www.socinvestigation.com Open in urlscan Pro
2a06:98c1:3120::3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Submission: On October 26 via manual (October 26th 2022, 11:53:33 pm UTC) from US — Scanned from NL

Summary HTTP 267 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 39 IPs in 9 countries across 37 domains to perform 267 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.socinvestigation.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 22nd 2022. Valid for: a year.

This is the only time www.socinvestigation.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
67	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	205.185.216.10 205.185.216.10	20446 (STACKPATH...) (STACKPATH-CDN)
26	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
22	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	147.75.85.234 147.75.85.234	54825 (PACKET) (PACKET)
15	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
1 35	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
1 10	2a00:1450:400... 2a00:1450:4001:80b::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
9 32	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
4 8	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
3 5	185.89.211.84 185.89.211.84	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2607:f8b0:400... 2607:f8b0:4004:c1b::78	15169 (GOOGLE) (GOOGLE)
1	74.125.133.157 74.125.133.157	15169 (GOOGLE) (GOOGLE)
4	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::2006	15169 (GOOGLE) (GOOGLE)
1 2	54.229.2.193 54.229.2.193	16509 (AMAZON-02) (AMAZON-02)
1 2	2606:4700::68... 2606:4700::6812:19ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	34.91.62.186 34.91.62.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	37.157.6.247 37.157.6.247	198622 (ADFORM) (ADFORM)
2 2	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	69.166.1.12 69.166.1.12	27630 (AS-XFERNET) (AS-XFERNET)
2 3	51.89.9.253 51.89.9.253	16276 (OVH) (OVH)
1 2	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
1	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
2 2	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4 4	216.52.2.30 216.52.2.30	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
3 3	34.252.9.30 34.252.9.30	16509 (AMAZON-02) (AMAZON-02)
3 3	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	23.11.239.181 23.11.239.181	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400e:4d::8	15169 (GOOGLE) (GOOGLE)
3	23.35.237.151 23.35.237.151	16625 (AKAMAI-AS) (AKAMAI-AS)
1	3.126.163.185 3.126.163.185	16509 (AMAZON-02) (AMAZON-02)
1 2	2620:116:800d... 2620:116:800d:21:b314:a0ef:ab7c:d546	16509 (AMAZON-02) (AMAZON-02)
2 2	3.123.150.182 3.123.150.182	16509 (AMAZON-02) (AMAZON-02)
1 1	151.101.194.49 151.101.194.49	54113 (FASTLY) (FASTLY)
1	66.155.71.150 66.155.71.150	13768 (COGECO-PEER1) (COGECO-PEER1)
2	3.75.3.113 3.75.3.113	16509 (AMAZON-02) (AMAZON-02)
2 2	18.194.101.27 18.194.101.27	16509 (AMAZON-02) (AMAZON-02)
8	2a00:1450:400... 2a00:1450:4001:82b::2006	15169 (GOOGLE) (GOOGLE)
1	2a02:fa8:8806... 2a02:fa8:8806:12::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
267	39

67 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

www.socinvestigation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map2.hwcdn.net

cdn.hooliganmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 216.58.212.162 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.85.234 (Schiphol, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

35 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:80b::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 172.217.18.2 (United States) 9 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.80.39.216 (Canada) 4 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.89.211.84 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1b::78 (Washington, United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.133.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wo-in-f157.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.229.2.193 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-2-193.eu-west-1.compute.amazonaws.com

cbsi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:19ad (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.91.62.186 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.62.91.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.6.247 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.19.126 (Shahr, Iran, Islamic Republic Of) 2 redirects

ASN13335 (CLOUDFLARENET, US)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.166.1.12 (United States)

ASN27630 (AS-XFERNET, US)

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 51.89.9.253 (London, United Kingdom) 2 redirects

ASN16276 (OVH, FR)
PTR: ip253.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.78 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.52.2.30 (United States) 4 redirects

ASN32475 (SINGLEHOP-LLC, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.252.9.30 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-9-30.eu-west-1.compute.amazonaws.com

match.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.126.56.137 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.11.239.181 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-11-239-181.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

gcdn.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400e:4d::8 (Ireland)

ASN15169 (GOOGLE, US)

r3---sn-5hnekn7z.c.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.35.237.151 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-151.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.126.163.185 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-163-185.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:b314:a0ef:ab7c:d546 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.123.150.182 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-150-182.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.155.71.150 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.75.3.113 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-3-113.eu-central-1.compute.amazonaws.com

cs.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.194.101.27 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-101-27.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:82b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:12::1400 (Singapore)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
75	doubleclick.net 9 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 188 googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 cm.g.doubleclick.net — Cisco Umbrella Rank: 215 bid.g.doubleclick.net — Cisco Umbrella Rank: 444 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 317 static.doubleclick.net — Cisco Umbrella Rank: 323	1 MB
67	googlesyndication.com 1 redirects pagead2.googlesyndication.com — Cisco Umbrella Rank: 104 c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 147	1005 KB
67	socinvestigation.com www.socinvestigation.com	2 MB
14	gstatic.com fonts.gstatic.com www.gstatic.com csi.gstatic.com	199 KB
11	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 78 www.google.com — Cisco Umbrella Rank: 2	2 KB
10	casalemedia.com 6 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 542 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 439	8 KB
7	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 193	325 KB
7	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 44 imasdk.googleapis.com — Cisco Umbrella Rank: 435	132 KB
5	2mdn.net 1 redirects s0.2mdn.net — Cisco Umbrella Rank: 273 gcdn.2mdn.net — Cisco Umbrella Rank: 933 r3---sn-5hnekn7z.c.2mdn.net — Cisco Umbrella Rank: 598766	236 KB
5	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 232	5 KB
4	lijit.com 4 redirects ap.lijit.com — Cisco Umbrella Rank: 599	3 KB
3	moatads.com z.moatads.com — Cisco Umbrella Rank: 404 px.moatads.com — Cisco Umbrella Rank: 481	104 KB
3	yahoo.com 3 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 294	1 KB
3	360yield.com 3 redirects match.360yield.com — Cisco Umbrella Rank: 2893	1 KB
3	onetag-sys.com 2 redirects onetag-sys.com — Cisco Umbrella Rank: 777	820 B
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 303	2 KB
2	emxdgt.com cs.emxdgt.com — Cisco Umbrella Rank: 1055	100 B
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 765	2 KB
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 729	796 B
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1137	458 B
2	pubmatic.com 2 redirects image6.pubmatic.com — Cisco Umbrella Rank: 671	1 KB
2	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 766 r.turn.com — Cisco Umbrella Rank: 3362	869 B
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 627	1 KB
2	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 828 s.tribalfusion.com — Cisco Umbrella Rank: 2234	1 KB
2	demdex.net 1 redirects cbsi.demdex.net — Cisco Umbrella Rank: 7837	2 KB
1	ctnsnet.com 1 redirects gcm.ctnsnet.com — Cisco Umbrella Rank: 40043	607 B
1	dotomi.com dclk-match.dotomi.com — Cisco Umbrella Rank: 2865	104 B
1	sitescout.com pixel-sync.sitescout.com — Cisco Umbrella Rank: 602	191 B
1	everesttech.net 1 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 578	535 B
1	agkn.com d.agkn.com — Cisco Umbrella Rank: 651	650 B
1	openx.net rtb.openx.net — Cisco Umbrella Rank: 1521	351 B
1	sonobi.com sync.go.sonobi.com — Cisco Umbrella Rank: 983	500 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 841	713 B
1	google.nl adservice.google.nl — Cisco Umbrella Rank: 14180	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 888	701 B
1	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 924	283 B
1	hooliganmedia.com cdn.hooliganmedia.com — Cisco Umbrella Rank: 194787	191 KB
267	37

	Domain	Requested by
67	www.socinvestigation.com	www.socinvestigation.com
35	tpc.googlesyndication.com	1 redirects pagead2.googlesyndication.com www.socinvestigation.com c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com tpc.googlesyndication.com securepubads.g.doubleclick.net googleads.g.doubleclick.net imasdk.googleapis.com
32	cm.g.doubleclick.net	9 redirects googleads.g.doubleclick.net c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
26	pagead2.googlesyndication.com	www.socinvestigation.com pagead2.googlesyndication.com tpc.googlesyndication.com c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
22	securepubads.g.doubleclick.net	cdn.hooliganmedia.com securepubads.g.doubleclick.net c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com www.socinvestigation.com www.googletagservices.com
10	www.google.com	1 redirects www.socinvestigation.com tpc.googlesyndication.com securepubads.g.doubleclick.net c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
8	static.doubleclick.net	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
8	googleads.g.doubleclick.net	pagead2.googlesyndication.com c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com www.socinvestigation.com
8	fonts.gstatic.com	fonts.googleapis.com
7	www.googletagservices.com	www.socinvestigation.com securepubads.g.doubleclick.net c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
6	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
5	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
5	fonts.googleapis.com	www.socinvestigation.com c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
4	ap.lijit.com	4 redirects
4	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
4	www.gstatic.com	www.socinvestigation.com c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
3	ups.analytics.yahoo.com	3 redirects
3	match.360yield.com	3 redirects
3	onetag-sys.com	2 redirects
2	px.moatads.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
2	x.bidswitch.net	2 redirects
2	cs.emxdgt.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
2	pm.w55c.net	2 redirects
2	cms.quantserve.com	1 redirects c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
2	r3---sn-5hnekn7z.c.2mdn.net
2	sync.teads.tv	1 redirects c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
2	image6.pubmatic.com	2 redirects
2	ssum-sec.casalemedia.com	2 redirects
2	c1.adform.net	2 redirects
2	cbsi.demdex.net	1 redirects c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
2	s0.2mdn.net	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
2	csi.gstatic.com	imasdk.googleapis.com
2	imasdk.googleapis.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
1	gcm.ctnsnet.com	1 redirects
1	dclk-match.dotomi.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
1	pixel-sync.sitescout.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
1	sync-tm.everesttech.net	1 redirects
1	d.agkn.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
1	z.moatads.com	googleads.g.doubleclick.net
1	gcdn.2mdn.net	1 redirects
1	rtb.openx.net	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
1	r.turn.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
1	ad.turn.com	1 redirects
1	sync.go.sonobi.com	c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
1	um.simpli.fi	1 redirects
1	s.tribalfusion.com
1	a.tribalfusion.com	1 redirects
1	bid.g.doubleclick.net	imasdk.googleapis.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.nl	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	prebid.a-mo.net	cdn.hooliganmedia.com
1	cdn.hooliganmedia.com	www.socinvestigation.com
267	54

This site contains links to these domains. Also see Links.

Domain
facebook.com
www.instagram.com
www.linkedin.com
www.abuseipdb.com
dnstwister.report
sitecheck.sucuri.net
urlhaus.abuse.ch
web.archive.org
hooliganmedia.com
twitter.com
github.com
www.facebook.com
pinterest.com
telegram.me
reddit.com
api.whatsapp.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-22` - `2023-05-22`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
hooliganmedia.com E1	`2022-09-30` - `2022-12-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.a-mo.net R3	`2022-09-05` - `2022-12-04`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.google.nl GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.go.sonobi.com Go Daddy Secure Certificate Authority - G2	`2021-12-08` - `2023-01-09`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-11-27` - `2022-11-29`	a year	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-09-06` - `2023-09-21`	a year	crt.sh
*.c.docs.google.com GTS CA 1C3	`2022-09-27` - `2022-12-06`	2 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
*.sitescout.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2021-12-15` - `2023-01-15`	a year	crt.sh
*.emxdgt.com Go Daddy Secure Certificate Authority - G2	`2022-05-18` - `2023-06-19`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2022-08-09` - `2023-09-10`	a year	crt.sh

This page contains 26 frames:

Primary Page: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Frame ID: 1453E4F798FB62D0EC0CB0658A5ED2A7
Requests: 106 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221025/r20190131/zrt_lookup.html
Frame ID: 293725EBC193ABE07A2F012C076FF4E1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&adk=1812271804&adf=3025194257&lmt=1666807359&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1666828404914&bpp=2&bdt=487&idt=286&shv=r20221025&mjsv=m202210170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1708984196510&frm=20&pv=2&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44775017&oid=2&pvsid=1423218013319643&tmod=1245212830&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=317
Frame ID: E45C070DF6C48D204E9BF68AFFF8CAB4
Requests: 1 HTTP requests in this frame

Frame: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 968F0971F639040C0267B1322EB161BB
Requests: 1 HTTP requests in this frame

Frame: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E6CAA8DBBB558647C8E1DB80F6C8B309
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: C4CC6D4B6B2084089048C973B4ADE357
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 1AA6A147EA7C758B4361B7246AAE0DAE
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C3B7CD5409C420374B04B1B7907B5CA0
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 8A8C290AB7E464A7BB3E5DE7A407C010
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite_fy2021.js
Frame ID: 109630FE06B815F77C1268CC5D0F03F6
Requests: 5 HTTP requests in this frame

Frame: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 19289A7A6843AB5BCA07C5B0BA225AD9
Requests: 18 HTTP requests in this frame

Frame: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 14F8D8EBABCB2B3D09084A65F04801A4
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNix6QEQo4r5ARjs9bzUATAB&v=APEucNVVENYpfh0OrBoePPkbctoWhSYg7egnlG2MKGA77kZtMRc2_X9b9n93Akx17fLVqzgWznw4c0QfoQXqdI5fIptvpxJTvD35a6eEe7m8Imi0G0NNLV5MBo7hebd1GqlMCid5dvJ_x4wlXDd61BN5radP_QBTHyyHOoJ2ZsB0DapuW1iU4L95wRwsZmqGC-NfyIPQmj3I
Frame ID: 163E02E11D6DDFC9025D7F684D3186DC
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 94CF00A98A9E65D11F73D784C6334A2A
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 555974CD2E2AA1777D4AF7CADC0E16FA
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 94697EB0C254C48D3A31143AC5C9A78A
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Frame ID: 64816095441F3EE7D08FDA77F1191885
Requests: 3 HTTP requests in this frame

Frame: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 8CD4D85BD3A30A8C21DB88216E322E00
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP651wIQprvuAhjRiYjTATAB&v=APEucNXnvt2_zc99go4pCc3-C-kLiwi0OuBViEGAVg-VgkWf7iRgH4nIyJ499Vc5fLbR9MOUfmuagX_7AHp7fESawM-GFIOsPtjO9vrDsENT8Q6F7wnwpT0lL73WjMvyJrpKQDcSAmPvZWw--upssUUhYwXaXJhN9dMmbxnrd2gYlFIlD0WU3H_Sfnhnd8y61Eb4nuNeuDh-
Frame ID: 2751E23882A41D5FD9378BC5DAE1CF7D
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 4D74C9D31529EBFD85D7627E4D133A9A
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 7D7190E488B3A644D3C409ED6E8574D6
Requests: 3 HTTP requests in this frame

Frame: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 69B605AF987AFF88D0E99A3BBB5A8B33
Requests: 22 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 4F2A8D60DA340B5A9B7B168C75F98B29
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js
Frame ID: 70F159B0068E8674DDD5A21A04D4C5C9
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssI4yLHsKpB1wycWizjO9Al1_Oe2dCkPoitdmeo-cD6WxZPlmpL5AaQttUzApFmcyoaA2R-mJuR2FRkeeKKlFAHgQN9Dmyw73J3KqV3faiOjEHm5OKxhkPLAdyFqxaFJY442loDqR0SyNnLeBiszXOrzZJ8KyhamMl7nbFgbAwQWWMXwLo0tFWDhnXp_SS2IrLeEYSZZYxcGH-w2o4vuH5P4bV9xlvZnV38tuwpfi6L_2XRCp5w7C8r6PMegTN0oI_KQ-Cpo-8T3nMrS8ree4YM3wCbza4Rq_K_DrKTEdk9I_jayt5dK3gIFHjq0U3Pb4WCbmQ&sai=AMfl-YQdhpH7CmUX-wN-KMzKKYjHxHn1OFQAFiHOmJHv3luXxTUZxOfW52D02yycUwpCOMMucnsmAz2x5T3jbMc4IMnArJV9pPhumir9-Uu8iJ6UCXWuV9WRJ8_gsIZqiwX1&sig=Cg0ArKJSzOJbksOTLzTWEAE&uach_m=[UACH]&adurl=
Frame ID: 406B64EDCEA379C692BF3D096AEAC223
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvBmVp_tgtDnFi4Gj-m-o6UBmIY-antZeVbeRI1VACWuMztI03W0wVBY43pX_8_06fKBq0t2UfS4Q0w0n1fMm1nAy4w9EgUcNTmiUIqDcYxK3ztC0fI9mql63yS9ygYEZuO2rBfXlD8ES9mwhhKX7iAf3wB3QtYihfmdyLgoAZD0xoZXgAYEq3J0SmSzCbxvcBrPTcNN5qv4sOPq8UKMKnWqoo27fpwM8A21f4qKJ_ojG3Gk1YMrXCjzK5dpuYFLHsZ-GGC6KQeL46UHoO4M1HeBGCBRzAwmPheM_fU4a9KRTlYJ94yKmuT9nNMQaS9FceAa-FMOpshRqGE&sai=AMfl-YQAtM5AG3aA04eEsi4DDZ3BnwIdnk5pWKfC3O_TiDRWm8Ni1B7kggVBUk9Ytd_WGarsx0pT50T-CS7DIfDMUo7tiLxmLoES3gwTVMtl_S5x4mmMj0NGLZ0R_3MuH2As&sig=Cg0ArKJSzJDdRDDnR7SqEAE&uach_m=[UACH]&adurl=
Frame ID: 08D42228FC8AEB734E446C4589DAC463
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Mapping MITRE ATT&CK with Window Event Log IDs - Security Investigation

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

RightJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

right\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

267
Requests

88 %
HTTPS

44 %
IPv6

37
Domains

54
Subdomains

39
IPs

9
Countries

5576 kB
Transfer

10013 kB
Size

38
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://facebook.com/cyberaptadmin/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/soc_investigation

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/soc-investigation

Search URL Search Domain Scan URL

URL: https://www.abuseipdb.com/
Title: AbuseIPDB

Search URL Search Domain Scan URL

URL: https://dnstwister.report/
Title: Phishing Domain Search

Search URL Search Domain Scan URL

URL: https://sitecheck.sucuri.net/
Title: Sucuri Web Malware

Search URL Search Domain Scan URL

URL: https://urlhaus.abuse.ch/
Title: Urlabuse

Search URL Search Domain Scan URL

URL: https://web.archive.org/
Title: WebPage Historic Checks

Search URL Search Domain Scan URL

URL: https://hooliganmedia.com/?utm_source=hms
Title: Powered by Hooligan Media

Search URL Search Domain Scan URL

URL: https://twitter.com/mdecrevoisier
Title: mdecrevoisier

Search URL Search Domain Scan URL

URL: https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack
Title: https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/&title=Mapping+MITRE+ATT%26CK+with+Window+Event+Log+IDs
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Mapping+MITRE+ATT%26CK+with+Window+Event+Log+IDs&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&via=Security+Investigation
Title: Twitter

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/&media=https://www.socinvestigation.com/wp-content/uploads/2022/05/Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1.jpg&description=Mapping+MITRE+ATT%26CK+with+Window+Event+Log+IDs
Title: Pinterest

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/&text=Mapping+MITRE+ATT%26CK+with+Window+Event+Log+IDs
Title: Telegram

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/&title=Mapping+MITRE+ATT%26CK+with+Window+Event+Log+IDs
Title: ReddIt

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Mapping+MITRE+ATT%26CK+with+Window+Event+Log+IDs%20%0A%0A%20https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Title: WhatsApp

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 102

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 148

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&C=1

Request Chain 149

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y1nId2VlQafzC7SYC6QH.AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&google_hm=2

Request Chain 150

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEPxqXSWnjaKVNkAo9YZy-Ok&google_cver=1

Request Chain 151

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D

Request Chain 165

https://cbsi.demdex.net/event?d_sid=20571141 HTTP 302
https://cbsi.demdex.net/firstevent?d_sid=20571141

Request Chain 166

https://a.tribalfusion.com/i.match?p=b6&u=CAESEM4Yb4CidyKm8GyeDZuPk2c&google_cver=1&google_push=AZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEM4Yb4CidyKm8GyeDZuPk2c&google_cver=1&google_push=AZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 167

https://um.simpli.fi/gp_match?google_gid=CAESEOCEheeXthmLz7OcwedWn78&google_cver=1&google_push=AZmPxg-Vh4zot88pCN6vhmmzGa12KvINE-zmytRGn5WGlzCujcsbc_rGqQZoEPEmYAZudb_KCyGorN08uj0ga_p5uS7Wml-dK58 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B0094347CD66430CACCAEE55B36AA9E8&google_push=AZmPxg-Vh4zot88pCN6vhmmzGa12KvINE-zmytRGn5WGlzCujcsbc_rGqQZoEPEmYAZudb_KCyGorN08uj0ga_p5uS7Wml-dK58

Request Chain 168

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHs7gMJAKhnwX8cH6LYRSKc&google_cver=1&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-zAMqHylC-XDdvHKrOLYsXoUw HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEHs7gMJAKhnwX8cH6LYRSKc&google_cver=1&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-zAMqHylC-XDdvHKrOLYsXoUw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDYwNTI4NDY4OTU5NDgxNjQxNg&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-zAMqHylC-XDdvHKrOLYsXoUw

Request Chain 169

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_cver=1&google_push=AZmPxg_DjFZlu2S7wTcjVSK1DgqonRgSKxI7nflxcUDOZg2SYbrn91wYyTbzycwkR2KZNZaQ1lk-QC0s34Q6fVr2yk6PoLD0Zw HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_push=AZmPxg_DjFZlu2S7wTcjVSK1DgqonRgSKxI7nflxcUDOZg2SYbrn91wYyTbzycwkR2KZNZaQ1lk-QC0s34Q6fVr2yk6PoLD0Zw&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_hm=Y1nIdxaoPA5amw2iG35YfQAAFA8AAAIB&google_nid=index&google_push=AZmPxg_DjFZlu2S7wTcjVSK1DgqonRgSKxI7nflxcUDOZg2SYbrn91wYyTbzycwkR2KZNZaQ1lk-QC0s34Q6fVr2yk6PoLD0Zw

Request Chain 171

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEIqLliUFiqXTbYwyWjerMXE&google_cver=1&google_push=AZmPxg-XrZK7p2jNmU0rhRPbuyZtD9NefaL3QH6tZ27RtAJlfZFJjlXJtWg8YYFvavAP5wx2jrn88pODCmNSrYHDmTIBE2-AVI0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AZmPxg-XrZK7p2jNmU0rhRPbuyZtD9NefaL3QH6tZ27RtAJlfZFJjlXJtWg8YYFvavAP5wx2jrn88pODCmNSrYHDmTIBE2-AVI0

Request Chain 172

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEIqLliUFiqXTbYwyWjerMXE&google_cver=1&google_push=AZmPxg_9Nguzsa9Zc9KIW5BZ6wU53hm7_Xpvci6Z6KkwAx-gadR1EUASO_yyUSHFXIp_Jig4W0JH7jtPnXCJqcJ2zUidValf1u5A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AZmPxg_9Nguzsa9Zc9KIW5BZ6wU53hm7_Xpvci6Z6KkwAx-gadR1EUASO_yyUSHFXIp_Jig4W0JH7jtPnXCJqcJ2zUidValf1u5A HTTP 302
https://onetag-sys.com/match/?int_id=19&google_error=5

Request Chain 177

https://ad.turn.com/r/cs?pid=3&google_gid=CAESELDB3y7ZTi5PdUc3zumzONs&google_cver=1&google_push=AZmPxg_jRv2gN8oh7CFTbq5CK3XFT3rEVCcVO1lOByuEqluPggsbvHoZ2DDtOwpmFJ0mchsNt8ujcagNIDwny_Eu1rWa-bDmRVw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzAyMDg4NjQ0MjkzMTEwMzgwMA==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELDB3y7ZTi5PdUc3zumzONs&google_cver=1

Request Chain 179

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEISrJR5XvLo4phbmC9_BpCQ&google_cver=1&google_push=AZmPxg-lI6TFD_rv6QcCgv8nEQy7PWdCll8F1smz1ILYkJElUtxPjSFOWCCGTWC3VnhX6PoV6lvw4Zq55jmQZeREbI0KMxjuhVzO HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEISrJR5XvLo4phbmC9_BpCQ&google_cver=1&google_push=AZmPxg-lI6TFD_rv6QcCgv8nEQy7PWdCll8F1smz1ILYkJElUtxPjSFOWCCGTWC3VnhX6PoV6lvw4Zq55jmQZeREbI0KMxjuhVzO&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=P54U4UwPRq2CKzgQKG5fdA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg-lI6TFD_rv6QcCgv8nEQy7PWdCll8F1smz1ILYkJElUtxPjSFOWCCGTWC3VnhX6PoV6lvw4Zq55jmQZeREbI0KMxjuhVzO

Request Chain 180

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBjOJryhS2Vx4IqvW9ythnE&google_cver=1&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhkyuMJiafmIvc HTTP 307
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBjOJryhS2Vx4IqvW9ythnE&google_cver=1&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhkyuMJiafmIvc&sovrn_retry=true HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhkyuMJiafmIvc&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

Request Chain 181

https://match.360yield.com/match/ebda?google_gid=CAESEFlBkeeCWxoiDCfae4KZdrQ&google_cver=1&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2fkYR2vB3tlcqaq HTTP 302
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEFlBkeeCWxoiDCfae4KZdrQ&google_cver=1&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2fkYR2vB3tlcqaq HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2fkYR2vB3tlcqaq

Request Chain 182

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAsyL-gbILEW07k5u84fqAo&google_cver=1&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajGgBrLgAgPLn5JsU-UJe9N04FJNySMFqHJOWLA3xdHLLOeA HTTP 302
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAsyL-gbILEW07k5u84fqAo&google_cver=1&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajGgBrLgAgPLn5JsU-UJe9N04FJNySMFqHJOWLA3xdHLLOeA&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajGgBrLgAgPLn5JsU-UJe9N04FJNySMFqHJOWLA3xdHLLOeA

Request Chain 183

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEG5N1mRVHT7LdIf0ZZjLKpg&google_cver=1&google_push=AZmPxg_gUFixVyuh9j37fKHgl8Ic3Lj6Dkd6Aefrhi9LCCHypiuaVRckuIY0b3NNXc8cQNJ6oJaRmoBCUXgfN7ZhpVU3A3i9ufRWwg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AZmPxg_gUFixVyuh9j37fKHgl8Ic3Lj6Dkd6Aefrhi9LCCHypiuaVRckuIY0b3NNXc8cQNJ6oJaRmoBCUXgfN7ZhpVU3A3i9ufRWwg HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 186

https://gcdn.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/8A743AC1EFD1E92829FEFD4E752A5106DCF4B67E.ADB2840031C364D633153C25E0E237A197B3BA50/key/ck2/file/file.mp4 HTTP 302
https://r3---sn-5hnekn7z.c.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/61549FEF6CCC71126218645FB0E9A33628E11F36.3C739323E8BA61D013B2FC80478EADBAE27410CF/key/cms1/cms_redirect/yes/mh/Fh/mip/2a00:1630:2:1c03::15/mm/42/mn/sn-5hnekn7z/ms/onc/mt/1666828146/mv/u/mvi/3/pl/32/file/file.mp4

Request Chain 200

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1

Request Chain 201

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y1nId2VlQafzC7SYC6QH.QAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1&google_hm=2

Request Chain 202

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEA4OrYptjKmx4VXoGLiqnpU&google_cver=1

Request Chain 203

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D

Request Chain 217

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&google_cver=1&google_push=AZmPxg8ADxYMU18LSrUM5CQBy4iBSkM9C72faFtPM_6Sr61wZ5fSPHWOwsMB2DWdR6in5xkqdGMPycRCx07khh5OOzl6XBL9_Y6W HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&google_cver=1&google_push=AZmPxg8ADxYMU18LSrUM5CQBy4iBSkM9C72faFtPM_6Sr61wZ5fSPHWOwsMB2DWdR6in5xkqdGMPycRCx07khh5OOzl6XBL9_Y6W HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MkZISGd1dVgxT05RZDk1&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&google_cver=1&google_push=AZmPxg8ADxYMU18LSrUM5CQBy4iBSkM9C72faFtPM_6Sr61wZ5fSPHWOwsMB2DWdR6in5xkqdGMPycRCx07khh5OOzl6XBL9_Y6W

Request Chain 218

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEGzCi6-4eIKOUmPhNeShEPs&google_cver=1&google_push=AZmPxg9kWddCuw8QfOzDBVNrzBLKvBn762Zk6zbl6ki2QRmXNwxhlAe3ZAab0aa7yfkDkg0tMRRcMrtkHS_wq8PGbdESbvk7zWE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGzCi6-4eIKOUmPhNeShEPs&google_push=AZmPxg9kWddCuw8QfOzDBVNrzBLKvBn762Zk6zbl6ki2QRmXNwxhlAe3ZAab0aa7yfkDkg0tMRRcMrtkHS_wq8PGbdESbvk7zWE

Request Chain 220

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEDxx4ob4uBzDI7LX6rWhMHw&google_cver=1&google_push=AZmPxg-adhBfQRnXtIPDjTY23srouwyuL3Iv6CmpzKKWydPqKA0AxCF3I4kN3hcBrHWjm-IAUaP0AkN7UVfML7pigBAv346axnGr HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-adhBfQRnXtIPDjTY23srouwyuL3Iv6CmpzKKWydPqKA0AxCF3I4kN3hcBrHWjm-IAUaP0AkN7UVfML7pigBAv346axnGr&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

Request Chain 222

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lbvKgJCIHKGGel1DPF4J-ezTVPp0gTrscRLIBRXCIU14OLfIWuDp5TtXIeY27g0fSDB_2A?google_gid=CAESECY0n8isMBs8lsZ7L4vjZH8&google_cver=1 HTTP 302
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lbvKgJCIHKGGel1DPF4J-ezTVPp0gTrscRLIBRXCIU14OLfIWuDp5TtXIeY27g0fSDB_2A?google_gid=CAESECY0n8isMBs8lsZ7L4vjZH8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=c779c061-83a9-436e-8adf-6e023bade620&&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lbvKgJCIHKGGel1DPF4J-ezTVPp0gTrscRLIBRXCIU14OLfIWuDp5TtXIeY27g0fSDB_2A

Request Chain 247

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKCfzLzSRRDYBBjYBDII6q-gdOZTvjE HTTP 301
https://tpc.googlesyndication.com/simgad/9201656655325074596

Request Chain 253

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECfdo9fVGJ6Qqe19lK1HbXI&google_cver=1&google_push=AZmPxg-9hkhdKh7G_jwsLMUe523DUHh3NqDzk2eUwvLEDEcDgCUGOYsmaZRm6UjNLucXy6ZGxNPjiem7VLDLTejEN4ItTZQSeUtP HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AZmPxg-9hkhdKh7G_jwsLMUe523DUHh3NqDzk2eUwvLEDEcDgCUGOYsmaZRm6UjNLucXy6ZGxNPjiem7VLDLTejEN4ItTZQSeUtP&google_hm=bRP3k1Al_N2EYGkLmcdhIw

Request Chain 255

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEAP-M927Bc7sUB55byM9Hvc&google_cver=1&google_push=AZmPxg8q7_gdLshJKENDMmQOhrhQ2n3-MY-nFik7f4U4ZpmFubFi489peNFSg3TYIytAgDE1LVj2o06L5pwDZa9daDZNM32I3zYS HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AZmPxg8q7_gdLshJKENDMmQOhrhQ2n3-MY-nFik7f4U4ZpmFubFi489peNFSg3TYIytAgDE1LVj2o06L5pwDZa9daDZNM32I3zYS&google_hm=e8sl0_5lQKyy8P1kcbTEVpA

Request Chain 256

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEGOmlvS-W1Z1FofN4-Cz4qQ&google_cver=1&google_push=AZmPxg8daEfGIrxuh6mSRby5wLTXfC94qqHXAbGINSr1RKD9jqDVGVWVpHkjh2_saej29LookoiMVgB8ox-XbTh0Uh3R9fi1znah HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg8daEfGIrxuh6mSRby5wLTXfC94qqHXAbGINSr1RKD9jqDVGVWVpHkjh2_saej29LookoiMVgB8ox-XbTh0Uh3R9fi1znah&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

Request Chain 257

https://match.360yield.com/match/ebda?google_gid=CAESECOFQ55G10X1irMvDh1q014&google_cver=1&google_push=AZmPxg9SUjptT4Np2wU1eeuNWbifs90vfjM8w9grnjbnEuVzohRsw0XRUjdzqnaOCyfuJxpGFhjoUM6gg4rUG--8QPfdfcMguEOa HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg9SUjptT4Np2wU1eeuNWbifs90vfjM8w9grnjbnEuVzohRsw0XRUjdzqnaOCyfuJxpGFhjoUM6gg4rUG--8QPfdfcMguEOa

Request Chain 258

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESENPchvVVG75QC9NH-wzlWXA&google_cver=1&google_push=AZmPxg9qjgFk3_tFkq0pQJij8HAONz3j5XPoEfhHmeYPWRo0ZPVWVB8KY1dFysWxO_Ub64b0ugK3fNCTQT5UqmUU1kgTMWeT6n5QUg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg9qjgFk3_tFkq0pQJij8HAONz3j5XPoEfhHmeYPWRo0ZPVWVB8KY1dFysWxO_Ub64b0ugK3fNCTQT5UqmUU1kgTMWeT6n5QUg

267 HTTP transactions
14 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/ 273 KB
37 KB 878ms
805ms Document
text/html 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1612e528df544acdb2987f4816f50a2f4032dd03fa5f8699e9b456ba9ceb81dd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 76071c72b8020a50-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 26 Oct 2022 23:53:24 GMT
last-modified: Wed, 26 Oct 2022 18:02:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tnrh1D5mv3jeZwE5%2F1N2eykLCVQDgALu1v7KcabW8nSk6vy4twyjX4imMxGYfTsqSErm0Vlz1n8wixIWh95dziRzXrJnYqntvbqEZ89DXeBQFm2LoLemwI%2F1geX1POUn9%2FDOC3bo63aZ8%2BuI7YL3yFhydd64ETw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding,User-Agent

GET
H2 200 style.min.css
www.socinvestigation.com/wp-includes/css/dist/block-library/ 87 KB
12 KB 39ms
31ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.3
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 12 Jul 2022 18:26:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 60254
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WKY52gvsVxkik%2F7forWZlJQqo7nLsHzETafd%2FPMXmsZo9Z8REXOoeAfzUjfaZiNW3Tbb%2FVtxYo0JjsZsd0hDFFyygaBEaZWO9qlpLEoqKugiqCEzF7H2%2BbCb%2FWa2tfal25scuMGsMAbzAQ8d0MLW0m9vQv9CNTo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c77df060a50-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 18 Oct 2023 00:51:17 GMT

GET
H2 200 email-subscribers-public.css
www.socinvestigation.com/wp-content/plugins/email-subscribers/lite/public/css/ 1 KB
954 B 46ms
39ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/email-subscribers/lite/public/css/email-subscribers-public.css?ver=5.4.17
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ca2151931b6171d626697be44acd541120b59d13418f1e3ce9965e66dd905df

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 56994
cf-polished: origSize=2141
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 19 Oct 2022 18:25:51 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GBaUwEsF9u3Ez2qwlM9ixDsbIJGJaHy8up%2FwobIQ8BvYhpugL%2FWT9ovZHvJPXZojTPm6BV2B7qG%2F0RBX07PMhB%2BEU%2BS8w6F1ZaZLWwn38hYoJIYRyM91UGaYhhTMeLZ%2FMCyWHziMSo1G6LugwO%2F6RkafylHqQO4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c77df0a0a50-AMS
expires: Thu, 19 Oct 2023 18:42:54 GMT

GET
H2 200 style.css
www.socinvestigation.com/wp-content/plugins/td-newsletter/ 5 KB
2 KB 46ms
40ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-newsletter/style.css?ver=11.5.1
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fda5ff8910b86411087b7c4c614e66b41eea77a892c9e816840f46c5fb8e9d2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63888
cf-polished: origSize=5464
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 04 Jul 2022 01:58:38 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3YL6ouaqoocRlmZB5wOeytcOnqpHJsHdOKybh1Qo8Fx%2FWDpsz8tc6UU6NW5XyRy8X%2BuJqloB8tmVFml9xMNwmKpA5X664vIwL9Wo1ICoKmKgw8wRhrXICCLoFa%2B3Q9tmFVDGdNcsWsVuHtKUo1kzmt1Z8efIRhg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c77df0b0a50-AMS
expires: Sat, 23 Sep 2023 06:29:47 GMT

GET
H2 200 style.css
www.socinvestigation.com/wp-content/plugins/td-composer/td-multi-purpose/ 36 KB
5 KB 39ms
33ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=6ea45b81e47c58269b68289d05535e19x
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb96d10b4b71a90568c571d4420edd4e2e38e7faf4eafe7f9adba5374c14fc60

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63888
cf-polished: origSize=37612
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 04 Jul 2022 02:22:14 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gusUrH1FRQVNx%2FWfcUlcGQY6uK68wP8UgQGckavhvLbLByoO4aiykF3u6jEXSSpYtjvyf3hfFn7V8A0InPRmykkH%2BTgyayWs0xD9TPwRTMcNhMyinRN58nBYZvZR43zcPG3WG12exJs71krryzRdkl0q1e6bW%2FQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c77df0e0a50-AMS
expires: Sat, 23 Sep 2023 06:29:47 GMT

GET
H2 200 css
fonts.googleapis.com/ 19 KB
2 KB 144ms
69ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%2C300%7CRoboto%3A400%2C500%2C700%2C300&display=swap&ver=11.5.1

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c943b419d090488721aca8e822663c98d7cb6cc483dae5636914088f059d8907

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 22:08:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Oct 2022 23:53:24 GMT

GET
H2 200 style.css
www.socinvestigation.com/wp-content/themes/Newspaper/ 105 KB
20 KB 39ms
34ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/themes/Newspaper/style.css?ver=11.5.1
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee1c191eca53bf9c56a2a13712a48ac9a3def467d15607be90fe26d5657a8fdf

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62716
cf-polished: origSize=150102
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 04 Jul 2022 01:56:17 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BsmkPiZBuM70WIoT%2BiI88xyAJUJhO6GTzm0JvaB2vlfrFotBGEnW4bgMnMCGeQzWBDZgxnxy%2B6R2GR9enUa4aQb63lS75yUb4DXfHi5UVLswSfLQwNL%2FAI51WFJfNLuTuL69dNFxBY9qc6CYElhLH1MKvsDcbGc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c77df0f0a50-AMS
expires: Sat, 23 Sep 2023 06:29:47 GMT

GET
H2 200 td_legacy_main.css
www.socinvestigation.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/ 129 KB
21 KB 63ms
59ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=6ea45b81e47c58269b68289d05535e19x
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47d0d2867473bc7627004dcdb05af0abc5fa4cb44a5592a50e412cb909377fe4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62716
cf-polished: origSize=162605
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 04 Jul 2022 02:21:55 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6poFUkzYd8%2Bdw4yNwHhJf9UC%2BM3%2BniWSrBHmcMMShlTSO4y1QIs5vpH5RUMHpmUv8IlldgseFYqYWiiFnbuO2bGGfVs1U2NRcuV7Y6BQLmQGyj5uE7iL%2FTCDk%2BsruA2tXsBm%2FraY4K9hED%2BFdFvubbSCfNJap3g%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c77df100a50-AMS
expires: Sat, 23 Sep 2023 06:29:47 GMT

GET
H2 200 td_standard_pack_main.css
www.socinvestigation.com/wp-content/plugins/td-standard-pack/Newspaper/assets/css/ 569 KB
52 KB 43ms
41ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-standard-pack/Newspaper/assets/css/td_standard_pack_main.css?ver=32b0396dacab6790bdbb765eba5d6338
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6956cbfddf2ce28aee043ecd2b7dbc3ada3954646d7009c6dd1b5ca173f136f9

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62716
cf-polished: origSize=732364
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 04 Jul 2022 02:00:01 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nRadtL92Xhu%2BQdXf71Y6zE5f4B37eUchHffmiMVNZ%2FFaojHB7pgqmvo45y%2Bo9bntjjLhSFfej8ljgVUQE992GGbZhoMpZZn64Qs5E3fkgRcFWCUQa6LmBd1JBte3jL1EN9aQgHp9scKaNQ5oGU19gsRElczitNY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c77df110a50-AMS
expires: Sat, 23 Sep 2023 06:29:47 GMT

GET
H3 200 jquery.min.js Show response
www.socinvestigation.com/wp-includes/js/jquery/ 87 KB
32 KB 33ms
32ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 22 Jul 2021 15:10:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v9QbMy5j8cMD1u%2BHdquhinoSiUB%2F75kdSeb3ebmSWJ%2FJ98QskAj%2BotckaArVRbjcir8aO2tYGZA4YS905QSzn3O7Z8dAoCJM0SFbXStYZn%2BCdXpngjru%2FQff5%2FDCsWvID%2FOfN2kSO%2BQFYLpxj8nQ%2FnpJKXmsNjo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c7879150a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 23 Sep 2023 06:29:47 GMT

GET
H3 200 jquery-migrate.min.js Show response
www.socinvestigation.com/wp-includes/js/jquery/ 11 KB
5 KB 32ms
31ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Jun 2021 07:01:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pVhWe4yjY1yfTmLc0I2GdeFyLVqyCfNy7Mb7B5csBahEySBvwOPg4rbPYHLSULUF58Izj2QtBadDfkXpS2jqng1hcJcC7qSnGCrU%2FyJSxI1bTyh5oAT5W7YUZ8jBwqBRICWLW1lc8mt023cCh2JNWTImm2MqVME%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c9670a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 23 Sep 2023 06:29:48 GMT

GET
H2 200 hmads0.js Show response
cdn.hooliganmedia.com/ 191 KB
191 KB 105ms
27ms Script
text/javascript 205.185.216.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.hooliganmedia.com/hmads0.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

205.185.216.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

2b6e18132b3e4c063dadb4994dc4bd9821d761b1123bf55bf1875b737f7787b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
last-modified: Tue, 04 Oct 2022 20:24:23 GMT
x-amz-request-id: tx000000000000135393c6b-006359c4e5-3f2ad568-nyc3c
etag: "397ce81c9f3b983cff524d2c0a2366c6"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-hw: 1666828404.dop151.am5.t,1666828404.cds240.am5.hn,1666828404.cds125.am5.c
content-type: text/javascript
cache-control: max-age=2689
x-rgw-object-type: Normal
accept-ranges: bytes
content-length: 195378

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 166 KB
54 KB 165ms
81ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1663975870032923

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

136ef8cd3222fdd91a301ea2b4218430b1cdbb6389d69f79013e92e49726984c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55176
x-xss-protection: 0
server: cafe
etag: 16208086719839270937
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 26 Oct 2022 23:53:24 GMT

GET
H3 200 email-decode.min.js Show response
www.socinvestigation.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 47ms
47ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.socinvestigation.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 18 Oct 2022 15:26:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"634ec5bc-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xmg7mzvylO3Kwez1r6TdXEEu4CkQcxn5hB6iNu5V2APlNc5rda9VCAA%2B7N%2FNyRuVjZtP2mc1n36SrJXddINm4Q62nmCGnKFL1ytHmvP907PE8zrnvwjOevrEyxKtkr72dAC%2Fcc5jRtLryTfG9%2BzwBOpONcZVJFI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 76071c78994b0a4c-AMS
expires: Fri, 28 Oct 2022 23:53:24 GMT

GET
H3 200 email-subscribers-public.js Show response
www.socinvestigation.com/wp-content/plugins/email-subscribers/lite/public/js/ 2 KB
1 KB 38ms
36ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/email-subscribers/lite/public/js/email-subscribers-public.js?ver=5.4.17
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a525a2e5c92b17dc4a7f505b744c4b28084c5e538c60f1573daef91777a7f64

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62716
cf-polished: origSize=4551
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 19 Oct 2022 18:25:51 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YP1LXjFQ5zv%2B2YcxSdOF8n%2BDekRWwsKQtFi1ATmHwVYdsYN0Hbdvph0di6PhG2xG5QqrBrnjBze%2BsegtwpmG75hPcHwzq%2BezM0y3PmOOV4MtnbkVhHJq7v2coiyAS%2FHMWSUvhaZtlur68uzCRBseUwnSbRRjn%2FM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c96a0a4c-AMS
expires: Thu, 19 Oct 2023 18:42:55 GMT

GET
H3 200 underscore.min.js Show response
www.socinvestigation.com/wp-includes/js/ 18 KB
8 KB 38ms
37ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-includes/js/underscore.min.js?ver=1.13.3
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0da4791b446818516f710c51707081aec7b23a7c5212fc0b2629c973210136a4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 02 Jun 2022 03:25:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7qPomvIZFuERaIcj5QrCqiJaIlpXnkxNqFMTURoafCcntlbfBbHHTjsDzUbdyUizGNDNJZ0DrGFqxE%2Fwcvah%2BL9qRlyq33FHyq1IbDpmYoekkp%2F6up8vkl9X%2BkwuESR43A2MPBkqs4DpQUYNTItCSP9kEw3AANc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c96d0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 23 Sep 2023 06:29:49 GMT

GET
H3 200 js_posts_autoload.min.js Show response
www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/ 5 KB
2 KB 43ms
42ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/js_posts_autoload.min.js?ver=4173294bcf58591c4439ff8ccd792f1ex
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cb5dcdb11eda07425f9584041552e161f7ff7395cf52d201e023dcd869157f2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 01:58:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sMcrnXoN7wzBZ1GXtWt4S%2BqDVJWwr5nj%2FU5u0i0YaWkJ1ZMkpPTjTAYbciYlnsebip67GHDUhfFJPu2aIWvtch0qrGzgfIa4RvRgPRWK%2FMT9GyC986dNtZLSHIhbKrsbhK87jNoM6pU%2F%2F2%2FSL%2B6JvkishMFqHfY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c9710a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 23 Sep 2023 06:29:48 GMT

GET
H3 200 tagdiv_theme.min.js Show response
www.socinvestigation.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 275 KB
64 KB 47ms
46ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=11.5.1
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 235be8bfdd19de9bbd0b0291b2b588b6c295093a33120f06d1e1b8803708c7fb

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 02:22:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qhqixwz9IAEYk4kZtL3S9IS9J5W4NYk2B988zrMzmQRw4AtwuUDFwlUXjCEUEEMnvJomhaEdq6owKKf5sM1M1k1kAggkeE6HeIGmbbyRhnzy10nvyhAXvVeADm%2Bf3yc%2BtGXHUfjPF4pwnPfckpA4DRfIvdCV2gg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c9730a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 23 Sep 2023 06:29:48 GMT

GET
H3 200 comment-reply.min.js Show response
www.socinvestigation.com/wp-includes/js/ 3 KB
2 KB 44ms
43ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-includes/js/comment-reply.min.js?ver=6.0.3
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 02 Jun 2022 03:25:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jSI73DdzEEweDvEA3kKUQzyJudoj9RKZ%2B6b2BWuMmhf3rBjgJcLkVYQ%2FT5jigJa6iVQTKepoKF8q5sbSlQei09vGhLfWertaLwSi%2FQxUB9Ozj1ihPpiwM1zjvok7Cew9kP4OLtuOdVLm%2FTcIcspKmenWJt5%2F6Co%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c9760a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 18 Oct 2023 00:52:45 GMT

GET
H3 200 js_files_for_front.min.js Show response
www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/ 41 KB
10 KB 45ms
44ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/js_files_for_front.min.js?ver=4173294bcf58591c4439ff8ccd792f1ex
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cda5f084c2c6f858fafe20b03ed46c19082233f70cb20282f1090ac1a2415719

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 01:58:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5TuTejOH%2F7G1%2Fk%2F%2FbfVrYBpQz7x8ejnhDatdIGY0qU2Npq9LYwWNW6xT5Hi50iwQ7NRoeY%2FL5XUu1t%2BcI76xnG9FVLC6ADiW0kKPyMMUVLnahO5pYt6WLfeAFJNws8mq5K4yPGVQHAtSAU%2FWQEd6ytJtKJbd5ew%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c9780a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 23 Sep 2023 06:29:49 GMT

GET
H3 200 float-left-right.js Show response
www.socinvestigation.com/wp-content/plugins/devvn-float-left-right-ads/left-right-ads/ 2 KB
1 KB 72ms
71ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/devvn-float-left-right-ads/left-right-ads/float-left-right.js?ver=1.0.7
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bd6ef384f95c63760a90ab5e6d0ddc45ecee28a134fd869dd7d6ff629a7b274

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62716
cf-polished: origSize=1951
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 21 Jul 2021 12:41:59 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7clNRgyUIzKmasm82KZVC7JPnGoePiLOwv1e5RG7S5FKr7wTJFLahdMDOGF5HsK%2BVAXD2yg1hiUzhpEFO6y%2FK3eYZ6u%2FaT9rpoatpovIVszrd1GH7NyOyzLdQRD0kvIK%2Fc1FsYPioLnZaZ2T6%2FvFh4J8SW66yiw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c9790a4c-AMS
expires: Sat, 23 Sep 2023 06:29:49 GMT

GET
H3 200 lazyload.min.js Show response
www.socinvestigation.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 8 KB
3 KB 73ms
72ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 05:59:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62716
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2x85p37JIaj2tV06yeEI1bJGkubZmCZzJemsvRgpY0Psuu%2Bs4Z4e4QMpfETo4B9bcWHJCnQuLUe9J4OMrN40sDxCmuUWTULexkEODMY1PwPwACZ%2Fm2%2BboWdeSp1q%2FjGCKFGkVKbfyNLBuwp%2BRFBYlQW%2F7gJ9vAQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 76071c78c97a0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 23 Sep 2023 06:29:49 GMT

GET
H3 200 newspaper.woff
www.socinvestigation.com/wp-content/themes/Newspaper/images/icons/ 28 KB
20 KB 67ms
67ms Font
application/font-woff 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/themes/Newspaper/images/icons/newspaper.woff?20
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/themes/Newspaper/style.css?ver=11.5.1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c70da34747fb31860fa118ff5d6736f81661838a0f50f077aa29d63ad7b00e4a

Request headers

Referer: https://www.socinvestigation.com/wp-content/themes/Newspaper/style.css?ver=11.5.1
Origin: https://www.socinvestigation.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 01:56:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 52538
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UfNPbwoU163FFkcbPvvIiWBKKVW0o2S4wKUeBv0NOmFI6SPM0UBBYOHCj6DwVz5KNMqEqDFmHrwKQUq73N45LCxZvexKeTWgLsWGC3%2FApuYk8Vd9gZBYgOi8QAFfEOH49D7xbeq%2BAN31qZyj4u%2F34mWdaEwiiI8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
cache-control: max-age=31536000
cf-ray: 76071c78c9810a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 25 Nov 2022 09:09:10 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 134ms
57ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%2C300%7CRoboto%3A400%2C500%2C700%2C300&display=swap&ver=11.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.socinvestigation.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 18:50:34 GMT
x-content-type-options: nosniff
age: 190970
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 Oct 2023 18:50:34 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 198ms
127ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%2C300%7CRoboto%3A400%2C500%2C700%2C300&display=swap&ver=11.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.socinvestigation.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 13:14:53 GMT
x-content-type-options: nosniff
age: 470311
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Oct 2023 13:14:53 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 191ms
131ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%2C300%7CRoboto%3A400%2C500%2C700%2C300&display=swap&ver=11.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.socinvestigation.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 05:09:29 GMT
x-content-type-options: nosniff
age: 499435
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Oct 2023 05:09:29 GMT

GET
DATA 200
OK truncated
/ 70 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44c4ed1af3bdda941698f1c946b68b6662aceb96ea833c246a4ae3a2cc420151

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c3cb71138ba89f1cf2419b37b83b35f896ec41631b116926520ae31541fd9bb

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 121 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4af2b962e68f5848d571c9faca60d5c26db34d3dd1d027323a38c7665479d76a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c1b2722be99e0f2c4cd70c48f342eb543a3ee0bec1b5dc6f1d72b034e013b47

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 178ms
170ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%2C300%7CRoboto%3A400%2C500%2C700%2C300&display=swap&ver=11.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.socinvestigation.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 20:10:25 GMT
x-content-type-options: nosniff
age: 13379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 20:10:25 GMT

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0ea2fa35271c78084c0244430b865af459ba144154779a691b70fedb0a3f0e8

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 ezgif-frame-008.png
www.socinvestigation.com/wp-content/uploads/2021/10/ 1 MB
1 MB 31ms
30ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/10/ezgif-frame-008.png
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bfed7fcc395671d82ccbeab04b29455102a75310511cd6ebfd951cbe5e0ae8b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:24 GMT
cf-cache-status: HIT
last-modified: Sun, 03 Oct 2021 02:30:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62715
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7p0tj4rqirHIWiDjottJuA6nBixhHf7ht16QQgJ0Rz8E3B17xlGqk7RWCnLQJDuRGcuJ0wsCWY5hg9QqTAI49fP0C8QlBtbutSUXz4HCkGWCc0kclkg60Gx%2FWrK5YZLPjgzXx%2BjUmee%2FeT64cNxQomF0U%2FFW48c%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7a1b430a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1474376
expires: Sat, 21 Jan 2023 06:29:50 GMT

GET
H3 200 Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-696x391.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 22 KB
23 KB 235ms
235ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-696x391.jpg
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62f3acb0192b1e8f397ad3f646ed9ef1f00fd933e52519963b676fcada9e16cb

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 16 May 2022 00:57:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7%2BjZuXy2HiBHvF99KyG5w6ChXKwMJyCvH7xuHGK7RSVbK7X1GlBdNuPsoZCx9EE3lWk%2FwxqzWsoxvwonfynK5gpJDhHG%2FUh5fncR%2FCsT9qAw8vABNuFkjEPcqt4fYOv6nv%2B8Pn0KWiGAU%2Botmc9VgxNUVqnjmYE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7a1b440a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 23031
expires: Sat, 21 Jan 2023 07:24:06 GMT

GET
DATA 200
OK truncated
/ 101 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9a612722eed86936463bc8772a9d4509e0c24f22485221beaa583a60079fef2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 79 KB
27 KB 210ms
74ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.hooliganmedia.com
URL: https://cdn.hooliganmedia.com/hmads0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

35bb05c7fe024e3e2a137bb4e0fe9f14fdc9fb9e022740452e8bfdef0a900ffc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27376
x-xss-protection: 0
server: sffe
etag: "1375 / 159 of 1000 / last-modified: 1666821989"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 26 Oct 2022 23:53:25 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
283 B 100ms
42ms XHR
text/plain 147.75.85.234
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.hooliganmedia.com
URL: https://cdn.hooliganmedia.com/hmads0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.85.234 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.socinvestigation.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.socinvestigation.com
date: Wed, 26 Oct 2022 23:53:24 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 18
server: envoy
vary: origin, Accept-Encoding

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210170101/ 353 KB
116 KB 153ms
91ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210170101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1663975870032923&plah=www.socinvestigation.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1663975870032923

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fb8fc0fca51d2214c6485a972df3cdb255e228d216c3ffa884e51d427543355

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 118756
x-xss-protection: 0
server: cafe
etag: 10175295546251683534
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 26 Oct 2022 23:53:25 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221025/r20190131/ Frame 2937 10 KB
5 KB 127ms
58ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221025/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1663975870032923

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 23894
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4270
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 17:15:11 GMT
etag: 9671129459699598864
expires: Wed, 09 Nov 2022 17:15:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_2022102401.js Show response
securepubads.g.doubleclick.net/gpt/ 378 KB
128 KB 98ms
33ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

79bbd067eff59b0e77f2c105b6a23129e341e4e0ed12a27e2618216fc1e850e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 20:22:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12629
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 130586
x-xss-protection: 0
last-modified: Mon, 24 Oct 2022 08:37:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 26 Oct 2023 20:22:56 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 46 B
84 B 107ms
42ms XHR
application/json 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.socinvestigation.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

53bab0882e74b131f6e7ed91c8ac092d03e8a199dd3aaf89d59b2eac192cde17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60
x-xss-protection: 0
expires: Wed, 26 Oct 2022 23:53:25 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 407 B
701 B 246ms
66ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.socinvestigation.com&callback=_gfp_s_&client=ca-pub-1663975870032923&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210170101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1663975870032923&plah=www.socinvestigation.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1aba8eb54c69cadbe19c10812b93c0115706ded00a24e57beb690137ada9019b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 256
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
792 B 133ms
40ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 196ms
67ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E45C 603 B
68 B 153ms
78ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&adk=1812271804&adf=3025194257&lmt=1666807359&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1666828404914&bpp=2&bdt=487&idt=286&shv=r20221025&mjsv=m202210170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1708984196510&frm=20&pv=2&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44775017&oid=2&pvsid=1423218013319643&tmod=1245212830&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=317

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:25 GMT
expires: Wed, 26 Oct 2022 23:53:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 122 KB
31 KB 372ms
371ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=728746975467092&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Chm-interstitial&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=2&adks=1874771964&sfv=1-0-38&ists=1&fas=8&prev_scp=pos%3Dinterstitial&sc=1&cookie_enabled=1&abxe=1&dt=1666828405339&lmt=1666807359&dlt=1666828404427&idt=870&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

1b70f64a3a0b1313d2c9d7b6f839e42e24c7b762b3a36ff492c1cfc7c81098cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32176
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 56 KB
20 KB 650ms
649ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Chm-anchor&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=3&adks=2830129390&sfv=1-0-38&ists=1&fas=2&prev_scp=pos%3Danchor-top&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405343&lmt=1666807359&dlt=1666828404427&idt=870&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

9bd85f417a69a46dff7efd6551f5448e04516de7838d180dadfeb6f9277d1c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20848
x-xss-protection: 0
google-lineitem-id: 6122225467
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138406043480
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
18 KB 216ms
215ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Cbillboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C970x250%7C728x90&ifi=4&adks=4162055255&sfv=1-0-38&prev_scp=pos%3Dbillboard-2&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405344&lmt=1666807359&dlt=1666828404427&idt=870&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e9bc46a916a7d35fa3988bde53f9a339b436d531431ce865ea179d0c38aaf215

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18157
x-xss-protection: 0
google-lineitem-id: 5996443147
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138390012799
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
18 KB 310ms
309ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Cbillboard-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C970x250%7C728x90&ifi=5&adks=2141707104&sfv=1-0-38&prev_scp=pos%3Dbillboard-3&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405346&lmt=1666807359&dlt=1666828404427&idt=870&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

eccd0b825996a53f95f8f1d8508bfc2dcfda6a26e12a603db48894a007516357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18168
x-xss-protection: 0
google-lineitem-id: 5992788937
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138389561862
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
18 KB 427ms
425ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2CMPU-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280%7C250x250%7C200x200&ifi=6&adks=1584201766&sfv=1-0-38&prev_scp=pos%3DMPU-4&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405347&lmt=1666807359&dlt=1666828404427&idt=870&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

99babef827b92a462e8fdc99e29f05fdd5df82272ade774e837541eb2fc6b9d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18077
x-xss-protection: 0
google-lineitem-id: 5996443147
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138390012796
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
18 KB 746ms
745ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Cleaderboard-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C468x60&ifi=7&adks=2271901398&sfv=1-0-38&prev_scp=pos%3Dleaderboard-1&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405348&lmt=1666807359&dlt=1666828404427&idt=870&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

a4e0bb8ef7599f6358fd347657c38363a35e021d5262da9c31748a8b9326c47e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18122
x-xss-protection: 0
google-lineitem-id: 5992788937
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138389462270
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 968F 6 KB
4 KB 242ms
66ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:25 GMT
expires: Thu, 26 Oct 2023 23:53:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads_2022102401.js Show response
securepubads.g.doubleclick.net/gpt/ 37 KB
14 KB 33ms
32ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022102401.js?cb=31070529

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

4873ba0ba5324f78b074263f4946dcb088b1b1beea174e14f9b8f60007de6926

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 15:58:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201298
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13941
x-xss-protection: 0
last-modified: Mon, 24 Oct 2022 08:37:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 24 Oct 2023 15:58:27 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 72 KB
23 KB 1080ms
1079ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2CMPU-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280%7C250x250%7C200x200&ifi=8&adks=474947799&sfv=1-0-38&prev_scp=pos%3DMPU-3&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405394&lmt=1666807359&dlt=1666828404427&idt=870&adxs=266&adys=1036&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=696x15&msz=696x15&fws=4&ohw=1600&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

6da84a88a91dde82ea2be848ad71993f5e164efd25c397f87cdd35a3ac9f29fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23910
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 1323ms
1323ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Cbillboard-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C970x250%7C728x90&ifi=9&adks=2161349176&sfv=1-0-38&prev_scp=pos%3Dbillboard-1&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405457&lmt=1666807359&dlt=1666828404427&idt=870&adxs=606&adys=122&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=728x15&msz=728x15&fws=4&ohw=1600&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

8c91490b6256ccd1996f725a45e5d4b33c18fb963f6852dd5d387e1de1aa2c53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9929
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 1843ms
1843ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2CMPU-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280%7C250x250%7C200x200&ifi=10&adks=675631170&sfv=1-0-38&prev_scp=pos%3DMPU-2&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405467&lmt=1666807359&dlt=1666828404427&idt=870&adxs=266&adys=969&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=696x15&msz=696x15&fws=4&ohw=1600&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

494d714b114dca21c5b1b3b840dd6be5fd46c8da9f3a5169f1aebde0667e0c00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9893
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 128 KB
35 KB 2519ms
2518ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Cskyscraper-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C160x600%7C120x600&ifi=11&adks=3086829201&sfv=1-0-38&prev_scp=pos%3Dskyscraper-2&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405472&lmt=1666807359&dlt=1666828404427&idt=870&adxs=1330&adys=60&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=a&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=130x-1&msz=130x-1&fws=4&ohw=130&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

87a0cdc19e16664e0bdfa53b8b3c9b4dfa11b5b46a3fe3cedc629499f45f72a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36169
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
18 KB 2891ms
2890ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2CMPU-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280%7C250x250%7C200x200&ifi=12&adks=498219963&sfv=1-0-38&prev_scp=pos%3DMPU-1&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405478&lmt=1666807359&dlt=1666828404427&idt=870&adxs=266&adys=933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=b&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=696x15&msz=696x15&fws=4&ohw=1600&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

9dbd3e2effee9b0dd96eabf2e5cbccb01041446a0dc3f3304538087f75410e7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18506
x-xss-protection: 0
google-lineitem-id: 6122225467
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138406678672
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
18 KB 3133ms
3132ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423218013319643&correlator=3095935265072895&eid=31070529%2C44772496&output=ldjh&gdfp_req=1&vrg=2022102401&ptt=17&impl=fif&iu_parts=115975610%2Cskyscraper-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C160x600%7C120x600&ifi=13&adks=3262068692&sfv=1-0-38&prev_scp=pos%3Dskyscraper-1&eri=1&cust_params=site%3Dwww.socinvestigation.com&sc=1&cookie_enabled=1&abxe=1&dt=1666828405482&lmt=1666807359&dlt=1666828404427&idt=870&adxs=1010&adys=578&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=c&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.socinvestigation.com%2Fmapping-mitre-attck-with-window-event-log-ids%2F&frm=20&vis=1&psz=324x15&msz=324x15&fws=4&ohw=1600&ga_vid=144073421.1666828405&ga_sid=1666828405&ga_hid=262341154&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e0929528a043980b48d039f2617741bba2b75a983b132eb7fad7ad3e2b60a740

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18146
x-xss-protection: 0
google-lineitem-id: 5996443147
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138389465534
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.socinvestigation.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 data-g55ad3191b_1280-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/09/ 11 KB
12 KB 39ms
38ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/09/data-g55ad3191b_1280-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec3466e07dd20b5a8044969e6b4ef2341096b43e98adf35d8a3c3fe94958b851

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Sep 2022 07:22:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ix8Hh3VttV%2BLJDT7dtwA5WIyej5KMaJSbb%2BcD8c8pPGg1eDlsbUAkRZSCOIdW0WnScjt9M%2Fz7adC9H7m7csrriZX5v81iOl5wIrVHfXhZCA6Eaze5%2FJNTbdFwlgd6xGOXwfAs5KAnvWgHQkE19hDjF579jRt3lo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7f6a7b0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11691
expires: Sat, 21 Jan 2023 06:29:52 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 135ms
74ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221025&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65513e686b4874559d231936804fb5881e1f300c3c7dd4c63e9033c63ebd1f69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11103
x-xss-protection: 0

GET
H3 200 password-cracking-techniques-11-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 7 KB
7 KB 32ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/password-cracking-techniques-11-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d61b86c85eff864247eac5a28be6b3c4abb337cfbe3a65856914cd74337404a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Tue, 23 Aug 2022 01:40:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HVLAExdbmjCTmJ4ReSTpd8CM1AzUZHI3B7sLj%2FNlO7f10fNtSQ4uwGoVaCmTCcImDmjJOWYYIcpoLexOiFQjwTtb4SBJbOQUQbafcVkauf8mQBLHYDJserffjfaetnzJIQXDvg30s3bR0tN82n%2B5D%2BEv2e3yiVw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7f7a970a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7146
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 The-Flow-of-Event-Telemetry-Blocking-Detection-Response-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 8 KB
8 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/The-Flow-of-Event-Telemetry-Blocking-Detection-Response-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfa877887bb9830e0eee4a15d162589c393e494b3f9c86805a68302be0e7b140

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 01 Aug 2022 02:08:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5LLW4rwHnXs4NeBzbHqjt%2Fq5d2jN7Md2TTIefkxD%2BsI2kjNiWyMXSjL3p2PanD2pgNrkKccN6wZHVCa73zAFbkudqeNEHWM9Fc0Kg4ZFNWt7lVU6D3YmsM8%2BI3jbehrhn05%2BYZDG72G%2BK9%2BGNFlpyosyWHng9M8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7f9ab70a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7978
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 UEFI-Persistence-via-WPBBIN-Detection-Response-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/07/ 11 KB
11 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/07/UEFI-Persistence-via-WPBBIN-Detection-Response-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f33b474a31d1481a85b01fedea079932e130b99cb03f108a096dbf579195ce2a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Tue, 19 Jul 2022 07:11:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63573
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ecfVkQjxwMvnKAjQQy88nOiHW5C1htQMQ1WvxfY2f%2B%2FUa5%2FI88czK8FdDhXvj12L%2BHpYcj2KfyYXZOR71qePoQIkWnc2apHyCUakYV7gSrO468JipLGTlz7MuzxNkhvz3GA78Nvdd893pH6F7uo4FGqGJCJoRUQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7faadb0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10987
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 5 KB
6 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35d22c1685889f79c4d92edd7544e5a0c2d58b8126190bc181474e518042c0ba

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Thu, 19 May 2022 01:57:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yOQz%2Brhx%2BDMQlRSDYlEJAnk1rJfbAdqOszhMwr3nxfa0GaZCIKAzPDfTHp4mQINmEpsw4dX3rvFfln0XuzJZy%2FXBdcjofgJ7Mna9ckMRB5oahbM9BImrB%2FU61Bkk6JeDT0FzmymTnQzF8uM6BKFDZCu2MBFZypA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7fcb030a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5464
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 What-is-Port-Forwarding-and-the-Security-Risks--218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/03/ 8 KB
8 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/03/What-is-Port-Forwarding-and-the-Security-Risks--218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6c92b4124a497573949aea82322dee37fc8f522ef4f59ce7ef1411fbe148976

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 07 Mar 2022 04:53:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BRgXv6wiqVb6x1cdTd8QlvJ9hIN0s1wxyVKAF5LbsR4F%2BHRBMD9Bg%2BI97bDS28p%2FzdtKBoZ0P0vs8v%2BkON8mkuwcVAKSReO8i6CPb0FYg9O2thYD4T2GI954fYmWg3aUEcV78bVaA00TkeWe1K5fDOorQlFxQkU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c7feb2c0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8051
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 container.html Show response
c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E6CA 6 KB
3 KB 96ms
32ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:25 GMT
expires: Thu, 26 Oct 2023 23:53:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 CVE-2021-4034-Polkit-Vulnerability-Exploit-Detection-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/02/ 8 KB
9 KB 32ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/02/CVE-2021-4034-Polkit-Vulnerability-Exploit-Detection-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b438bfaec498b9ae1119d3ff6b17032850d54007c059a3642abdd61ba57536cd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 07 Feb 2022 13:09:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qNh1Yv%2Bs0VkF0Fv78PBaiG%2FwbiGzarcdRN9LtoB6UiBlX3fh4MKGUd39SoPvrHMCQrW612TN9wr8nqHMqEJu2VjnvaQMumP71yyiekHl9HZ4k4EbISgp0ot6isEFrSlnZ6ecSkFPHEFGBAQZgI3U1kawZFskZko%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c802b830a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8341
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3 200 The-Flow-of-Event-Telemetry-Blocking-Detection-Response-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 8 KB
8 KB 31ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/The-Flow-of-Event-Telemetry-Blocking-Detection-Response-min1-218x150.jpg
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfa877887bb9830e0eee4a15d162589c393e494b3f9c86805a68302be0e7b140

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 01 Aug 2022 02:08:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZnjukUUaiJuoDoCGyNs8FOmCbwiYonQ7BHsSlPeEqA71ALG5ONjGZj74DV3ylZ9sxpzSKlVLhWq37EWns%2BdtQMuyGedIEqh3Nygreay0CZ%2FCxXCrtPZMH3e9lRE19k2%2Fh39DMel7fCrsXOlOE%2FjSBPn5ZWyLeoo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c802b9e0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7978
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 173ms
90ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:25 GMT

GET
H3 200 UEFI-Persistence-via-WPBBIN-Detection-Response-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/07/ 11 KB
11 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/07/UEFI-Persistence-via-WPBBIN-Detection-Response-min1-218x150.jpg
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f33b474a31d1481a85b01fedea079932e130b99cb03f108a096dbf579195ce2a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Tue, 19 Jul 2022 07:11:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63573
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=scQufesEIUXeII3mH0xxiU%2BlC22KoWmYxq5ikpnUZCcLnRyYUx6v8bQFbKFlZci6T51TTBDf5XL3Pz2KGnsHxicPPeUvL7q9R1ULzQJlxHa7IoIC52J%2BS%2FCN%2Fx7piJaDgwjdCsswMyfx%2BTMU%2FzVjc39FzmovCco%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c804bc30a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10987
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 5 KB
6 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-218x150.jpg
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35d22c1685889f79c4d92edd7544e5a0c2d58b8126190bc181474e518042c0ba

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Thu, 19 May 2022 01:57:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evUHxLCEFoEgKNoM3N%2FVIq31f7cUTthV9CdwFH7ebFTARxyXivlkRfHDjKq5ZHoalVPCyVBrogOC0gl2rRVL47LxxRlJN8p8xuf3MxZM4eOFrANChhfmN1v%2F1lD63w8rkZzxLSJWDzmL09hbX0iMnrbRysvs1zA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c806bf10a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5464
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 What-is-Port-Forwarding-and-the-Security-Risks--218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/03/ 8 KB
8 KB 35ms
34ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/03/What-is-Port-Forwarding-and-the-Security-Risks--218x150.jpg
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6c92b4124a497573949aea82322dee37fc8f522ef4f59ce7ef1411fbe148976

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 07 Mar 2022 04:53:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kOuWfx3EEt31H%2BTCpetc1pHX7TxxoBOUYoApZNxSBhRsF4%2BFlyHqwQBrZQr5avl77a46U%2BYFDgHozzkvOACZkVZhskNZ7o%2ForC3jO%2FYcgkMHmRcFoj5SGU6pIGXnQN%2Bvex9WvsbSfs5h5j3rVGz2Z%2BdW8VWdn0w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c808c260a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8051
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 CVE-2021-4034-Polkit-Vulnerability-Exploit-Detection-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/02/ 8 KB
9 KB 29ms
29ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/02/CVE-2021-4034-Polkit-Vulnerability-Exploit-Detection-218x150.jpg
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b438bfaec498b9ae1119d3ff6b17032850d54007c059a3642abdd61ba57536cd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 07 Feb 2022 13:09:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BwjU%2FthGdMVsoFRb6C4LkZAn3b5midX2nKU6GRlUH2ctYwKCi%2BdRc6oW%2FEBzpbxi6ycBmcf%2B8eYj%2BGq6XxQblIb%2FWIRanPi1oKK0BsrxCp2jwOcR%2FU8dUCQ8OfQxPQUydHab0pfPS3y%2BKby8w69cVNuuNEUBvVg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c809c430a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8341
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame E6CA 4 KB
636 B 135ms
70ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 23:19:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Oct 2022 23:53:25 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame C4CC 8 KB
895 B 131ms
77ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 23:23:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Oct 2022 23:53:25 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame C4CC 2 KB
1 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:49:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32606
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:49:59 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame C4CC 23 KB
9 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite_fy2021.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15b192d13c1d029346a73cb1b2eb3a1b8905dfe8df1aaf9ced37356de9380e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9268
x-xss-protection: 0
server: cafe
etag: 17746901142539384344
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 17:17:28 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame C4CC 3 KB
1 KB 80ms
80ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:18:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 21:18:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame C4CC 17 KB
7 KB 65ms
65ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d99f77a187454fecc18b59b2f520b1598b246d01e142bfdc4de56eb7221a9330

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:49:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32636
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7367
x-xss-protection: 0
server: cafe
etag: 4759548068123418343
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:49:29 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C4CC 0
0 193ms
65ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSs_Os0Mb6nMq0nQ0oa2DwYvq_QKniPAg8gd_-gdxxcT_l5RpDnLv8Mqbdrmf6lVqi2_Urg-Nd7nH9LSI8XCsudfd0IQg
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C4CC 152 KB
47 KB 75ms
68ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47514
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1666784471914692"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:25 GMT

GET
H2 200 6d06f43d9219529f87f676616f1c0e3b.js Show response
www.gstatic.com/mysidia/ Frame C4CC 33 KB
14 KB 141ms
58ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/6d06f43d9219529f87f676616f1c0e3b.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19d9403b8b5963aaeae98991373ef1f4ec9ed98d649be55e657db8e1302578bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42733
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13940
x-xss-protection: 0
last-modified: Mon, 24 Oct 2022 21:55:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 24 Jan 2023 12:01:12 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/elements/html/ Frame E6CA 19 KB
8 KB 112ms
112ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e70f196596d57a6f3570a0983040f63d9ed88bb9da8849a302ad19fea617dd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:58:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32087
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8012
x-xss-protection: 0
server: cafe
etag: 16149103330692230356
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:58:38 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E6CA 205 B
518 B 145ms
65ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:07:42 GMT
x-content-type-options: nosniff
age: 9943
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 26 Oct 2023 21:07:42 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E6CA 604 B
694 B 145ms
66ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:16:58 GMT
x-content-type-options: nosniff
age: 2187
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 26 Oct 2023 23:16:58 GMT

GET
H3 200 Domain-Name-System-Security-Extensions-Explained-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 10 KB
10 KB 31ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Domain-Name-System-Security-Extensions-Explained-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f69a3291a73787cd086a9d165630512c48bde188f68c53ef33aba67a0f9b8696

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 31 Jan 2022 11:19:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rXFT9eLgEayAN%2B8NNXj%2BNbjDEvRs7fiuf6OXvY0NZXmUPJw3ehHKYtV6Hdh%2Fug36K%2BfQLi1ZBGaX3M%2FziQmutXNw7slxwcwKyRIFReefgOzCx%2F%2FmUoA4UYcREphJDE0tgU10%2F%2FcyYCryGiYYNQzot0OOk9cDbfs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c80dc850a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10157
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 Detect-Most-Common-Malicious-Actions-in-the-Linux-Environment-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 6 KB
6 KB 31ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Detect-Most-Common-Malicious-Actions-in-the-Linux-Environment-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c8ef9dfc9dd03c8c921452506e8036676c465f9f4ccb62c33934319506b99e3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Mon, 17 Jan 2022 05:24:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KS4tNczrGnpSSd9Y3Q9Gx4Q4mdlPXT2FXC0YvkE1E3clc2WCHWVeZ51APtFZQ2X45iKsMhpln7gXnkVIj8GwqTmZoQzFRd61JQRTrTTt9V0p0uI0fyieHFR2mrD79gK%2FzkfnaGZIOy%2ByI8ZyZHKE0mcr2U3E1NU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c80fcab0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5639
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 How-DNS-Tunneling-works-Detection-Response-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 10 KB
11 KB 32ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/How-DNS-Tunneling-works-Detection-Response-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5e0684697fa8aeb5266b010e4cf40320640ebb988b51b26017c28dc5d7e93bf

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Tue, 11 Jan 2022 04:40:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RB5mHxIrQ0uSZXMEcJBi4cAmLfd60Hiu2wpJd0gAPC1SFdNxkKdU5GmmOyFqY5vAgLrOo%2Bkbs3gEFRTTEqFL8%2FWJfeLNdMhJdC5BJLETHLh7FAyapVouxheCCpWvo7kT8UbckqvuPU7qr8N9AHksCR2ePgabV3o%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c811cf00a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10358
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 Anatomy-Of-The-Ransomware-Cybercrime-Economy-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/07/ 10 KB
10 KB 38ms
32ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/07/Anatomy-Of-The-Ransomware-Cybercrime-Economy-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ef0e3ab3c5f4c424d6a778b7cc5e5cbd94a00cbe69fea62696d2bfed3e49de1

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Sun, 24 Jul 2022 23:18:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g240R7hBYcuTMEYLSO8R5ePtC30zxHex%2B%2F5X17ZZGoUrSJZRB3ZZuQZCsy3rGGgzG%2FuRFAscGjkhcyCKT3AnNd8FeaaHAPaHF2hSnvs9ksA5BAmezg%2FyvgkPr2ZdV4gy2cX2QbhQ5mMJFa5ZmFBa4xZk%2BD9an9w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c814d280a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9982
expires: Sat, 21 Jan 2023 06:29:53 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1AA6 143 B
166 B 59ms
58ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 2283
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:15:22 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Anatomy-Of-An-Advanced-Persistent-Threat-Group-1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/06/ 11 KB
12 KB 32ms
32ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/06/Anatomy-Of-An-Advanced-Persistent-Threat-Group-1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb8e968d27846d9b5f945472c551af104bf55e88416fda2c9a844badc7d930d2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:25 GMT
cf-cache-status: HIT
last-modified: Tue, 21 Jun 2022 01:28:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2ndRX7IfFcbmC75LQ4zXvM64v6N5GQKNb9Q2e5R3veRtaWnwJIi9oedewKczcLZvUy5Z2SF00cttMysMOiY%2BWaAPocglHuYGHBqgBlSUkPZ0BoBDoTTVvXd9fRxm7qjUNhvLSs%2FIbDZGlkJqkCJWm%2FkW4yJog8k%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c816d540a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11424
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3 200 Out-of-Band-Application-Security-Testing-Detection-and-Response-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/06/ 7 KB
8 KB 33ms
33ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/06/Out-of-Band-Application-Security-Testing-Detection-and-Response-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f14f5588e3126579115888a2ffa0e22c2f851c6b884bc0f157c8c905d8e85710

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Wed, 08 Jun 2022 01:35:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NO82XS1NnJMa9Tj2Yal%2Bk6ysqSVbud2dHk6Ycw6Wy0Y%2FVTytRdUads7SVX72zj0SKY27eh3NxTiWHH47WwHXu9HMYGiwHQGHnEmHpXYAFNrCs5jIOfoNFp6XBMnVtHLUN9Ku60Kw%2BnBO4urC4QIVqkJML3LyAf8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c818d7a0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7656
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C3B7 13 KB
5 KB 124ms
59ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 2966
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:04:00 GMT
expires: Thu, 26 Oct 2023 23:04:00 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8A8C 783 B
999 B 73ms
67ms Document
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7a9d9add68e7f5c3ac92ca43c42ad16d7ce5021c11bfd5f03d1129a04402e19d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-gmzmQ0zbWTOsCxHrDb9QUA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-gmzmQ0zbWTOsCxHrDb9QUA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:26 GMT
expires: Wed, 26 Oct 2022 23:53:26 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame 1096 23 KB
9 KB 108ms
64ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15b192d13c1d029346a73cb1b2eb3a1b8905dfe8df1aaf9ced37356de9380e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23758
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9268
x-xss-protection: 0
server: cafe
etag: 17746901142539384344
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 17:17:28 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 1096 3 KB
1 KB 102ms
58ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:18:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9288
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 21:18:38 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 1096 0
0 67ms
64ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaScllB03wXlbv3VnHJS5WqFrwQDRDSH9WR04UaAHEadWNwLZug9riPypSos2gFxRK1rFKBywtjimIIDTVXBGKv7qwsnyg
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1096 152 KB
46 KB 76ms
74ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47514
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1666784471914692"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:26 GMT

GET
H3 200 15030683822279363882
tpc.googlesyndication.com/simgad/ Frame 1096 127 KB
127 KB 113ms
70ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15030683822279363882

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39a5002bda56d66137a61bd2e5a140310f8c85e3aee91a958effe526aaa5471d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 25 Oct 2022 16:14:03 GMT
x-content-type-options: nosniff
age: 113963
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 130239
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:39:48 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 25 Oct 2023 16:14:03 GMT

GET
H3 200 Splunk-134-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/03/ 4 KB
5 KB 32ms
32ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/03/Splunk-134-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04a5a33c6fac83565e0f8bfe9575db1e8c635e3c3e01800c5e5da28acdab850e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Wed, 09 Mar 2022 05:26:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ujS7VHIE7DnX0wWgltCh%2F7%2By8rg%2F0QNh5k3DBMq9KyDl2UpdUhfcEJw81DGQjXunfx2m2RIbaS7FeUTWkqXehZgGLoyel%2FGy0CUWWbk6gJGt21s8JhZ%2FgC26DchwOooPYVyT3fgOTL9U%2B9iHi3UFX0V6dcWgscw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c821e200a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4416
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1AA6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
19 B

70ms
69ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:26 GMT
expires: Wed, 26 Oct 2022 23:53:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:26 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8A8C 0
0 93ms
92ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221025&jk=1423218013319643&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 Microsoft-Cloud-App-Security-Anomaly-Detection-Policies-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 6 KB
6 KB 31ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Microsoft-Cloud-App-Security-Anomaly-Detection-Policies-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33a765d12fcf0854f5e0cddfd2d926cf1e4de070b6e02c871398ae2e64be5b29

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Tue, 03 May 2022 03:01:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fcX6fd%2BllLD3Mfbs7GIfDy07VqekYI6UjT9xNtOJHEo3KMzIoz5hzEU6%2FiS%2BQP0JOqJQdKZIbHtUDaRTH%2BgmuiunoeqPqKO4tTl8hynZ%2Fm2jS9ICB%2BSIzhwpVE8tT%2FTKupcjccmxW4Eb8XSHti044QNBbG8%2FNt4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c822e450a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5964
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3 200 Free-Ransomware-Decryption-tool-No-More-Ransom-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/03/ 7 KB
8 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/03/Free-Ransomware-Decryption-tool-No-More-Ransom-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c89871faf7d2b59c948ff5e12f2d4971d7cad0e9bc23d2ab8379d8210d7f5cd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Wed, 16 Mar 2022 05:19:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nTQt3SsvObpEr%2FxTFkJ8giLWy1QQHwNx%2BRaj9JgnZMYo3lc28voc046Zk0%2FKHbhG20D1o9n5PbZbBH%2FfXVs3d6ljacSYMHk%2Fz9H2c1KrQEui6gjnSNFyPyzopMZBsRlSf8%2BMyx4UC%2FUZP9WEQqjt7jCuJygm89Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c824e720a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7353
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3 200 How-to-Remove-Database-Malware-from-Your-Website-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/02/ 12 KB
12 KB 48ms
48ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/02/How-to-Remove-Database-Malware-from-Your-Website-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc64ca4f9ac377de71a30b14be28b0b131109a99dd385a7f4c6c4fdad46b0899

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Wed, 02 Feb 2022 09:48:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uKpYmgcXfiBzUAGUV10sMshpSPreQggC1wg7vS8638RYyvY18gTRH550gCA8bs8fD0KJOysO52p4cmZ8U32t%2FkyYOah2k36tXgZPYZInDTeg5IhAoS3bkDn7dnvFCV020t2lcojgGWBrhnHkMuorkGh%2F2t%2BiQpE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c828ecc0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11904
expires: Sat, 21 Jan 2023 06:29:55 GMT

GET
H3 200 Most-Common-Malware-Obfuscation-Techniques-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 18 KB
18 KB 31ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Most-Common-Malware-Obfuscation-Techniques-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c927356cd5c29976ac4448b1fc160316d88a24de40405b287ec05a71e355e7ba

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 31 Jan 2022 11:46:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GYmfhpt6CVv0ynB5hHSdQtqolvGboKPOcXpOZYprmjT6HiwbhnO6S%2Flpd53QdUfPPx13hnDpXunGZudeRxqpksafy%2BQPbkW1bYtWf3hIx9TEG%2BpFCmbifJnlFtylpuidielZwZ%2FgzCZPUCO6hTG5GgB6AD%2BkZoc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c828ecf0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18159
expires: Sat, 21 Jan 2023 06:29:54 GMT

GET
H3 200 HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js Show response
pagead2.googlesyndication.com/bg/ Frame C3B7 36 KB
16 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d9aee9c7463bd35f930878be886e5ee224aa8c9800331d699b91a28ceccdf1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23756
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
last-modified: Thu, 20 Oct 2022 10:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 26 Oct 2023 17:17:30 GMT

GET
H3 200 Web-Malware-Removal-How-to-Remove-Malware-From-Your-Website--218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 8 KB
9 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Web-Malware-Removal-How-to-Remove-Malware-From-Your-Website--218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89340946079058ec32f6a455fdf05e55fcb627a5be2617fcdb0fc0d393195608

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 31 Jan 2022 10:44:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m5%2BbgB3E59a4KigoB%2BLizFfx416y9R1sphlSszdMEX%2FFlhwTiqD64Vm%2BJGpq9w2C6WsdJBRgZghxoUkICLeBSpFpkPH2uq%2B0JrVL6WbA9mV7ClBoQxALiQLFUIjLC%2B6tmzXpiL48pecOvuDbXRLbtmJbxK6QV8A%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c82aeea0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8551
expires: Sat, 21 Jan 2023 06:29:55 GMT

GET
H3 200 What-is-a-WAF-Web-Application-Firewall-Explained-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 12 KB
12 KB 34ms
34ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/What-is-a-WAF-Web-Application-Firewall-Explained-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc821678522f6a89487b0b9310900e882dfb6ecee4bb2ac39a0afdf02d1a60dd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 04:43:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KicR8X%2FpDO3PD25rL2VDzqIeZ%2BFDiAe1tS%2ByKyGOBj08p%2B0MM9bk%2BGlk32DTT8aEoqaVjecGPsxTTXVyxS2m5wf1qqFxrgb0uEoEWh2endlythrvxxGdahke5dy%2F7gj6e%2BOFN7h%2F2wBGdMk5YCDNhvIpYHzjqM4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c82cf210a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12039
expires: Sat, 21 Jan 2023 06:29:55 GMT

GET
H3 200 WEBBFUSCATOR-Campaign-New-TTPS-Detection-Response1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/09/ 9 KB
9 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/09/WEBBFUSCATOR-Campaign-New-TTPS-Detection-Response1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09cc503b39f0ff23111123eecb3886bf2f40b8151815ac6c03b7ba8ce11b7026

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Thu, 01 Sep 2022 06:00:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=44JR5f7S3X25j1WJRWSNHchwVBnHd5q4bT1WjE22B4j3xMBEJh3on7LYcqgTBGiADYPP3rqT3Q5fxHamqyae96XKosWuM2LGmj%2BG2bNbgDC1n%2BR3y2Kis2esT3frDUahcpTZRBluHfBXy9YWaxpt8sMJKexeIVU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c82df4d0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9162
expires: Sat, 21 Jan 2023 06:29:55 GMT

GET
H3 200 remcos-rat-malware-iocs-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 7 KB
8 KB 34ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/remcos-rat-malware-iocs-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3378fb808052472987b9ee3c79eb6f23c831d883f1ec3381c903fee00ddd768f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 29 Aug 2022 07:16:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E7ICKdLPDftZY6HzuWoJhCMW%2FZv%2F2OYbo%2FCCflFd4zoNuUZMYaXW8b%2BDfCP6I4JD7OnKIlE20jVjjSQq7FOjOuP6FNSy%2BiEndj2xoZ297bZsJStParcOXPVJROeGJkKYDIjwXFkcbsuwbqnObmFkZSvulSeksqs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c830f7a0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7638
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 powerpoint-malware-218x150.png
www.socinvestigation.com/wp-content/uploads/2022/08/ 33 KB
34 KB 34ms
34ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/powerpoint-malware-218x150.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 383947decf3f80b59ea39cecaac0876a456eff9d0477c0760b8d08a8e6140183

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Thu, 25 Aug 2022 06:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=etrGAoEt8%2FrJtVQwBXiY8BBsrYGdL5GiajCs17%2FCjeMMqZL7bLVPl4ii8M4S14oBl5sen%2Bm54Fh7c8zKBMkPmB%2BA9ZWAxXwN%2BnuOtDa1UVZZhWaIuue47CXzXF2EXJHiJLJ8P90eTUs%2F8DUT2tTpQM3yOrfA040%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c833fb50a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 33921
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 cve-2017-0199-new-malware-abuses-powerpoint-slide-show-868-min-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 10 KB
11 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/cve-2017-0199-new-malware-abuses-powerpoint-slide-show-868-min-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f4d20dfc97b1d181ea138840c23110bbca3d2bb930c059b7051a443230b894a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 22 Aug 2022 05:21:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nqoX%2BY8ExpG%2BEnVzlJ4q6oug26yR%2B5uJ7NwtfhZ5OO%2FTm2MpmkAlL5iXT5xuqWuBgD8nW4IvC%2BOp%2BWtyMk%2FHrOjsz6bcUqG14v%2BOvvRr%2FtwDTm7lfHLOHdb4Lrtkfch0AM7bZnEfE7Le%2Fv%2FwU2p2gz%2BBZGcdBE4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c835fe40a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10450
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 Racoon-Malware-min-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 8 KB
8 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/Racoon-Malware-min-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c49b03685563b28f6f12ef05b608288482ea816882b82ab7bc5d9542fc4eddd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Thu, 18 Aug 2022 07:34:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63574
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WvStMZ7hdPDPJx6HnEMIXRgrBRgRSjfiTJJXvFv53PluSivdeFPehH12l7KKZE4%2F%2FfirPDAg3y316uYpsaJCImsQveZYuroqSAnYSXzyP6pCtjvlSp9XDWZKsJYnghOXjw97vqpwNKkNOOc521%2BYcPahh0zI43c%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c8378150a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8172
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame C3B7 0
10 B 58ms
58ms Image
text/plain 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?xg3qcA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 Masquerade-Attack-Part-2-Suspicious-Services-and-File-Names-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/07/ 9 KB
9 KB 30ms
29ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/07/Masquerade-Attack-Part-2-Suspicious-Services-and-File-Names-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5d406027dde7ba57b063eb276e1e19de171361a999a80278b2072f5f08c7c9f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Thu, 07 Jul 2022 05:18:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sLJ5sQqbtGEnBhtWXIa%2FwF846pmd3HAX3c%2FXsCawVNCfl9AFaHptHAyi1ffsrrxhs19JTQtNRmVDXkrJQDw607iVE3akN%2FeTJ9naaIzXfK4nJn79SLB0%2FnsJZrdXgLDnxjC1D65%2FmOIuZKjpq6KUNrSzZ2lSgxk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c83a83a0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9178
expires: Sat, 21 Jan 2023 06:29:55 GMT

GET
H3 200 Masquerade-Attack-%E2%80%93-Everything-You-Need-To-Know-in-20221-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/06/ 5 KB
6 KB 33ms
33ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/06/Masquerade-Attack-%E2%80%93-Everything-You-Need-To-Know-in-20221-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3c7289e46b8cbc58837a9719245eeb078e1fdf34276b53c4d4aea13cf385982

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 27 Jun 2022 05:45:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wT%2FyBbijak3mMLzjP%2FQ4Rp4KZaErnOhySy5JCJno%2Fjq7JX4yuRffNgMSs%2BWSVzAaCUFAsvgv%2BdQsfjCfXD1khCkoB26%2FgdIUR9pMosnDRIhEfXAvAFsKxb7sowEghZBytZ8w8OpU6uT%2FbRk5AE0W3Jo2M%2B6s%2FMA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c83c84b0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5311
expires: Sat, 21 Jan 2023 06:29:56 GMT

GET
H3 200 MITRE-D3FEND-Knowledge-Guides-to-Design-Better-Cyber-Defenses1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/06/ 12 KB
13 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/06/MITRE-D3FEND-Knowledge-Guides-to-Design-Better-Cyber-Defenses1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5e52ac1307c87c338523edd19d7932e73ceee567678f87833496fe3b8e06c76

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Fri, 24 Jun 2022 06:49:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fW3uNfwT2O%2B338cJTaZ%2FOT3sb4cK2TI9CHfoXYy8O4u%2BSBb5DH%2BBwUXQhwBDDU3xGDztkUwnrOWKl0ToW9cU3wzqDRUL4zCzZyyYU5tJRnAS5mL88w9oZyolbYA9RN0DfzX78P2IYprx7mRPcu%2FeVgVKmFQRqdw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c83d8770a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12753
expires: Sat, 21 Jan 2023 06:29:56 GMT

GET
H3 200 Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 6 KB
7 KB 30ms
29ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51a7253d7470a5568df4c781f29ddf530a892a6a044ef91a4dafff95dcd0d265

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 16 May 2022 00:57:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PPG2%2BqG7EEuOHXwBbZ0Gr%2FKpa3xnLVITNhUH3prSFn2ZDzUsSjxSCwgP2i2bNKpINKEkE8GtzMz%2BlqgseofWcSX7A7H4Liq9gCpC4OGCeP2GhNcVvc9MfnkPo%2FDYAGd1S1%2FuA4RpC614CBJZ%2B4hgaALrWG59AOc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c83f89d0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6203
expires: Sat, 21 Jan 2023 06:29:56 GMT

GET
H3 200 photo-1562813733-b31f71025d54-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/11/ 6 KB
6 KB 31ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/11/photo-1562813733-b31f71025d54-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e249765e273a74656063470fe2148a7f4aed395b8731d4efe2a828c52da018d8

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 22 Nov 2021 04:55:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cp3lVUNw6GGEyQ0YT2KBAL7LRyPVezw%2Bw0dG2iH%2Fc%2FKivkNC0hppaP%2F3kI56tIwK2m07vkmpm8%2BaoMAspiClnStGsQCe9X2cK%2B5B05%2FVQykCVdH%2FZK%2ByfEdln7GozsDnJJiEOJdlN9Cme26TUtzprK4GXXfhgWY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c8418cc0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6026
expires: Sat, 21 Jan 2023 06:29:56 GMT

GET
H3 200 Hackers-Use-New-Static-Expressway-Phishing-Technique-on-Lucidchart-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 4 KB
4 KB 35ms
35ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/Hackers-Use-New-Static-Expressway-Phishing-Technique-on-Lucidchart-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecac8e33a0fd1eb7b02faa8fc41d9987d06dd8252ec989568900910458098880

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Aug 2022 07:36:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AywdslnKAMWBxBJcbfK0e5K%2FaP50difYaRUhSiSetbQKcqESif5ubo%2FGJKj9NTwHDf2IESj2MxdqPWjyLGsFO%2BvrdiyDQgqFpHlrjITxjfY8Ow06WyXi%2F7MowA4c14F2r908d8fIvElfZElfAH6IxodK8rnvWwo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c8428f70a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3634
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 Weird-Trick-to-Block-Password-Protected-Files-to-Combat-Ransomware-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/06/ 9 KB
10 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/06/Weird-Trick-to-Block-Password-Protected-Files-to-Combat-Ransomware-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 272fd4e2790248a70d7aafdcaea641d52bd7242e85c9d0b7464dc8a374a40337

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 20 Jun 2022 07:48:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=blpDWWiP2edFsEp8rJ739yI2AN0t2pPonpUddfM4C2x9%2Fzl%2B19SS9PP9MIdDBpREcolrR58tYOhFGC7o31G4JxcBBHBHrIupnUPTFjbI1o0%2FqoJLNT%2BScw%2B5JJK8BrV7eNbDqn%2BdPuG1Plz2hZmd1SOQ8XSggyU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c8449170a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9264
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 Phishing-with-Reverse-Tunnels-and-URL-Shorteners-Detection-Response-min-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/06/ 8 KB
8 KB 32ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/06/Phishing-with-Reverse-Tunnels-and-URL-Shorteners-Detection-Response-min-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5601922898e1de0402042c3c0d826ad07a8f09fdd0bda775c6a058e918195b2b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Tue, 07 Jun 2022 01:05:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hl3t6idGXM8E8e5tleh6OaEWKqU%2F3y3Q1%2BSHkOBBPnONHRmHCqqfcBvcfRMlLw8rIJ51OvplJBLNiLZU1LjFjl%2BOKjilXme87ykz8UaQZ1UznxID3uCsRS33zpUcpoY6RiXJn6WWMG6p6bpGgUNsGxdsKWy12c0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c84693a0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7879
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 How-to-spot-a-phishing-email--218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/06/ 7 KB
8 KB 32ms
31ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/06/How-to-spot-a-phishing-email--218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00f2cb9932cf77c587cc8f03c84e1c1432be58cc6a935344cd90d91d63c4020b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 06 Jun 2022 02:43:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a5GqA0pNvi413HxYs5NKQGmZAi4kVLNQz8zSKfVMblQdLRpqQGF3njKmOapxKNgmnzU%2BqDJRBBsWDHv4%2BR%2BQtL3JelLez3RooINhgNKfrSlhj%2FunPK%2BgOYjaKaa1eUYJgvP%2BW12Mizv6jaG6HeG0xGKwbfhdMYw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c8489550a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7554
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 Google-SMTP-Relay-Abused-to-Deliver-Phishing-Emails1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 7 KB
7 KB 44ms
43ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Google-SMTP-Relay-Abused-to-Deliver-Phishing-Emails1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1794a3cf13f7bb6847ad633beedd9dc4c09773165073a6718b73d1314d4b87a2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Wed, 04 May 2022 05:55:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fse%2BnsT0vgECpcKRYbhaHt4hX4mu9A8uh8c73aGVdZ0lcSSQ1ETeqPjqaJtYjXPDz8fIvRLeeeNU3F5LxQh2kxlp2Be%2BRFn%2FPPDgimVoUEZW7%2FP6zOAd1ZWK6JHb8nmA%2Fl%2F4PwxNNeKT0u2lfA1hqw9S3z2u6Ew%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c84a98b0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7080
expires: Sat, 21 Jan 2023 06:30:33 GMT

GET
H3 200 data-g55ad3191b_1280-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/09/ 4 KB
4 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/09/data-g55ad3191b_1280-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd546e0797df6341ade99f3157cb1b513143ae03e2f877b4d143da3754fecc1d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Sep 2022 07:22:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63772
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=75hvjkonzmzN5n8HUXSMaHr3nlZuYEdNgmPLjnUDMcWWFpX7CqzJKSTH1mJHMUAuCwhFYrlO1BTDZPh5QgCDQzP4AzQAvDRnGufF%2FwHUBTIAYWyDGucrOGx7iC20Zd2yHzAnoM4WFAvCD4A4hokyQjH5DfVnGlM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c84d9d40a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3608
expires: Sat, 21 Jan 2023 06:31:46 GMT

GET
H3 200 password-cracking-techniques-11-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 2 KB
3 KB 37ms
37ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/password-cracking-techniques-11-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8016275febfece8b113cd5ad403b83b787ec3cdee3f5c27c64a02820ab50a77

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Tue, 23 Aug 2022 01:40:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b8n%2BBhHMSBhQkmXyGF6th7c1WZn2Li0LkprBGqZq1sOEmtaXiYWIhpQXfMyDKXjyVzkEzX7bVMSjm8ppfuo%2BqmZh3ac9XdqEucNaLa%2BFTskfAke4OyGP%2BexLDQ%2FZdFRyR%2B2FUTXVcNAw481FiwvUIiZJWcdQBAo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c852a200a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2487
expires: Sat, 21 Jan 2023 06:30:46 GMT

GET
H3 200 container.html Show response
c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1928 6 KB
3 KB 32ms
31ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:25 GMT
expires: Thu, 26 Oct 2023 23:53:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 The-Flow-of-Event-Telemetry-Blocking-Detection-Response-min1-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/08/ 3 KB
3 KB 30ms
30ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/08/The-Flow-of-Event-Telemetry-Blocking-Detection-Response-min1-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c19c4de4eb4160edae6eab4a733a624718ab361141cbd77f6c476e2ac4bbb78

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Mon, 01 Aug 2022 02:08:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LqkuCBVGbcsCkJzdiSk2rgBIXXSWqpijzJa958s8Pzr20eNME0ePadeaWXb6ytk7wyYqP8xR8ndZ94hP7nsy6u461OjDuctRG6mzQ%2FaAdNuwSu9cwmaX8UzQlGLpZAnrv0%2FRhcap46ucYpQz%2Bak%2FMfjsJKhQWPI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c854a4b0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2627
expires: Sat, 21 Jan 2023 06:30:45 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame 1928 23 KB
9 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15b192d13c1d029346a73cb1b2eb3a1b8905dfe8df1aaf9ced37356de9380e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23758
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9268
x-xss-protection: 0
server: cafe
etag: 17746901142539384344
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 17:17:28 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1928 8 KB
716 B 71ms
71ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

684dfe949ae87a38c2afbcee199f51b0025dd9121b524d62e881cf40846cdd21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Oct 2022 23:53:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 23:19:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Oct 2022 23:53:26 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/ Frame 1928 14 KB
3 KB 150ms
58ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/outstream.min.css

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 12:53:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 212424
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Mon, 24 Oct 2022 10:41:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 Oct 2023 12:53:02 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/ Frame 1928 362 KB
124 KB 151ms
59ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/outstream.min.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9c216dc2c163cef46ce19c9156c05aa2edfae28210be29ccfbf902a75190293

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 12:53:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 212424
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126916
x-xss-protection: 0
last-modified: Mon, 24 Oct 2022 10:41:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 Oct 2023 12:53:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 1928 17 KB
7 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d99f77a187454fecc18b59b2f520b1598b246d01e142bfdc4de56eb7221a9330

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:49:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32637
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7367
x-xss-protection: 0
server: cafe
etag: 4759548068123418343
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:49:29 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 1928 0
0 67ms
66ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQSjxAVkxlKe3Oi0vjc7myjYm-DawcTCCxIQlaxAl5fCPu1nYv_30p8j7eRX6jw252350NovrBolmUInK8FmwkNPzEq9w
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 UEFI-Persistence-via-WPBBIN-Detection-Response-min1-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/07/ 3 KB
4 KB 32ms
32ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/07/UEFI-Persistence-via-WPBBIN-Detection-Response-min1-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ad93b26ed81f9c28a344c6997214ce734422cb5a09d4abe1fe31b47356035f2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Tue, 19 Jul 2022 07:11:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=US22yqGcTbY1TeMcAv418YXZtNpYQ%2FghfxQZuK%2BcIzMQlXa2AnZax9Q9B5tZSDiCfmHHrDdag7vV8dbCK0M9ii3QiDv%2BQa4KyKp6d%2FenGJV6JUGmDUkx901MiP1y1%2FU2Ab1oMa30CkButnaJKoxEJ7i71YtPyPo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c857aaa0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3440
expires: Sat, 21 Jan 2023 06:30:45 GMT

GET
H3 200 Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 2 KB
2 KB 34ms
32ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06affebe3ff598a04bdbb98e7440365dc63e81a496ed82424edd6c9e827fb694

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
cf-cache-status: HIT
last-modified: Thu, 19 May 2022 01:57:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63575
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YDauY0ckGUsPGucpPgeuEwid2DacUdMakyGymQElhlSgbPnx6z4gZDUXAFdrqVnjXh%2FuwGnTQe3Jfc1oMcjrLoDPgQAlg07okRx0F1taqRbty1y57cF48GVqFcYb4OD53G%2F4h4a%2FQ4wTjcwCWTkUFhXUULSUwHk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 76071c85bb0c0a4c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1933
expires: Sat, 21 Jan 2023 06:30:45 GMT

GET
H3 200 container.html Show response
c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 14F8 6 KB
3 KB 32ms
31ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:25 GMT
expires: Thu, 26 Oct 2023 23:53:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 163E 624 B
297 B 77ms
76ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNix6QEQo4r5ARjs9bzUATAB&v=APEucNVVENYpfh0OrBoePPkbctoWhSYg7egnlG2MKGA77kZtMRc2_X9b9n93Akx17fLVqzgWznw4c0QfoQXqdI5fIptvpxJTvD35a6eEe7m8Imi0G0NNLV5MBo7hebd1GqlMCid5dvJ_x4wlXDd61BN5radP_QBTHyyHOoJ2ZsB0DapuW1iU4L95wRwsZmqGC-NfyIPQmj3I

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 14F8 75 KB
34 KB 97ms
97ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxsXCEWcyn55XeAZwKUVDiNuJkiWOM7uOv6HFxaMruqy6c74Q7EUX9f91WHUzkGbU58aAZPZA5FjyXw0sa6-yiSbo6aA&cry=1&dbm_d=AKAmf-Co8hIFcAO3_JNOpiMhR4C_P-wixG9gdHoOGbm8x5OkdUXLjB9-4STuh6VrwYRkCjUxndujuZ1Opkyet26yZ2JZ3IPLIkS0opkVv2YTzmVf2Dl2ydPbq91plkpKyAua_pvl6RqAsC0NNcC-OTT-vB0amRTG2AKQGWen7F-EN7dH5hoZS7nW691tcfZQRcoqBJVW8RX1hxgJp6aP0pogiHM47V8WchGxyZTUshJA5xkPdsv4OO53O0-tdg4KQTfZ870D1k7sC3n4FXUy-fB1F7wdzripGm4uYzfSpgaS7CDRjkRpFZDBBlH3Osw6O9m5zCSuLoFvrBlT-UWpKUTJk2XCWPBcX5pqBTJiGu1gAig3PYvQB4jK8QzqvM5IV_0K77WBdx5iz_vfN49aaesTftJShL8-M3CyfPdcPXNZLR30HztbKDeDi1jCoVtV2UpJIQkYjO0qfdFwp9SA-9hrVmBNVsTPrKw0YtDBc0biHczoA_hjxWn_GepVr-mevX6KkqJLfDwkPDAoaWCEsOE2Mivj1WMHnvJTIwIjBtfHpVvWo057Kf32WzaxxBKxrpqP7LXqsOfmXiSqzgrNTTN_b7LCttiEgnpMzewmnLM52GOLuLaLYbd0XtS1m5aSGImqwXIg0EbOLHxiB4V2QUYlZ65aDrKH1vJ512-sEPiCGyHJvHFAUhiPwSbaKHNbl2ExF-ETJ36HHCC-plZ15BQVYDhrLpoY2rV7nTfeYCDdgLMlf0v3T2de5VsJYHaL_JBg3f74_g6zsye6fYOYAbYgp_XuhQVerrBCoDM2wXujrlQbRbsQgeIM_32LTM1ax9yXmVylckAHtXmYau7ikecgr-LIyII_JW2UKtZ9IIg77_y2l9APlsbfFT1oXb0ZvrcuPD1JxMojfGxDhKtISt0l9yCSHGi7UoeZMwDFJtuQYjrG2B9amn2kJ4gLuapJeM55CRsJSeZgIgIxNkidiCsgH4a8sgJT7LYGQrRJB7YO2GNOuhtPoYhBwVfJWWrcQEfZ4w6SDfpUiQQiVtYrTb_EcBc5ueDNMX0H_7_imvGbtxppZnBHX5-RCn_7Xbu8Wd8alcgvw2K2bUuLa5xEmBiG4Fl8HZLrioeOtH3L7bgJtaOGbea-_mwU4pkLPCdYalnrWRzT32fhAJt1gBUYy-IajCaSPWufWAl8Pm1OzR3tEswtBb93B-7TL8wZXnhV39JOrBPLAwcULiQ7VNSa6LD2O0v9IHyxtQ5yEemfVlv9cQ2NSBAR0RiJFXjLFspV75rDZSvSYF71dh1eYd52EDmkTi4Y2Yl_dwqbxeAusiNrxnXaB_ctBKmuOjulVsz5Ip0-s4fywqr65te1LguiU2IMG_1X-znpgw9Wc1x0nkW0KTdKa5YllBfbykVbaaHJNVNtCDZvd5UxDZwyoNGFwbRR-WAugPinc4bvmU7LRvqr87jQjO9gnJOyJw6ESq3GnQw1vGU_zfisGBdh-zesxhXdFDn8G3z3TXNE7HAoF3VYKAxCXtWSX1V0cG2L62TOGcXBdXqCtDBoVihXPJIL_gJxs8605QXEVI19-3fOyPowr3DTeg9u_ftFiaZnTK7GCTylohjp_gOgmTfPpjonRq1mUpKeoCbXAUSEBX0v2B_KfP9KzDAQeEOL29Xmm60WSFGSocDmGJc9ShGkDtB2vgLOBHUBSRfEKSPPmU3WcovmtPvOUKpbHLpEfzamakeAl7Pyn8SqClMXAuIq4PbnrbwOu8vtR42vCOggh-_b4dM8h1w1NXwlDzpcy5so01DN1fbiXtH6YO172FlS42QizYPOvLD1nHPVOFIqSwaUcW1osA8ED2oycBy2F7NoUXiR57pJB0WEwDJjnnhAzoJ0TauS2ncCL6yr4ZQsrR6RMpw9aWii7KcPonNqXwPdZILliSUVo9lJewbAThalFVSfbXw9eXZKbF-ncJUgOaenTjJs6Sn2p43WJiimYoZNmZlxeCznyGAdodMPHPE2mmz4ERQA3xWlnR_BO34_tiW2WNjqvGT4kjFQvhYFyv2y7uD6UnAv2bbSthyJ1uo83jzM6GCzTSqMWDe3b3UcYvMJnriMo4LNFUrJigEPswENIpqOIE0rMKYkegOxxHECdyWIRLz6YtNZUsHmVLFCl9_0nvqcmRqvmQYb2IEkaUXe8eLbEpGcZKZ8zmCFLoXiRYLkrdL4DPXj92h-wkdoS7riUg1JxXhcEcaVSvi4_L_xQ3OJVPUmJvPbTM4H5up9Ym4fHOTc8_DJolQeOXnLCLDus84DusQN2Fy5T9VPIHy57jGcZOJsykGiYiH85XCCrB6ZhNDXvn52WiQvbvW47p8afECV-AyPKZ5X_6uHfopwLC5xjGwemHP149BJt6JE1QhAESDqQwd8wQRcNgP5KyrnVvAzo_g9yayRVbADPI1_FXfsB0uNbgDUtBGEaLPyVfnRmPfzNkuoMc6ES3uD_yGH6Wu13AySEFaD438RCQsfjRTczN-2LZpeLc2v7Dlo3DzjSU9Dse_7GM1c55Fi1tHfP3v2TQl3LIewcsWdFMTZI3wRdQwrVxtU26m_vZHktOEjOOOO7PWJVj0ql1h5LSQHwamOk2-vSUNr7vuCfSyL2OmqkEgIatRZ1gQHF1ffUHdclHeMyGBaPXcu7xIadssoj5KTZU_Ny8aHduroV__ocY-xEqT54_MC9ec76Ru8dA3G0JaDS93AtIzJDqWTgVclxekiuREv2rrLoxfWJTK8pdzuUDSFBxpr9j7DvmjGdCad8lC_INQvBDJ5SDmM2f_Ru62vbmbotDLsWlJY0aWeK-8F2B1YoHKOH_e-JH1kUJiYeAVTC553mfWrVYJEnDvReaQAgoZQlr4eSSrSlOig3fqQ60N8x_8v6jY-UMO3qyuJGSvnii1-1IrcIJhGUHo8HUrzIj5DPcWhFkruQQLUc9nUCSvJrp7OG3yX0xNXUICkfjLq1cmg_ruqxYTpnoj0HYxvr3ujvH5JSh8qs6POy6i9Ovpaf5o9clYguQyU16Gf_ChE7TkWHRcJQ90oeBYMbqLh7PM5X7LP9BATRyeL_gln4lqTZpBLyeuaotNgYK3vg8EAoKogs09tUWYFZp_ApTiWpR8Gf8SwfAWJcsj-x65OkpHOd1tG3_gbxqYTJxw-g7SMXOtomr8qs5L6_elizoZrJUSEqUx0qAxK06tYH8NnD_cYI0n7RAekAzRK10KEM9r6UPEbTV15tdlEaCuTywFWxl3aSRapCLi4seXxvTWZmvmihRvyLVOdD1zHS_E0xrr8VIw_b6QtRWDP4WPNqStPWW1Cs4JSZuwTktXkm7mMqZ200i534sJzmYqPmxi4Pgy03LOwFaT6SnwP981Lo8-rDH8BKwvC-gfRnSgaf3Dg0z0QdiZA75hsgF63T0h-vkz5DjIhK_A7DNUqT61UzeuTnhVnPZBUYNmuhwlm-IsA8H0_mTmvDlYZklPvhbfky7kzDC525erpTgDcYOutF26HeRd5TEy3WuD_sBI-tv6vCL_k-oGLMRLn&cid=CAASJeRoNAsQ-KzNIoEIR6DMBEwZjEtREtzYQA5bLpX7C91HJ3esLBI&rfl=1%2Chttps%253A%252F%252Fwww.socinvestigation.com%252F%240

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ea31a72e208889ba7cf10d12da43cc3dc1d2a80678e39d36fce67d667586556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35286
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 14F8 42 B
63 B 93ms
92ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CY9RO6yaxfQ-uPFko7tFxTsK1uJguVUvkMmuT4sHz1CuIEW0HKkXZDAohvFjdhVyu33k61xqydgVI9IvyThFu6Dpi8s6ciFBSYE8ck8RvBVnHEX0k

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 14F8 3 KB
1 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/window_focus_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:18:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9288
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 21:18:38 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 14F8 17 KB
7 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d99f77a187454fecc18b59b2f520b1598b246d01e142bfdc4de56eb7221a9330

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:49:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32637
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7367
x-xss-protection: 0
server: cafe
etag: 4759548068123418343
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:49:29 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 14F8 0
0 69ms
68ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSSwWhhzUqX5EqRbUguTwLLJc2Enm9ISK13yn6Az7N1ebOrH8toJxRgccHWDBoayv2j44cUViprxpLAy7eMXzmWiphmDQ
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 14F8 152 KB
46 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47514
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1666784471914692"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:26 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 94ms
94ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221025&jk=1423218013319643&bg=!dHeldzPNAAZPh4lnb4c7ACkAdvg8WjcRQZ745HEO34iPc2Sz3VOu3hCPjXN6pU3xxrkUqh05hnw3ewIAAABDUgAAAAJoAQeZAp_Cg21s-MRe_H8QdPffUqyl4tFVe-Mrm1M0y9Ye08v6-DU8ve7H0RIT7AzKne_i3cFmpEdh_uQWT6gV8Rlx_mIHovvdWqSx3xPJ9E_nyHft86fLiAPtRZdu5P5ZQV5nZNoC3GDBzl87Qzp-Dz_ss2LFcDXBNwDx2tXLG0bJWwWdi9egC09GOtr8y3cTR9AjUNFCTI2hFgMnmf7cEG1phaGfWiu_bWpcretK_C2GZSZIOmkz7x7I-0Qs1MEYWWzJjYgjmNrbTZSF-TZ2SxGKM9IWUI6WaINjxBBnjrbOU7oQziMsUDaHNkno2wnnJm69QbVs657Jvo-JqDT7Mhxm0pwWo7lemD8HsONUhAy-x96qgGz_LgXQuWMOgmmU4thOK7aF6vLx8Sb8mwL0uRKAI-4YqkaJ2B80yyo3D_6gWYEwSPjlkVU2iitRS1cwAW8vc63_J0YFYaNywEJzLaRP7BIagMJhDOW-fhn6WVTgg41LUqi3xOZGvfusX-sQeNzHsFXBp4MmtmBK_N6H9htHn_pZHV6greFNiMB0F-3UV7lR7XRr4ieeRAc6TtXK_LOSYFBrGJTFz_UwXdJb1-MZXr6jQO6rE_NaXgtFAsPjmFWkoBfG1gC71m80Szj3O0jyPvGI69FOWkAg1fiKHT3cSohUvYuqqaw0B1HLvAGHubNIm5zaXcaLdnyJXak956ZOAKDqQoCCk5duGnttde7ksyiKNoLSPDYdmWYYZOqZ9Pz4x1Edy00ueTiHfvXse6CUl-PrZGubm0Bvym5eS6SHCkLUyGccR1MiDvjrgy4q3euD1jZlMVE50IxrwGzdzS4_3RLTVsUPLZSzs4SG6kEJUpFUGUD92qDreO2IN7JSJsQvgXv3usYj4J-oAK6dI3RoVw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 163E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&C=1

43 B
766 B

34ms
31ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNix6QEQo4r5ARjs9bzUATAB&v=APEucNVVENYpfh0OrBoePPkbctoWhSYg7egnlG2MKGA77kZtMRc2_X9b9n93Akx17fLVqzgWznw4c0QfoQXqdI5fIptvpxJTvD35a6eEe7m8Imi0G0NNLV5MBo7hebd1GqlMCid5dvJ_x4wlXDd61BN5radP_QBTHyyHOoJ2ZsB0DapuW1iU4L95wRwsZmqGC-NfyIPQmj3I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 163E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y1nId2VlQafzC7SYC6QH.AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&google_hm=2

43 B
766 B

31ms
31ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNix6QEQo4r5ARjs9bzUATAB&v=APEucNVVENYpfh0OrBoePPkbctoWhSYg7egnlG2MKGA77kZtMRc2_X9b9n93Akx17fLVqzgWznw4c0QfoQXqdI5fIptvpxJTvD35a6eEe7m8Imi0G0NNLV5MBo7hebd1GqlMCid5dvJ_x4wlXDd61BN5radP_QBTHyyHOoJ2ZsB0DapuW1iU4L95wRwsZmqGC-NfyIPQmj3I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDbjeaYKpxfltYFCdi4zSZo&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 163E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPxqXSWnjaKVNkAo9YZy-Ok&google_cver=1

43 B
1018 B

32ms
24ms

Image
image/gif

185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPxqXSWnjaKVNkAo9YZy-Ok&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNix6QEQo4r5ARjs9bzUATAB&v=APEucNVVENYpfh0OrBoePPkbctoWhSYg7egnlG2MKGA77kZtMRc2_X9b9n93Akx17fLVqzgWznw4c0QfoQXqdI5fIptvpxJTvD35a6eEe7m8Imi0G0NNLV5MBo7hebd1GqlMCid5dvJ_x4wlXDd61BN5radP_QBTHyyHOoJ2ZsB0DapuW1iU4L95wRwsZmqGC-NfyIPQmj3I

Protocol

HTTP/1.1

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
AN-X-Request-Uuid: 2579db0a-204b-4839-bb3f-6e0dabc21f6c
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 31.204.150.144; 31.204.150.144; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPxqXSWnjaKVNkAo9YZy-Ok&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 163E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D

170 B
188 B

110ms
47ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
AN-X-Request-Uuid: b46f6cbb-eb67-45b5-bd40-be4203f43f5e
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 31.204.150.144; 31.204.150.144; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 1928 0
327 B 356ms
108ms Ping
image/gif 2607:f8b0:4004:c1b::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~l9qali1o&c=3861975625142&slotId=1930987812571&qqid=CPrbrtiL__oCFeLsEQgd3hwGnw&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C44752538%2C75259414%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::78 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 1928 15 KB
16 KB 127ms
64ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 05:09:29 GMT
x-content-type-options: nosniff
age: 499438
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Oct 2023 05:09:29 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 1928 15 KB
15 KB 121ms
60ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 13:14:53 GMT
x-content-type-options: nosniff
age: 470314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Oct 2023 13:14:53 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1928 0
20 B 94ms
94ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CoXNvdshZY_rIBOLZx_AP3rmY-AmtiqDXbKuqtue2EMCNtwEQASCT3JxzYJGEoIWMGMgBBagDAcgDmwSqBIMCT9CWiZDrA54ZCLCNpoe4NW7QkUpj_nVEU2LHTaOZNbenW_He0nsnhwtojWPkNYO4ptnBzvMMgU_6Fj7T1ikD9QcZ-J_SNE3qCxToSL-0Izu6l8HFmj6AM2JZ0crf2B4PsBd-xE-4tF2PI3VsnzG163MY40U2Fv3JWaKj2rmh4jJ_KHkmAuO2nRYmS2znSlYU3az92UK8fgSIjqbaJhU1pSZeIrAD_hkJbXOkb2dNswTyC10eIumVx_9uYIdwendn23v5BSp5Z9LGE6uA_L_N94uSnvyjzz87wy8jVzqFn1Q9KSbgVodL9mpNcfwluCW3Wd_63AqRBiC2Lo6Ec8nYYZh66MAEl9D1pYsE4AQDkAYBoAZ2gAeCut3aA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAeALAYAMAbAT4_vXEMgTx_iW4QPQEwDYEwqIFALYFAHQFQH4FgGAFwE&eventType=clickstring&clientTime=1666828406959&ai=CoXNvdshZY_rIBOLZx_AP3rmY-AmtiqDXbKuqtue2EMCNtwEQASCT3JxzYJGEoIWMGMgBBagDAcgDmwSqBIMCT9CWiZDrA54ZCLCNpoe4NW7QkUpj_nVEU2LHTaOZNbenW_He0nsnhwtojWPkNYO4ptnBzvMMgU_6Fj7T1ikD9QcZ-J_SNE3qCxToSL-0Izu6l8HFmj6AM2JZ0crf2B4PsBd-xE-4tF2PI3VsnzG163MY40U2Fv3JWaKj2rmh4jJ_KHkmAuO2nRYmS2znSlYU3az92UK8fgSIjqbaJhU1pSZeIrAD_hkJbXOkb2dNswTyC10eIumVx_9uYIdwendn23v5BSp5Z9LGE6uA_L_N94uSnvyjzz87wy8jVzqFn1Q9KSbgVodL9mpNcfwluCW3Wd_63AqRBiC2Lo6Ec8nYYZh66MAEl9D1pYsE4AQDkAYBoAZ2gAeCut3aA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAeALAYAMAbAT4_vXEMgTx_iW4QPQEwDYEwqIFALYFAHQFQH4FgGAFwE

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 1928 29 KB
16 KB 153ms
68ms XHR
text/xml 74.125.133.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CGzLS5faWUqk0Ox1yR_rKwDJekl_K2YG5SxdCuf1Jaa5P0CDzj5JA76Tr4wQCeaJLlLePNPBuFrahF_azsl-rDpYDTTA&cry=1&dbm_d=AKAmf-Dx4n9eUKC6My5-RGXu_oRNwwNp2UGGtygjRXq91mVs1H0qQFWROYaZr4brqdLhws9ZX4WJK5KGMd6kQiof79m2WmMpCFfT3FAjNCfWyeC0IluzszZJlTsahEujDNnkdkzxUS4qjSHJPBJtndFdSOmm-wxmiji217I8cbgrFl0Nxns9PInIQRUGZqjXx7l_j3iTjVYtzt-Y14fP1DtgmkZwz2JiPfJujHRfYyC_nhmmE099YOANZx9wCxjLLl9_RLjbY_j43NbwYc7a-hTSGkYGJgPxTuU1wezqea6att1xKvY2GEvcdqQBU9KAw7g8mq1WnVsCv-_kBAaeMse4pmuX_8JoI4VJefJiz-n2Q4vcsydaBjMTR-UCqf98k296oFWuIMVASy43uEv9by04TDCVE0piwlVXeF8kRZUgRfIkxWEw27G9EaRNO8fynAyqevXAlnNR6hRPtz0KeLbuUjaaxFULhYvXYWqViCj9B9H4jjqFIql1Sz7ASPP862dJAc9dcuQagVahYxY4mYtjyykaIy6ttBQKHJIK4ablf4Ac5L-T62ar80GEMi7aU_sVsemNH8Bgwggvy3o2VAH8MGo0sJuKuAObVcE12wZr58zbZrRlbGSrKLvi0Dq0UMTQ4pQfc7rVI60dmt2bwAiZzZk7e3-gcW2tvklVip8iC5z5MtzsWalc2lvTx_zi8GcIEikQVouoiqDm3fHiNThOP0ksCimHQzplbKucLaqxWsQQZrRe14CnSAhABRW67N3_klj5FZRxBkW4T6XZ62yaFGfhCXMuualbftUqGmMe0iY8FPmxCc-dIn9arJr7WpX_TXFL8bjLHybdOOX2vVL1BQ4pPDreE5LtTDuHXsySGSKwNB2zwnh4b3YBWv65ZAr0Kmb2g42MvjLICRuuW1dRRbf1Cb5VzbTIC4teZH9oUtnnRzXrfSpR8OeHjbwtRVB-Quz3-yxWxc4H9QKOb9jEDwJLsvWuQKNBLWRSRTjtqmOUyJEWKAGeMHeFLk-_xTr5JfJErdn8aft6yqFvqOFjGQ8FPyVQ5ofyNQEXf45n-TP-6y5H0bv0Q1LyP6JBrsSkpuJcbn4VI-108rxWK6ePsFTBB9iaVEMIGMtVviQosCLGFBmNEq2Z34ZQXN9pKFgH0Zx2WUpIVbrUbfTRs9F6RS6wi_tTChcvN-KGiouDRWvuICwz9ahcMfgwz67sWqej1Ar81Q1JAzkSU8MjMQVC4gBrpzVPc3EdLkbO4rsT6h-9lPyYtpHDw6N6sD_VSADwRebeafvfmr3hN8_KTvXluO9M-eOxBqRYpDbRIMGL-NwnDDGxGhjvAUFDMld8h-Hww76KiqlreCq02LteSCuPv3q30wztFG5csGDJ7xdyhdytttN5ZTXh16QoJWaqKipe9AmLo1803_M-N0PiBT5XelfiR029jlIbmQN8yDnLmfUcoXjmqzoX8yg60rYoVqD5Dko9k21pQrAN3femV059fgpZScvmcKfEaXIs1EIf-UdXFnzxEkEfKkbDnFXZOzsAx3mmmTbPawV0Wb-I9Hn_ZIlAckE1Fwmcy26emDygSwe9kJaTtkGktp9EBotrMiTHYF0uQc6e1xRhY5UdpDW-Xw5U3RWQvBssOt8tIw9TOKFfooTYAAeThh6UjBHyAJShpsNqYH0DJojaqq9XI8ee2t6VH-IDn_5QgEj9UoIQZU1y9iRqzKQUfdkp2GmWWo9trgp2h2tvR-HhH6BNX4W15d0g1OjdBtxJ7sqNilcCByltt45UcQsvWbru_PkOack9HS8_zFVGBH60z_aOr_GpzjT8yGV-KJ-1XvLYbFHrZAAJAJCJuhnSXGTnQp64nj1YWf9r_cHlboav7T-0nn8pN1IIfSvV52e2rxV0QmAzDr19klTlG_yG9U6S7c7rALpvgCFOFfNgruTd6VeP33jT0aMTOltizEn9zsZbEEwdlQPRoFfHEvIbY-9EEiYjVXrTfWpqhF7mOoBLr4wIjq5lFLEBeNQhH-eQvWa_oczC42FSpQ0j3HaFvFUioQxJLom168HsRidyJ95_70Ga4g5_Nr1YF4zR63EleRCtMs85Vv5pyqueyoae-bJBkV0f4Knup0VQlz8M79NicRPV8mhr057VHEQIAHo8kH0sDxIO2tZ9lTbH_FtUK_7xPuiwjgGyT1CRhbgTWyMhTm6CYKlufvJ6-kpPYnIDCKeQtmElbV9EqZH61_-6h55E1As4AGmEaRnK5s8l5-Bwk_p3qVTgTUSHjs1ugzjrHfOZ--DKcJExBkeX39Yh1Sn6fIpLDxqs7XaKt4TIrkcvfcrD4B-fxX43JdWlHrbIqQGoCI9BkRIHBNirYRJPdta6et1jHc-pTL7y-6mkqbGrB0NetAyaiCFkf1moedic-UOIK2PGiapRKuvW5nozobHgqJh_jDGYfO0W8RJyhhBIWHnYM0D-3Er087CmHtH6EcS2dUi9ujpJw0ZD5HN1Am4geX_GBbko2RE9oyr35O6Y_JZxpSaBcLo1WyQpEXQtewKItjadkGPT4CgOePGPCXC6qE0xC39AFTSvrm9XyJbyZehrbHbnJvwdzS0BQSkRb8m9O4oAXP39zt_oj8iwPYpCsQeAPaLpi5XZK_ctdZVkqC9q3GrNO0IKvs9YSAWivVw63UejO6YAf-Y_Adl285OT_wMnRiZB0QzU5zxTtqvkylZLqRmgia7r3r2amI2qn12pPL8KVqFjmrqYpwY_ZYAtdDPzO9CW5ftbkipSdUI8NAER7D2TpX40ztOXpMKHp86RMGZSF7j271rBu45ncvnpcQ4q1iPs3BTuM1WtuYFtdT2kmWvOGm0bikv3Z4lrZPvzo1XRJeLeoG4YTtLrt50bNlzXVs-J1vqCVecPgN1vc6t_72zVvzbR-xDiFCTiwbC-dorXwBxx3VmbWL0j4GOXw-9okv4CxtVy1RyPbOUMwJUAGTx4FA0NHZQh6GdKnmLgdI6l6cqCwVWM_jSu076jnZgv1Pq0MjE5XqLJxyrFlXaNi0JmenvHz2G20F_INAxr-izyOZL8scJUFEq5MkYam5flFVBgqSIzdwgIW4p91ASWhgranhQ3u68lC9yKa5CJ1E7h2RWykj3lO_Mx-jeve9gZ5N5Phdj-KLZW6StMgKF6fLUJtWTiPh8b1crAHAlCNE39bD8ExtDsWJrmLBbXR65Q1Z3FVGrqRqVNAizAflWucyuQtxRv-3sCAKMUAC7ghop_xgb1UpB9ykJWErWHQ8rc9kp5mFe7zH9TopjOgqh4iIxgO0bIQmO3TnJXb050iNOPw8I_k6O2njXHr_3JRnCQ7Vb4ytoKnZQSiv4X7nQ6sfYQwGN5jK9_Hw&cid=CAASJeRoTGuCi_oK-3dUIsHZ_5buPIWrqR0xNhiaSb52MLTCEffxC9Y&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f157.1e100.net

Software

cafe /

Resource Hash

c5c50d946b71f3b8f8d411acd873d00c741a090d6dbddf1b31c3ddbc4b607c85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16005
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 1928 0
0 71ms
70ms Fetch
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cpw58dshZY_rIBOLZx_AP3rmY-AmtiqDXbKuqtue2EMCNtwEQASCT3JxzYJGEoIWMGMgBBagDAaoEgAJP0JaJkOsDnhkIsI2mh7g1btCRSmP-dURTYsdNo5k1t6db8d7SeyeHC2iNY-Q1g7im2cHO8wyBT_oWPtPWKQP1Bxn4n9I0TeoLFOhIv7QjO7qXwcWaPoAzYlnRyt_YHg-wF37ET7i0XY8jdWyfMbXrcxjjRTYW_clZoqPauaHiMn8oeSYC47adFiZLbOdKVhTdrP3ZQrx-BIiOptomFTWlJl4isAP-GQltc6RvZ02zBPILXR4i6ZXH_25gh3B6d2fbe_kFKnk_0zzGOHKaLRw5Po1DSeIL9noH5iXp8IMhticILDZfrlN7jZwwOM50DZlBFWAODC_u7J4ClleIZMe8wASX0PWliwTgBAOIBdOmtuNEkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZ2gAeCut3aA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcKEMr5ARiX7qbUAdIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsBsBPj-9cQyBPH-JbhA9ATANgTCogUAtgUAdAVAYAXAbIXHgocCAASFHB1Yi04NDczNzYzMzQxMDU0OTkzGKrnGg&sigh=OeUm6zOV6Ds&uach_m=[UACH]&cid=CAQSPADq26N9Acxm1wlBhBYQ_LqB9j-qee8ybYma8swK1ZV_61nY5UQwq9KjNAimMmSkqFSBlw-LXWd2KEY5XCAT&vt=10
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 94CF 1 KB
643 B 59ms
59ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 42713
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 12:01:33 GMT
etag: 48472445140208031
expires: Thu, 27 Oct 2022 12:01:33 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 1928 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 35a3430524543dd9933b01089961dc9d0fbaf84b74af1cfc246c162ee0d3125f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame 14F8 30 KB
11 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxsXCEWcyn55XeAZwKUVDiNuJkiWOM7uOv6HFxaMruqy6c74Q7EUX9f91WHUzkGbU58aAZPZA5FjyXw0sa6-yiSbo6aA&cry=1&dbm_d=AKAmf-Co8hIFcAO3_JNOpiMhR4C_P-wixG9gdHoOGbm8x5OkdUXLjB9-4STuh6VrwYRkCjUxndujuZ1Opkyet26yZ2JZ3IPLIkS0opkVv2YTzmVf2Dl2ydPbq91plkpKyAua_pvl6RqAsC0NNcC-OTT-vB0amRTG2AKQGWen7F-EN7dH5hoZS7nW691tcfZQRcoqBJVW8RX1hxgJp6aP0pogiHM47V8WchGxyZTUshJA5xkPdsv4OO53O0-tdg4KQTfZ870D1k7sC3n4FXUy-fB1F7wdzripGm4uYzfSpgaS7CDRjkRpFZDBBlH3Osw6O9m5zCSuLoFvrBlT-UWpKUTJk2XCWPBcX5pqBTJiGu1gAig3PYvQB4jK8QzqvM5IV_0K77WBdx5iz_vfN49aaesTftJShL8-M3CyfPdcPXNZLR30HztbKDeDi1jCoVtV2UpJIQkYjO0qfdFwp9SA-9hrVmBNVsTPrKw0YtDBc0biHczoA_hjxWn_GepVr-mevX6KkqJLfDwkPDAoaWCEsOE2Mivj1WMHnvJTIwIjBtfHpVvWo057Kf32WzaxxBKxrpqP7LXqsOfmXiSqzgrNTTN_b7LCttiEgnpMzewmnLM52GOLuLaLYbd0XtS1m5aSGImqwXIg0EbOLHxiB4V2QUYlZ65aDrKH1vJ512-sEPiCGyHJvHFAUhiPwSbaKHNbl2ExF-ETJ36HHCC-plZ15BQVYDhrLpoY2rV7nTfeYCDdgLMlf0v3T2de5VsJYHaL_JBg3f74_g6zsye6fYOYAbYgp_XuhQVerrBCoDM2wXujrlQbRbsQgeIM_32LTM1ax9yXmVylckAHtXmYau7ikecgr-LIyII_JW2UKtZ9IIg77_y2l9APlsbfFT1oXb0ZvrcuPD1JxMojfGxDhKtISt0l9yCSHGi7UoeZMwDFJtuQYjrG2B9amn2kJ4gLuapJeM55CRsJSeZgIgIxNkidiCsgH4a8sgJT7LYGQrRJB7YO2GNOuhtPoYhBwVfJWWrcQEfZ4w6SDfpUiQQiVtYrTb_EcBc5ueDNMX0H_7_imvGbtxppZnBHX5-RCn_7Xbu8Wd8alcgvw2K2bUuLa5xEmBiG4Fl8HZLrioeOtH3L7bgJtaOGbea-_mwU4pkLPCdYalnrWRzT32fhAJt1gBUYy-IajCaSPWufWAl8Pm1OzR3tEswtBb93B-7TL8wZXnhV39JOrBPLAwcULiQ7VNSa6LD2O0v9IHyxtQ5yEemfVlv9cQ2NSBAR0RiJFXjLFspV75rDZSvSYF71dh1eYd52EDmkTi4Y2Yl_dwqbxeAusiNrxnXaB_ctBKmuOjulVsz5Ip0-s4fywqr65te1LguiU2IMG_1X-znpgw9Wc1x0nkW0KTdKa5YllBfbykVbaaHJNVNtCDZvd5UxDZwyoNGFwbRR-WAugPinc4bvmU7LRvqr87jQjO9gnJOyJw6ESq3GnQw1vGU_zfisGBdh-zesxhXdFDn8G3z3TXNE7HAoF3VYKAxCXtWSX1V0cG2L62TOGcXBdXqCtDBoVihXPJIL_gJxs8605QXEVI19-3fOyPowr3DTeg9u_ftFiaZnTK7GCTylohjp_gOgmTfPpjonRq1mUpKeoCbXAUSEBX0v2B_KfP9KzDAQeEOL29Xmm60WSFGSocDmGJc9ShGkDtB2vgLOBHUBSRfEKSPPmU3WcovmtPvOUKpbHLpEfzamakeAl7Pyn8SqClMXAuIq4PbnrbwOu8vtR42vCOggh-_b4dM8h1w1NXwlDzpcy5so01DN1fbiXtH6YO172FlS42QizYPOvLD1nHPVOFIqSwaUcW1osA8ED2oycBy2F7NoUXiR57pJB0WEwDJjnnhAzoJ0TauS2ncCL6yr4ZQsrR6RMpw9aWii7KcPonNqXwPdZILliSUVo9lJewbAThalFVSfbXw9eXZKbF-ncJUgOaenTjJs6Sn2p43WJiimYoZNmZlxeCznyGAdodMPHPE2mmz4ERQA3xWlnR_BO34_tiW2WNjqvGT4kjFQvhYFyv2y7uD6UnAv2bbSthyJ1uo83jzM6GCzTSqMWDe3b3UcYvMJnriMo4LNFUrJigEPswENIpqOIE0rMKYkegOxxHECdyWIRLz6YtNZUsHmVLFCl9_0nvqcmRqvmQYb2IEkaUXe8eLbEpGcZKZ8zmCFLoXiRYLkrdL4DPXj92h-wkdoS7riUg1JxXhcEcaVSvi4_L_xQ3OJVPUmJvPbTM4H5up9Ym4fHOTc8_DJolQeOXnLCLDus84DusQN2Fy5T9VPIHy57jGcZOJsykGiYiH85XCCrB6ZhNDXvn52WiQvbvW47p8afECV-AyPKZ5X_6uHfopwLC5xjGwemHP149BJt6JE1QhAESDqQwd8wQRcNgP5KyrnVvAzo_g9yayRVbADPI1_FXfsB0uNbgDUtBGEaLPyVfnRmPfzNkuoMc6ES3uD_yGH6Wu13AySEFaD438RCQsfjRTczN-2LZpeLc2v7Dlo3DzjSU9Dse_7GM1c55Fi1tHfP3v2TQl3LIewcsWdFMTZI3wRdQwrVxtU26m_vZHktOEjOOOO7PWJVj0ql1h5LSQHwamOk2-vSUNr7vuCfSyL2OmqkEgIatRZ1gQHF1ffUHdclHeMyGBaPXcu7xIadssoj5KTZU_Ny8aHduroV__ocY-xEqT54_MC9ec76Ru8dA3G0JaDS93AtIzJDqWTgVclxekiuREv2rrLoxfWJTK8pdzuUDSFBxpr9j7DvmjGdCad8lC_INQvBDJ5SDmM2f_Ru62vbmbotDLsWlJY0aWeK-8F2B1YoHKOH_e-JH1kUJiYeAVTC553mfWrVYJEnDvReaQAgoZQlr4eSSrSlOig3fqQ60N8x_8v6jY-UMO3qyuJGSvnii1-1IrcIJhGUHo8HUrzIj5DPcWhFkruQQLUc9nUCSvJrp7OG3yX0xNXUICkfjLq1cmg_ruqxYTpnoj0HYxvr3ujvH5JSh8qs6POy6i9Ovpaf5o9clYguQyU16Gf_ChE7TkWHRcJQ90oeBYMbqLh7PM5X7LP9BATRyeL_gln4lqTZpBLyeuaotNgYK3vg8EAoKogs09tUWYFZp_ApTiWpR8Gf8SwfAWJcsj-x65OkpHOd1tG3_gbxqYTJxw-g7SMXOtomr8qs5L6_elizoZrJUSEqUx0qAxK06tYH8NnD_cYI0n7RAekAzRK10KEM9r6UPEbTV15tdlEaCuTywFWxl3aSRapCLi4seXxvTWZmvmihRvyLVOdD1zHS_E0xrr8VIw_b6QtRWDP4WPNqStPWW1Cs4JSZuwTktXkm7mMqZ200i534sJzmYqPmxi4Pgy03LOwFaT6SnwP981Lo8-rDH8BKwvC-gfRnSgaf3Dg0z0QdiZA75hsgF63T0h-vkz5DjIhK_A7DNUqT61UzeuTnhVnPZBUYNmuhwlm-IsA8H0_mTmvDlYZklPvhbfky7kzDC525erpTgDcYOutF26HeRd5TEy3WuD_sBI-tv6vCL_k-oGLMRLn&cid=CAASJeRoNAsQ-KzNIoEIR6DMBEwZjEtREtzYQA5bLpX7C91HJ3esLBI&rfl=1%2Chttps%253A%252F%252Fwww.socinvestigation.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac32377ae624ac720172de6cd59d7fad67c0c78fe658c7a7b2b43be14b9d74ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:47:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11484
x-xss-protection: 0
server: cafe
etag: 16485072225624805710
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:47:30 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/elements/html/ Frame 14F8 8 KB
3 KB 63ms
62ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:47:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2998
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:47:30 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 14F8 0
622 B 160ms
77ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuZPyTDyuEd8WgpcempXWKW7FntoJ1zmE9ufLo-RL28ygLkX5TdHxJVROdLwPmVZXsQ7zz_24vDGj3Hsuf4_ifHzzB8kPhEs6JZ4iiuk64suGyh4f5udpc6iy50wrERpQJhJIuLlDA-E31GYxcz6slzaUdNNk8hOzbEeuefTHzJqteAk8tpM7UE3fH9LApmTVZ4E10NQVeiMtyJdvbC6uZdTjMHl_ITN_8-0g8rEGQokBqjXtK5TytKLZFFJPoG2by0KHloa7hEonD39tKiVm3NiTjuIA0q9PzLBAWIIZlrETQ1E-nIvUzo8E_m4toSYUhf8Wbut_E2p1FPekXYRpuiT-cIxxzEJ3dnXB8L31Ndr5ETsvoppS9LXIq8pO59aqiz3URFJ1ItTpFxOUTDdaY4zHNR-E3A8rRoezoCSnjCZR_9XHe3RJ205cH6lCuNc3Rt_Saa31ry3TJO46D3UjgpUlo3LC-ZCMrUM2Z-5g81hRMWly-YTbrf0AUpopS68AmkQXUdQnTqfdCcRdnlPNFaP8Wvxua39vMdF9Ct-b_iGKNZkMtxSeyUZBjHwOJEn3FG42n7he8zR-P3MI_t5z1rVzpCCP9yMohoeSe1IChd_MhY2jguVxiEpz88975F8k4EHX3mfAresekcVyrSkYDYe8fikSwHoHrPrJEXb1STtEK8zFYLjlKDINAh5ydzDraqF_Hb7G9Kx-6IFcsynxfr_dmD1Zaaz4CcAuwzL46RPE1ZyAhN14sXXVA9SzXcpXSuHwJcCpI92exTNvSqSnFGjipbqDXjC5Z_Q30R3Pn7BbHmay3DGJ6dN9bDRAJew1fs4iDiFdqTIrvRlp7dT8Sg2EqiMxh3imdW6e5w9diF4FlHdH6hap5ZzEMrxj4ATNaFIT8IYeSfggJlMLExCSj19E0SELpzjspVLF2PtAtqgfOge-U-6zB6SX2gOa2QYygYIgd4CJYwAHNWL9ED_lljjT525SGonWWtgBbNOyz03PB_IiYpyd4rS3jnGkldrifjLV35Qve50KwcGYC919XxpEOBSEeF6O8mB86TktqoGLWYXYv3qJYqcZQmnWJXeIPAKuz0P5R8l_sIsLEPaV7bv0eTnu9d5rt4f1UqLEz2KaAuvAsgoRQS4ZmxSM7gR90MrmlOTzBypaNGYrzC3lbfXhLhiu2DiI3AKeyTGMxoA1NAfC3bkVwBXD8erM531fycCrQvg_vMmU9uS0yu1xFWTQa0a2Z8pCQ46YbnD1jWzlMUMS9I04INaIp0CdWMkBP2Cx2JJvfoanmx6MrGLh1wQ3Ff_2Da0R85Njiu&sai=AMfl-YTPkmk1Uu-0yGJV8fX09dd4k8dZD5AQbVWPJyoG1aUZCuegNoccTb_q2jhyCK-RbCnPdiVsvHYB7XwJlSNGuVyk8eQHviOLugb2ZkAsodckecAZMISsWEwFyZ1pQxJC8IXUzdACuGeBaQCWc9YUlHGR1DsAw-nPElQcU5yEqWselX4HbVFY3hB1kDotpjgA0KgpF21qEgzDWQMIdw842O4B8MQ6VGvZM6dR1R_CqjPo08pyaXxVtDE&sig=Cg0ArKJSzDghgiSNmrWHEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221025.05341&arae=0&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 14F8 41 KB
15 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 12:01:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42715
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 12:01:32 GMT

GET
H2 200 16114614013835711833
s0.2mdn.net/simgad/ Frame 14F8 166 KB
167 KB 194ms
60ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/16114614013835711833

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a09c3f27b293ba21c778817f5de3e54fd625ceba7e06ce3fe252f2d4e6bf8ab9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 17:00:20 GMT
x-content-type-options: nosniff
age: 456787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170251
x-xss-protection: 0
last-modified: Thu, 29 Sep 2022 04:16:12 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 21 Oct 2023 17:00:20 GMT

GET
H/1.1

200
OK

firstevent
cbsi.demdex.net/ Frame 14F8
Redirect Chain

https://cbsi.demdex.net/event?d_sid=20571141
https://cbsi.demdex.net/firstevent?d_sid=20571141

42 B
944 B

56ms
49ms

Image
image/gif

54.229.2.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cbsi.demdex.net/firstevent?d_sid=20571141

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

54.229.2.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-229-2-193.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v044-00e203cc2.edge-irl1.demdex.com 8 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Jpv9BJ6wQJI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v044-0ebe57a1e.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 7b/UIDFoTjg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://cbsi.demdex.net/firstevent?d_sid=20571141
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 94CF
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEM4Yb4CidyKm8GyeDZuPk2c&google_cver=1&google_push=AZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U&r...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEM4Yb4CidyKm8GyeDZuPk2c&google_cver=1&google_push=AZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U...

43 B
412 B

193ms
183ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEM4Yb4CidyKm8GyeDZuPk2c&google_cver=1&google_push=AZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 76071c89cb3d0bc0-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 782
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEM4Yb4CidyKm8GyeDZuPk2c&google_cver=1&google_push=AZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAZmPxg8ZCbu-ocyICtn2F74G9rbYXvIpUqQC91v1tgJxSOzCPQOUxiBu7LYDI8ad4h4IPHeoOC5GejbILQAOVWzIDdW_ixg9j-U%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 76071c8889ad0bc0-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94CF
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEOCEheeXthmLz7OcwedWn78&google_cver=1&google_push=AZmPxg-Vh4zot88pCN6vhmmzGa12KvINE-zmytRGn5WGlzCujcsbc_rGqQZoEPEmYAZudb_KCyGorN08uj0ga_p5uS7Wml-dK58
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B0094347CD66430CACCAEE55B36AA9E8&google_push=AZmPxg-Vh4zot88pCN6vhmmzGa12KvINE-zmytRGn5WGlzCujcsbc_rGqQZoEPEmYAZudb_KCyGorN08uj0ga_p...

170 B
188 B

58ms
45ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B0094347CD66430CACCAEE55B36AA9E8&google_push=AZmPxg-Vh4zot88pCN6vhmmzGa12KvINE-zmytRGn5WGlzCujcsbc_rGqQZoEPEmYAZudb_KCyGorN08uj0ga_p5uS7Wml-dK58

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 26 Oct 2022 23:53:27 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B0094347CD66430CACCAEE55B36AA9E8&google_push=AZmPxg-Vh4zot88pCN6vhmmzGa12KvINE-zmytRGn5WGlzCujcsbc_rGqQZoEPEmYAZudb_KCyGorN08uj0ga_p5uS7Wml-dK58
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 25 Oct 2022 23:53:27 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94CF
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHs7gMJAKhnwX8cH6LYRSKc&google_cver=1&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-zAMqH...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEHs7gMJAKhnwX8cH6LYRSKc&google_cver=1&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDYwNTI4NDY4OTU5NDgxNjQxNg&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-zAM...

170 B
188 B

42ms
42ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDYwNTI4NDY4OTU5NDgxNjQxNg&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-zAMqHylC-XDdvHKrOLYsXoUw

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDYwNTI4NDY4OTU5NDgxNjQxNg&google_push=AZmPxg9Jxg6CtNjvQKTPG6CaeXKvTuCmNwbF8y0UA6m1vI5cPbn3oKCZYN-9KdryWrS-CASMrm-zAMqHylC-XDdvHKrOLYsXoUw
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94CF
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_push=AZ...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_hm=Y1nIdxaoPA5amw2iG35YfQAAFA8AAAIB&google_nid=index&google_push=AZmPxg_DjFZlu2S7wTcjVSK1DgqonRgSKxI7n...

170 B
188 B

42ms
42ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_hm=Y1nIdxaoPA5amw2iG35YfQAAFA8AAAIB&google_nid=index&google_push=AZmPxg_DjFZlu2S7wTcjVSK1DgqonRgSKxI7nflxcUDOZg2SYbrn91wYyTbzycwkR2KZNZaQ1lk-QC0s34Q6fVr2yk6PoLD0Zw

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIIQY6JWiTVGy65rZjUDe5U&google_hm=Y1nIdxaoPA5amw2iG35YfQAAFA8AAAIB&google_nid=index&google_push=AZmPxg_DjFZlu2S7wTcjVSK1DgqonRgSKxI7nflxcUDOZg2SYbrn91wYyTbzycwkR2KZNZaQ1lk-QC0s34Q6fVr2yk6PoLD0Zw
cache-control: no-cache
cf-ray: 76071c890ee5b954-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame 94CF 0
500 B 443ms
108ms Image
text/plain 69.166.1.12
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAZmPxg-FAmf691hfkEa2jdlBC0utVSEGVZOY4NoENJ_wldUC-_3Dm9FN05q75T1bk1R4Aru8jjOXRP5pwnyVhmntwofTBgHe2w%26google_hm%3D%5BUID%5D&google_gid=CAESEFwTvPc7LmY4qvp0QOFvWaE&google_cver=1

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.12 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-170
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94CF
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEIqLliUFiqXTbYwyWjerMXE&google_cver=1&google_push=AZmPxg-XrZK7p2jNmU0rhRPbuyZtD9NefaL3QH6tZ27RtAJlfZFJjlXJtWg8YYFvavAP5wx2jrn88pODCmNS...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AZmPxg-XrZK7p2jNmU0rhRPbuyZtD9NefaL3QH6tZ27RtAJlfZFJjlXJtWg8YYFvavAP5wx2jrn88pODCmNSrYHDmTIBE2-AVI0

170 B
188 B

56ms
48ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AZmPxg-XrZK7p2jNmU0rhRPbuyZtD9NefaL3QH6tZ27RtAJlfZFJjlXJtWg8YYFvavAP5wx2jrn88pODCmNSrYHDmTIBE2-AVI0

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AZmPxg-XrZK7p2jNmU0rhRPbuyZtD9NefaL3QH6tZ27RtAJlfZFJjlXJtWg8YYFvavAP5wx2jrn88pODCmNSrYHDmTIBE2-AVI0
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

/
onetag-sys.com/match/ Frame 94CF
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEIqLliUFiqXTbYwyWjerMXE&google_cver=1&google_push=AZmPxg_9Nguzsa9Zc9KIW5BZ6wU53hm7_Xpvci6Z6KkwAx-gadR1EUASO_yyUSHFXIp_Jig4W0JH7jtPnXC...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AZmPxg_9Nguzsa9Zc9KIW5BZ6wU53hm7_Xpvci6Z6KkwAx-gadR1EUASO_yyUSHFXIp_Jig4W0JH7jtPnXCJqcJ2zUidValf1u5A
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

42ms
32ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 94CF 0
223 B 41ms
38ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KhtKwQWBxArXEfTK_oOjwXxB5WMedf4bXcqTSkNe5UUsaT5XH9-KWrop7TgGF8hJnMdofCXw

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5559 1 KB
643 B 60ms
59ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 42714
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 12:01:33 GMT
etag: 48472445140208031
expires: Thu, 27 Oct 2022 12:01:33 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 14F8 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60e9796f6dd85dadb59f4025ebef2f9dabe2f98e63884a5c28ff0742f99de20c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9469 22 KB
8 KB 59ms
58ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 42714
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 12:01:33 GMT
expires: Thu, 26 Oct 2023 12:01:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 5559
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESELDB3y7ZTi5PdUc3zumzONs&google_cver=1&google_push=AZmPxg_jRv2gN8oh7CFTbq5CK3XFT3rEVCcVO1lOByuEqluPggsbvHoZ2DDtOwpmFJ0mchsNt8ujcagNIDwny_Eu1rWa-bDmRVw
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzAyMDg4NjQ0MjkzMTEwMzgwMA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELDB3y7ZTi5PdUc3zumzONs&google_cver=1

43 B
398 B

70ms
24ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELDB3y7ZTi5PdUc3zumzONs&google_cver=1
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 26 Oct 2022 23:53:26 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELDB3y7ZTi5PdUc3zumzONs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 5559 43 B
351 B 126ms
29ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEDutyDwhUVonQXKF2G2nSQo&google_cver=1&google_push=AZmPxg9xcW_P2G8piGOcfTDReddJrKZbZpjoFH_f6vu5zudH1sdC1LvwbngbR3uwPii81iJc9dkD_GWcUyMGhTFKMQIAUxfz-Hy3
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:26 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 35r9p71bl13d6mgpvfj06hg5vnnlv9d2

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5559
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=P54U4UwPRq2CKzgQKG5fdA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

42ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=P54U4UwPRq2CKzgQKG5fdA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg-lI6TFD_rv6QcCgv8nEQy7PWdCll8F1smz1ILYkJElUtxPjSFOWCCGTWC3VnhX6PoV6lvw4Zq55jmQZeREbI0KMxjuhVzO

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=P54U4UwPRq2CKzgQKG5fdA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg-lI6TFD_rv6QcCgv8nEQy7PWdCll8F1smz1ILYkJElUtxPjSFOWCCGTWC3VnhX6PoV6lvw4Zq55jmQZeREbI0KMxjuhVzO
date: Wed, 26 Oct 2022 23:53:26 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5559
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBjOJryhS2Vx4IqvW9ythnE&google_cver=1&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhky...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBjOJryhS2Vx4IqvW9ythnE&google_cver=1&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhky...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhkyuMJiafmIvc&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

170 B
188 B

41ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhkyuMJiafmIvc&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 26 Oct 2022 23:53:27 GMT
pod: X-Sovrn-Pod: ad_ap6ams1
access-control-allow-methods: GET, POST, DELETE, PUT
location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-SsproI5D5mIwm4Abr2tRbiDu-I8QpT3i18pB7siBgQyUoxKZkoYk7vD3NzgzjDEl5TeRxK1MKGm93UQhkyuMJiafmIvc&google_hm=FjE5uGZHnEOPK_WTQRmzmdln
access-control-allow-origin: *
access-control-allow-credentials: true
connection: close
access-control-allow-headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5559
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEFlBkeeCWxoiDCfae4KZdrQ&google_cver=1&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2fkYR2vB3...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEFlBkeeCWxoiDCfae4KZdrQ&google_cver=1&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2fk...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2f...

170 B
188 B

42ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2fkYR2vB3tlcqaq

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg-NEPRBCl7LzkHLRNLql4kHZ5mu5R0VcD8ib9Ch7uPIcWR7hNMiwcEgF2uviqBD4JkApBrxVLtlox0Qz2fkYR2vB3tlcqaq
access-control-allow-origin: *
date: Wed, 26 Oct 2022 23:53:27 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5559
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAsyL-gbILEW07k5u84fqAo&google_cver=1&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajGgBrLgAgPLn5JsU-UJ...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAsyL-gbILEW07k5u84fqAo&google_cver=1&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajGgBrLgAgPLn5JsU-UJ...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajG...

170 B
188 B

42ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajGgBrLgAgPLn5JsU-UJe9N04FJNySMFqHJOWLA3xdHLLOeA

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg8swATe1EX5xca90_HBNijbmpI9i6C-tfmBjpAFYcatZh7nhTajGgBrLgAgPLn5JsU-UJe9N04FJNySMFqHJOWLA3xdHLLOeA
date: Wed, 26 Oct 2022 23:53:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

report
sync.teads.tv/um/ Frame 5559
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEG5N1mRVHT7LdIf0ZZjLKpg&google_cver=1&google_p...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AZmPxg_gUFixVyuh9j37fKHgl8Ic3Lj6Dkd6Aefrhi9LCCHypiuaVRckuIY0b3NNXc8cQNJ6oJaRmoBCUXgfN7ZhpVU3A3i9ufRWwg
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
172 B

55ms
55ms

Image
image/gif

23.11.239.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 23.11.239.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-11-239-181.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Wed, 26 Oct 2022 23:53:27 GMT
pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5559 0
12 B 79ms
41ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LoHqrxf9pjKtokYVtazMRbgsukQ2akCpfHSfoUC9R1QiXEg4BENCuEOyWOC8qpQx_s7tkEVJE

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 1928 41 KB
15 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 09:38:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 224102
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 Oct 2023 09:38:25 GMT

HEAD
H/1.1

200
OK

file.mp4
r3---sn-5hnekn7z.c.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 1928
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r3---sn-5hnekn7z.c.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

129ms
24ms

Fetch
video/mp4

2a00:1450:400e:4d::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-5hnekn7z.c.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/61549FEF6CCC71126218645FB0E9A33628E11F36.3C739323E8BA61D013B2FC80478EADBAE27410CF/key/cms1/cms_redirect/yes/mh/Fh/mip/2a00:1630:2:1c03::15/mm/42/mn/sn-5hnekn7z/ms/onc/mt/1666828146/mv/u/mvi/3/pl/32/file/file.mp4

Protocol

HTTP/1.1

Server

2a00:1450:400e:4d::8 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Wed, 26 Oct 2022 23:53:27 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1580613
Last-Modified: Wed, 28 Sep 2022 11:35:52 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Wed, 26 Oct 2022 23:53:27 GMT

Redirect headers

date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 650
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
location: https://r3---sn-5hnekn7z.c.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/61549FEF6CCC71126218645FB0E9A33628E11F36.3C739323E8BA61D013B2FC80478EADBAE27410CF/key/cms1/cms_redirect/yes/mh/Fh/mip/2a00:1630:2:1c03::15/mm/42/mn/sn-5hnekn7z/ms/onc/mt/1666828146/mv/u/mvi/3/pl/32/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js Show response
pagead2.googlesyndication.com/bg/ Frame 9469 36 KB
16 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d9aee9c7463bd35f930878be886e5ee224aa8c9800331d699b91a28ceccdf1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
last-modified: Thu, 20 Oct 2022 10:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 26 Oct 2023 17:17:30 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 6481 23 KB
9 KB 59ms
59ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 224101
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Oct 2022 09:38:26 GMT
expires: Tue, 24 Oct 2023 09:38:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js Show response
pagead2.googlesyndication.com/bg/ Frame 6481 36 KB
16 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d9aee9c7463bd35f930878be886e5ee224aa8c9800331d699b91a28ceccdf1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
last-modified: Thu, 20 Oct 2022 10:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 26 Oct 2023 17:17:30 GMT

GET
H3 200 container.html Show response
c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8CD4 6 KB
3 KB 31ms
31ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:25 GMT
expires: Thu, 26 Oct 2023 23:53:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 14F8 0
26 B 130ms
68ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9469 0
20 B 95ms
95ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BzqzddshZY7KFNpmI9u8P6a2w-A8AAAAAOAHgBAI&bg=!srGlsfXNAAZPh4lnb4c7ACkAdvg8WsIKX5j48rB1hL6O2ipD34w_UPSygoh_cevEhQ0dCw5L4BipiQIAAAB2UgAAAAJoAQcKAGGmouH3x4SfZBBN5CPShCSHd8tYvVozLVA09sHBIXnWcW5UwezJDpcJEJiHcarUqh5eoEbu8KTKd0cEs3WwkPTMzQwSkHpJYDNA23woSq28QEgLvgb77UgAESfyJB9ueRf4mQL-n_rsFOIGrYTQoTcy2bkoN0atrBWhhpc4G4WqqxEeRdb6hTWaoO81CyqULeDNdtp0tlYps7RDS3aPVUVWpqNxGcRPuySWjmKss8050oaGAMuxO-ZEbmiZwA7GX2wc-0Atyl2BRvp1n4_xIfcC-QUdyheCsc5IBAYyi-ZuHuxpp9tgvYQbeDzXXp5vKhjlqP-ZF2Ga9I9p1RvKNt6D5rTMzZBxZcW4ICqUe85nQcZxzPldXkCX8Fl6fF2Ov4ZzwVFoGyPqAzD1xevVrUijzN_9WBrJ1Bsfl-GyXLhHkrxBSua8Z22x1EfTAyg_i3t_PqmmI2ndb33Eva88zGtzYXnuae0lymXpfYaMMTtmxRDgf8_vRDnIGunJLM2vf_chovXjMG82e3yi1nSr4IWqXsFBygEjOjAWIHophy49q-GyM2235gBaHprGL_sJ1S2aafz738I-frN_ygItO-ZC8bPyjY-UX-_IpvLXSF2OpQVZoi8u4UNfvg8djuDaxFv7eDyQRwPhL7xiEQ7H53xrd0q7SSbsyPLq-fPjqkPAWRe2pehetEV6UDS_C02siDwtVLizvvLhLDe8NKbw1elFLwf2MQsGrTGytnUjNfqwdusBEw0qW_hVQedZt5Rcqys-cx73rC4zLg976xsjTC7PgGdGou0nHvIX8fomP_QcM_nmP1_fuyaq5LvcYO19xksLCt-aVKJbaMh_2dQvHMkipt70c8yZFeWiN_l08zfHUk3WyMAy0FUpvt4HVC3SrnjxXTlCD_MHxu8A3e7ih4eaPRJHCmQ6bgKqn2_7Kz49VeNupknLZlNsAdK8ENXBabd8y6wBTRcXpISm_yCyDP_ARRvIrnn2zaZ_Q1wC_JPBVXygyPhI9kDtyn1jYM7nL92ZJxYCBEUWNALMgWIpcTJzN8SCGI52woamai4c6Tlpl1aQEIjIBTgZAieAciYqdjeB8jxplPLSbKXJs_if191vRSHAL0PnQ9SmjZZzU7H2MVND9lR8r6hBDHw6lcoeWeXHtQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2751 624 B
297 B 74ms
74ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP651wIQprvuAhjRiYjTATAB&v=APEucNXnvt2_zc99go4pCc3-C-kLiwi0OuBViEGAVg-VgkWf7iRgH4nIyJ499Vc5fLbR9MOUfmuagX_7AHp7fESawM-GFIOsPtjO9vrDsENT8Q6F7wnwpT0lL73WjMvyJrpKQDcSAmPvZWw--upssUUhYwXaXJhN9dMmbxnrd2gYlFIlD0WU3H_Sfnhnd8y61Eb4nuNeuDh-

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8CD4 75 KB
34 KB 96ms
94ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AE3O7XHgyBUQZlRdNKRNrwWwXpgAuj9Q-bgxusQR46aw8EVxx0V3-0QWUHQ0iY-oiE26uvaLauGHSmut_tHG_iUuzGag&cry=1&dbm_d=AKAmf-DcYlrBU7CRdkyVp_v2awBBH-ctescTmvVfvy864VOLovCblauhrqivMACWm-k0LtrM0-1hziZBkQkRa4eq98W5T7foiC6xgR1lv7KhGebC0e-9suPcomg2j5P3WG9kM_IYPX1gJ9inYg5_8lJwoznKIVeoLfItWI73Pvp_RCGgKCGiEmB0fcmbGOb0jH36r97oe3h9Abp1v9Tp5AKygzxwMXy2vtqhfL5q69Zi9SJP2JM_6B5D4a1qIfYvKJ8d_-iLgIptv5CFcmNMRnwTEYm2GW-SCbaaTnOgOE3ErKqCdrsP017of7zJePKYeWcWLzCK1sx6xFfavc0LIgT6UDkklsnTqP-zQ5hbAGNB2UJzfN7Cxc3YlLbGBadQ1_52ruEFCPMJ3SvVYRz8z1HaeZLvHMg-hZKnxRkxFxKoNMQV9DTSnTj6yAsSPesnvpg200DqYoxfSYRBG0P0ulTmijqF_Kaoxy5wB3S__jHyLiEoT1OST5ROR8UirzKzjw7Dlvkbe6MYWYETcxI4PQS5Jlsu2AoQtpsoUJZEzo6lQRzaNmSq9i5PS8rZu5wkv5Dh_TQA2vzkKjjUPRj2IF6bEFMqHq1nQ4eSD8iGKMyt-EgmLBSLo0ZWulbBXhTdXyNvzuG0I38Q2vJmKmZq0mBg0oIMwAvcc7-ZxnWWFIyAiD-4iVxI4ovFch3YRAeFabHx0Yg0fTXD3TGC4v4lSBDI0kKunQkhhJXmKuU2Dm8_f42I92VLV-ytc_UBqaOD5pX5C1nswbrp5nkpkW_lC3kDx8Vc17WcDsTwBjkszan1L8Pa-0wAhD77CKZClaNGgwXVmo3Pii-9jEuVbL4oakGDmhUu4ByCCE_JG7nQxNhmM5yXYr2AHDTsFhfl4VCC4rGg03Egdif5ewuy66HkyOCuFQTLd_9FseZivnlowYOD-fsKgcTqw6cdGadjbAN0rMrVaKj--fQQaNcJ9CqdPK-G8Nv3gjl8hxvVeClR9J0WJe_OreLPdeUCwNWm-bDJalJW9-FB1i-PE1BgnX1NRpA0rb6Nawhq-4Y6Kh6egJRXjY9VqHJvcxahxBOejnQi7IUjH1pNJKMAaBXer1GPnWFSaJ02eCgmJf9LNp26KB7Z-YfDP-CHd1z8EKsPHZ8WUm06HmwSaRvkecP_lX37yCQgd-qGaNBA5RFg8-UbAEj7bgiKXsZFwFyFJkmmNWC2GqVND5x3oQ_Fda4NtKFqQoNDuLicYi3xHymKgdcCEPYmjqHXcRmqmVyMs2tMdhN-jOszE75pRaqbGpQ_wC2R3RbVBbC2YJPBmk5OpDOdshfrsi37FLm5gHwXfHqgkbIKyOPXkiltcu4XiWLb1wcwsFXpCWRHNSFDI2gU17IC-fn7FG7gD0bjoN1xBN0gbexzfb9Qjz4b6y6RymTsmRF6hd8ruLxF_BUpXksTDDnbnpEKzO3QLBgkX6DX5uPeD17l4rIaVG7ZVLKXw8xr74ce58SgGbDRQk4duvXJZNgYaEEneIb4Yb5mu5Ab-pxzmco01wmEbYKDT8NerW7Y77H87d0AB0VtkpJZxCXAvPRr--dkaJpy8xBkP_WK2m94UN63puDX9uHuvgqMpF8MRcOzE8kiF3EUqlEP9a5nD5dpe0IL9c-Pn8ma3aN72w3wKyJBHU_cB8ARJ7N85hHhjI17kIeOU2zHMKDHf6a6jJwBXFBD6Wglz6dVapjzqDj6DL2a88JFPH6K8kSaV9eR65GHPk6oevT9p5DDxOS9GSSpWC0S2M36gzTapRlKR6J5iIbB5BrC6CEpOO3JLo9ZI1-TLdzcgaKemzXolnpRx2WpNqyux7ePzglVsKmbARNevBg_PlOzZB77gNjxjr2S_LlBltem7X2Vgt9q6AWyfHfulYKScjjDjzNkS212JGO6-m5n4LUwsRGrLlCrPlW3nku4M7YwK_c2DP7QcL78or1y9nsKu_OeeXSnT9KIgY1scZklZVnyqXNIN9UCFDoN6qNeIFT6q_xVdU1RZixJXqhh7UMLVLtwO8dk5nYBYjpOxcYL8DBw7aPSRkzkMfmCU4nUuYtK0FAUW8m8QxnC0vk4tvRuquQ80hFgR0KmZ9oKlc8DaFoHPMN9VJqiCxeu15nkCOU77pMXZ4ruN1HmfDZ2jeOSbHtBCl5jiHdXnAqkNJ1GkxMhBiE4vpK_7i4yLej6L3kUEEeb527WIQL1uvQ9aA-FMlHRj16IIHDwDRBLSWAwo7l2He_zYz0MGDpJlR2vuqRj7yjOSpVhe6X0h7Pa4YrcXKdzxhPl7GtP5UKn9-cYRof8pGSkK7VyLtaMOEa9Z3UC4zyXVwDsSAJdV9HRNpdrAJOMG0uogdyvgtkRywOK2EeYH8scdUbCYGnRZixcwxuQDiLGD8oB-vYQ1zZn5GO5mjQ563JgNITtq4UHQFjbsSVwLUNDc3DX8jo3_5zm3jRzPIdEWPgbTGBObriZV1uS_-hTybfGxH_gG3t_5iVOW8HbeprGD2k9koaVuMB8BOxRgEosZgi9oa61V1PdZCYJn3ofxYEaRN2AaDG7Z9M5Z51bpVJTuuqIpsiO8O1bV0bwfnWMSa3jr4vqEIrebQCqUiZUGx2-qEQ5ZiO_lljGoBBLOiPhU5qqopew6s6uJm6yR91Iuj_RsDsOg9unfP3qESVOi2__3SapaqD3nTX_Oinzo26g_yUauLysDD_9pTX8HNBT5zZL0VVYup5Y9cRxnjBxtS4y7hmCLpEkJiYxrDpp70QTeVBCw_JyKfSJtbEdFlHNZyiKTeKR4RWJdbGYqh3apPUrQDwHczybJNB8cFuCOe1em_trNz3pws648_23TsOoDsDmkH2FKe3SXitdjrLPbEV_YeWL9rKALbZsKkX2a-6a2Q_qHkv34kXUpbLQGDLDIAnqwOet2wjj5BfuT24ki2xkYY9LLMw3bk_s6mTkW0Munc04bkTb00vn5bcTDF9BIvARLPRzFD1P4m6tA7BrzA92jn_1_fMtwZ9vlnxvC_kN6R6B9NeduasCL1sI-PvS6TJKmZhfnIBH5Uo0QfNtkz30UNytKlVVRow43NnJ64IHhlRdRmf1UWCBWkereNogfkw3GDPPYbDIydb1gg9XksY9EN4wPvKWDZN6J7ARQHFcx-IoeCJ1ZvhGi5s1T4HE5VUMaU_JP_E_nm-Mn2WcgIRyqrVYLTuQuLKgsBo97FWlfm4gPScyT1RuHJFSn5qWCXJ6kKEk9ezwMU0wqOwVcjRAgmfUfQJf5X1HcRlueQ408HnNko0P-HpPSGzshkEYeYgCFL9u_EQorR4TZfvOVNAQnKI&cid=CAASJORooOPpiaFrGaded8NVmsyXOo7LuAhG-RH_1qrkFgZqc5uUWQ&rfl=1%2Chttps%253A%252F%252Fwww.socinvestigation.com%252F%240

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a1782b55bd2cfba5280382ae4f11bdd0b6784ba012982be940295c9b34ad57f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CD4 42 B
63 B 93ms
91ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DHvUUuQWMVRqK5IP6tCdSgNv2FlXoMpn6LTFBRQpJ_9CTuv_hw-r0AicTLSMVnAmCkjT0zQaJ4XXuQwWaD7PMEW8VcoDasK2wReEXVeBvPUYr8h0I

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 8CD4 3 KB
1 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/window_focus_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:18:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9289
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 21:18:38 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 8CD4 17 KB
7 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d99f77a187454fecc18b59b2f520b1598b246d01e142bfdc4de56eb7221a9330

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:49:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32638
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7367
x-xss-protection: 0
server: cafe
etag: 4759548068123418343
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:49:29 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8CD4 0
0 66ms
65ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSnCz0ydz5pL_IX9G9-csSLPQy4CGCVQB1ccSxKGT80u6L5md-H_gag7PgY2Viywk-8NPZs_A4HzSiLqZZPU3UMhUqE5g
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8CD4 152 KB
46 KB 74ms
73ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47514
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1666784471914692"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:27 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2751
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1

43 B
766 B

31ms
31ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP651wIQprvuAhjRiYjTATAB&v=APEucNXnvt2_zc99go4pCc3-C-kLiwi0OuBViEGAVg-VgkWf7iRgH4nIyJ499Vc5fLbR9MOUfmuagX_7AHp7fESawM-GFIOsPtjO9vrDsENT8Q6F7wnwpT0lL73WjMvyJrpKQDcSAmPvZWw--upssUUhYwXaXJhN9dMmbxnrd2gYlFIlD0WU3H_Sfnhnd8y61Eb4nuNeuDh-
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2751
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y1nId2VlQafzC7SYC6QH.QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1&google_hm=2

43 B
766 B

31ms
31ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP651wIQprvuAhjRiYjTATAB&v=APEucNXnvt2_zc99go4pCc3-C-kLiwi0OuBViEGAVg-VgkWf7iRgH4nIyJ499Vc5fLbR9MOUfmuagX_7AHp7fESawM-GFIOsPtjO9vrDsENT8Q6F7wnwpT0lL73WjMvyJrpKQDcSAmPvZWw--upssUUhYwXaXJhN9dMmbxnrd2gYlFIlD0WU3H_Sfnhnd8y61Eb4nuNeuDh-
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPWf1xpCc2e1EN2-m19EPVw&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2751
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEA4OrYptjKmx4VXoGLiqnpU&google_cver=1

43 B
1018 B

26ms
26ms

Image
image/gif

185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEA4OrYptjKmx4VXoGLiqnpU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP651wIQprvuAhjRiYjTATAB&v=APEucNXnvt2_zc99go4pCc3-C-kLiwi0OuBViEGAVg-VgkWf7iRgH4nIyJ499Vc5fLbR9MOUfmuagX_7AHp7fESawM-GFIOsPtjO9vrDsENT8Q6F7wnwpT0lL73WjMvyJrpKQDcSAmPvZWw--upssUUhYwXaXJhN9dMmbxnrd2gYlFIlD0WU3H_Sfnhnd8y61Eb4nuNeuDh-

Protocol

HTTP/1.1

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
AN-X-Request-Uuid: b40d472d-3c9d-4260-8fef-f4a712a89e27
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 31.204.150.144; 31.204.150.144; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEA4OrYptjKmx4VXoGLiqnpU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2751
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D

170 B
188 B

41ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
AN-X-Request-Uuid: 95bc6c7f-f7d4-45fb-9645-41469cd4f309
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU3NzgyNDgyODcxMjE4MjExNw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 31.204.150.144; 31.204.150.144; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame 8CD4 30 KB
11 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AE3O7XHgyBUQZlRdNKRNrwWwXpgAuj9Q-bgxusQR46aw8EVxx0V3-0QWUHQ0iY-oiE26uvaLauGHSmut_tHG_iUuzGag&cry=1&dbm_d=AKAmf-DcYlrBU7CRdkyVp_v2awBBH-ctescTmvVfvy864VOLovCblauhrqivMACWm-k0LtrM0-1hziZBkQkRa4eq98W5T7foiC6xgR1lv7KhGebC0e-9suPcomg2j5P3WG9kM_IYPX1gJ9inYg5_8lJwoznKIVeoLfItWI73Pvp_RCGgKCGiEmB0fcmbGOb0jH36r97oe3h9Abp1v9Tp5AKygzxwMXy2vtqhfL5q69Zi9SJP2JM_6B5D4a1qIfYvKJ8d_-iLgIptv5CFcmNMRnwTEYm2GW-SCbaaTnOgOE3ErKqCdrsP017of7zJePKYeWcWLzCK1sx6xFfavc0LIgT6UDkklsnTqP-zQ5hbAGNB2UJzfN7Cxc3YlLbGBadQ1_52ruEFCPMJ3SvVYRz8z1HaeZLvHMg-hZKnxRkxFxKoNMQV9DTSnTj6yAsSPesnvpg200DqYoxfSYRBG0P0ulTmijqF_Kaoxy5wB3S__jHyLiEoT1OST5ROR8UirzKzjw7Dlvkbe6MYWYETcxI4PQS5Jlsu2AoQtpsoUJZEzo6lQRzaNmSq9i5PS8rZu5wkv5Dh_TQA2vzkKjjUPRj2IF6bEFMqHq1nQ4eSD8iGKMyt-EgmLBSLo0ZWulbBXhTdXyNvzuG0I38Q2vJmKmZq0mBg0oIMwAvcc7-ZxnWWFIyAiD-4iVxI4ovFch3YRAeFabHx0Yg0fTXD3TGC4v4lSBDI0kKunQkhhJXmKuU2Dm8_f42I92VLV-ytc_UBqaOD5pX5C1nswbrp5nkpkW_lC3kDx8Vc17WcDsTwBjkszan1L8Pa-0wAhD77CKZClaNGgwXVmo3Pii-9jEuVbL4oakGDmhUu4ByCCE_JG7nQxNhmM5yXYr2AHDTsFhfl4VCC4rGg03Egdif5ewuy66HkyOCuFQTLd_9FseZivnlowYOD-fsKgcTqw6cdGadjbAN0rMrVaKj--fQQaNcJ9CqdPK-G8Nv3gjl8hxvVeClR9J0WJe_OreLPdeUCwNWm-bDJalJW9-FB1i-PE1BgnX1NRpA0rb6Nawhq-4Y6Kh6egJRXjY9VqHJvcxahxBOejnQi7IUjH1pNJKMAaBXer1GPnWFSaJ02eCgmJf9LNp26KB7Z-YfDP-CHd1z8EKsPHZ8WUm06HmwSaRvkecP_lX37yCQgd-qGaNBA5RFg8-UbAEj7bgiKXsZFwFyFJkmmNWC2GqVND5x3oQ_Fda4NtKFqQoNDuLicYi3xHymKgdcCEPYmjqHXcRmqmVyMs2tMdhN-jOszE75pRaqbGpQ_wC2R3RbVBbC2YJPBmk5OpDOdshfrsi37FLm5gHwXfHqgkbIKyOPXkiltcu4XiWLb1wcwsFXpCWRHNSFDI2gU17IC-fn7FG7gD0bjoN1xBN0gbexzfb9Qjz4b6y6RymTsmRF6hd8ruLxF_BUpXksTDDnbnpEKzO3QLBgkX6DX5uPeD17l4rIaVG7ZVLKXw8xr74ce58SgGbDRQk4duvXJZNgYaEEneIb4Yb5mu5Ab-pxzmco01wmEbYKDT8NerW7Y77H87d0AB0VtkpJZxCXAvPRr--dkaJpy8xBkP_WK2m94UN63puDX9uHuvgqMpF8MRcOzE8kiF3EUqlEP9a5nD5dpe0IL9c-Pn8ma3aN72w3wKyJBHU_cB8ARJ7N85hHhjI17kIeOU2zHMKDHf6a6jJwBXFBD6Wglz6dVapjzqDj6DL2a88JFPH6K8kSaV9eR65GHPk6oevT9p5DDxOS9GSSpWC0S2M36gzTapRlKR6J5iIbB5BrC6CEpOO3JLo9ZI1-TLdzcgaKemzXolnpRx2WpNqyux7ePzglVsKmbARNevBg_PlOzZB77gNjxjr2S_LlBltem7X2Vgt9q6AWyfHfulYKScjjDjzNkS212JGO6-m5n4LUwsRGrLlCrPlW3nku4M7YwK_c2DP7QcL78or1y9nsKu_OeeXSnT9KIgY1scZklZVnyqXNIN9UCFDoN6qNeIFT6q_xVdU1RZixJXqhh7UMLVLtwO8dk5nYBYjpOxcYL8DBw7aPSRkzkMfmCU4nUuYtK0FAUW8m8QxnC0vk4tvRuquQ80hFgR0KmZ9oKlc8DaFoHPMN9VJqiCxeu15nkCOU77pMXZ4ruN1HmfDZ2jeOSbHtBCl5jiHdXnAqkNJ1GkxMhBiE4vpK_7i4yLej6L3kUEEeb527WIQL1uvQ9aA-FMlHRj16IIHDwDRBLSWAwo7l2He_zYz0MGDpJlR2vuqRj7yjOSpVhe6X0h7Pa4YrcXKdzxhPl7GtP5UKn9-cYRof8pGSkK7VyLtaMOEa9Z3UC4zyXVwDsSAJdV9HRNpdrAJOMG0uogdyvgtkRywOK2EeYH8scdUbCYGnRZixcwxuQDiLGD8oB-vYQ1zZn5GO5mjQ563JgNITtq4UHQFjbsSVwLUNDc3DX8jo3_5zm3jRzPIdEWPgbTGBObriZV1uS_-hTybfGxH_gG3t_5iVOW8HbeprGD2k9koaVuMB8BOxRgEosZgi9oa61V1PdZCYJn3ofxYEaRN2AaDG7Z9M5Z51bpVJTuuqIpsiO8O1bV0bwfnWMSa3jr4vqEIrebQCqUiZUGx2-qEQ5ZiO_lljGoBBLOiPhU5qqopew6s6uJm6yR91Iuj_RsDsOg9unfP3qESVOi2__3SapaqD3nTX_Oinzo26g_yUauLysDD_9pTX8HNBT5zZL0VVYup5Y9cRxnjBxtS4y7hmCLpEkJiYxrDpp70QTeVBCw_JyKfSJtbEdFlHNZyiKTeKR4RWJdbGYqh3apPUrQDwHczybJNB8cFuCOe1em_trNz3pws648_23TsOoDsDmkH2FKe3SXitdjrLPbEV_YeWL9rKALbZsKkX2a-6a2Q_qHkv34kXUpbLQGDLDIAnqwOet2wjj5BfuT24ki2xkYY9LLMw3bk_s6mTkW0Munc04bkTb00vn5bcTDF9BIvARLPRzFD1P4m6tA7BrzA92jn_1_fMtwZ9vlnxvC_kN6R6B9NeduasCL1sI-PvS6TJKmZhfnIBH5Uo0QfNtkz30UNytKlVVRow43NnJ64IHhlRdRmf1UWCBWkereNogfkw3GDPPYbDIydb1gg9XksY9EN4wPvKWDZN6J7ARQHFcx-IoeCJ1ZvhGi5s1T4HE5VUMaU_JP_E_nm-Mn2WcgIRyqrVYLTuQuLKgsBo97FWlfm4gPScyT1RuHJFSn5qWCXJ6kKEk9ezwMU0wqOwVcjRAgmfUfQJf5X1HcRlueQ408HnNko0P-HpPSGzshkEYeYgCFL9u_EQorR4TZfvOVNAQnKI&cid=CAASJORooOPpiaFrGaded8NVmsyXOo7LuAhG-RH_1qrkFgZqc5uUWQ&rfl=1%2Chttps%253A%252F%252Fwww.socinvestigation.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac32377ae624ac720172de6cd59d7fad67c0c78fe658c7a7b2b43be14b9d74ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:47:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11484
x-xss-protection: 0
server: cafe
etag: 16485072225624805710
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:47:30 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/elements/html/ Frame 8CD4 8 KB
3 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221025/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:47:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2998
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:47:30 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CD4 0
27 B 79ms
79ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst2yEKo5vLJ7coPEjUt1CtAyxJO6VaHIGAE-O4aItjtQRTMQ_F94LRAsJGxyDU_p5Cakpt77iICAy_2nXkmdyrbDL0CywJT3tRAJIiRAPSUY-SAU_16rpvbE6WihZlr0k0Vf37QWLAVUHH_yCUcab9JAIBUjW8SELPhgClB-ZsoNCtPCCq_1G9-y1XH3b3AOiPpurlx9xOdwXwhJJrdFWs8JVJMmutMSZemz6ySzcDiUygjZX7N9p3kNp9QRAcVuKxrbEtwCcsgPlFUx668P7-2mQxyd6vb1QUiG1Z-ropLtzK1GWybEd1aW_cbS-2XtEeSmWwq5DTvG6PRtu6JppcnMZAFN73uXfYnK8UAyCjis76SsgqHkmUCoZMk6vUwhBKyCPDax3tFtpk6r5joJGg8uuXyTwxbxO5G9RXIVBwCaFEDil0-SNGaP9-oG3trCM4v-cOtMF4xNpCa07pRpZzinv6Ek2yqiAGRFluPIu6NzdigdsZ0ZooEVKpxMvEVZ37q6W36sMCU6mLtH8dXG3E2gTndLS95Y_k4ho8nF3Ks4zdDcbv0sutqsdTWkMFx0fQprouGLrCFuwxiIDxRkRG0wX5lFgRV-y05oMWvKH9jKptdOnNzaKbu-YZpCI58xvBUKKrY1vNPagJoySpaAkXw-JRDthuneQeHbPC4clvKHZLN4vJYkFxkH86Sh9rk2OzxUpMQk8W-Yfa76zDHqD6Ic9-sQyWbbca6lhSgZJX3G8RLt0w4lB2lCcO2FQCPKs3-L5N9O1D7mJz0QMKe2f-7_vFbfhd5W5TiH8FJKKjZuAN4IRbDjKy7to9Cc1FducFndTXQ1TnuuMWfi36zg6ChSg0hy4QeHRP-53R2_fvDc0p2YO-O7aQ6fyNCdHa8cbHgg5aBsgzByF7FOuHAFVocRNj6kEJgWfMfeqKZItWSaaaT7HpwJQghM5SJ5tmIKaUBY695xNlwFS4HotiLUyFw0saEmcxpsRv0oHc-n10wjTxBDqcYDEKfLjr4c4brz2NUkqPn9ohZL2h9jdsQcXm3wEfQIOJXG6Xvi8v1T6uShQvZi14B_wcASOMuCxUEvoDamGsKJi7333-4BttYBZuIKRKkVJRga9Yv8ytSkxqYdY2whTZ0je-emUcIj843BTjxhtCuXK3RwJppG_IHjHAP_ae9phnD7gyj9puF9Kvukxpbtx2VhwCLQwptOMiMzwdu-eTs0q8klaZKWAFQqHXbaFmllxwymou1UejvqBDKDvhrpv44YeeLVW_xLzhUSbRT7jGmJq9WfQhP9vQiBdiKofs3UBzqaffI110fYEG8NA745A0a7-ol&sai=AMfl-YRgmn2v4dMbSdDeVdVrLfbqYrWMOIxn3VpLH1f_xaljxfLCk96GeAR_d9saCYvApSHG63MFwyhRPBqeETMleClLJe3M2peAKE82DAPzwwn2lSzrYo55Qc3TtpU8c777J9On_yUUUD3mbLVs1WWILTUBkAt9z23I3Azh0DzJRUB_mQubYQZ44jhy4q3bwbSwIoFhJqROKgYiPbRIi6BT394mX60152XOdYluJqR3UFYRb1q0yvW1&sig=Cg0ArKJSzDMu0JEs5TyQEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20221025.88078&arae=0&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 moatad.js Show response
z.moatads.com/wpromotepeacockdcmdisplay515722200356/ Frame 8CD4 303 KB
104 KB 120ms
30ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/wpromotepeacockdcmdisplay515722200356/moatad.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AE3O7XHgyBUQZlRdNKRNrwWwXpgAuj9Q-bgxusQR46aw8EVxx0V3-0QWUHQ0iY-oiE26uvaLauGHSmut_tHG_iUuzGag&cry=1&dbm_d=AKAmf-DcYlrBU7CRdkyVp_v2awBBH-ctescTmvVfvy864VOLovCblauhrqivMACWm-k0LtrM0-1hziZBkQkRa4eq98W5T7foiC6xgR1lv7KhGebC0e-9suPcomg2j5P3WG9kM_IYPX1gJ9inYg5_8lJwoznKIVeoLfItWI73Pvp_RCGgKCGiEmB0fcmbGOb0jH36r97oe3h9Abp1v9Tp5AKygzxwMXy2vtqhfL5q69Zi9SJP2JM_6B5D4a1qIfYvKJ8d_-iLgIptv5CFcmNMRnwTEYm2GW-SCbaaTnOgOE3ErKqCdrsP017of7zJePKYeWcWLzCK1sx6xFfavc0LIgT6UDkklsnTqP-zQ5hbAGNB2UJzfN7Cxc3YlLbGBadQ1_52ruEFCPMJ3SvVYRz8z1HaeZLvHMg-hZKnxRkxFxKoNMQV9DTSnTj6yAsSPesnvpg200DqYoxfSYRBG0P0ulTmijqF_Kaoxy5wB3S__jHyLiEoT1OST5ROR8UirzKzjw7Dlvkbe6MYWYETcxI4PQS5Jlsu2AoQtpsoUJZEzo6lQRzaNmSq9i5PS8rZu5wkv5Dh_TQA2vzkKjjUPRj2IF6bEFMqHq1nQ4eSD8iGKMyt-EgmLBSLo0ZWulbBXhTdXyNvzuG0I38Q2vJmKmZq0mBg0oIMwAvcc7-ZxnWWFIyAiD-4iVxI4ovFch3YRAeFabHx0Yg0fTXD3TGC4v4lSBDI0kKunQkhhJXmKuU2Dm8_f42I92VLV-ytc_UBqaOD5pX5C1nswbrp5nkpkW_lC3kDx8Vc17WcDsTwBjkszan1L8Pa-0wAhD77CKZClaNGgwXVmo3Pii-9jEuVbL4oakGDmhUu4ByCCE_JG7nQxNhmM5yXYr2AHDTsFhfl4VCC4rGg03Egdif5ewuy66HkyOCuFQTLd_9FseZivnlowYOD-fsKgcTqw6cdGadjbAN0rMrVaKj--fQQaNcJ9CqdPK-G8Nv3gjl8hxvVeClR9J0WJe_OreLPdeUCwNWm-bDJalJW9-FB1i-PE1BgnX1NRpA0rb6Nawhq-4Y6Kh6egJRXjY9VqHJvcxahxBOejnQi7IUjH1pNJKMAaBXer1GPnWFSaJ02eCgmJf9LNp26KB7Z-YfDP-CHd1z8EKsPHZ8WUm06HmwSaRvkecP_lX37yCQgd-qGaNBA5RFg8-UbAEj7bgiKXsZFwFyFJkmmNWC2GqVND5x3oQ_Fda4NtKFqQoNDuLicYi3xHymKgdcCEPYmjqHXcRmqmVyMs2tMdhN-jOszE75pRaqbGpQ_wC2R3RbVBbC2YJPBmk5OpDOdshfrsi37FLm5gHwXfHqgkbIKyOPXkiltcu4XiWLb1wcwsFXpCWRHNSFDI2gU17IC-fn7FG7gD0bjoN1xBN0gbexzfb9Qjz4b6y6RymTsmRF6hd8ruLxF_BUpXksTDDnbnpEKzO3QLBgkX6DX5uPeD17l4rIaVG7ZVLKXw8xr74ce58SgGbDRQk4duvXJZNgYaEEneIb4Yb5mu5Ab-pxzmco01wmEbYKDT8NerW7Y77H87d0AB0VtkpJZxCXAvPRr--dkaJpy8xBkP_WK2m94UN63puDX9uHuvgqMpF8MRcOzE8kiF3EUqlEP9a5nD5dpe0IL9c-Pn8ma3aN72w3wKyJBHU_cB8ARJ7N85hHhjI17kIeOU2zHMKDHf6a6jJwBXFBD6Wglz6dVapjzqDj6DL2a88JFPH6K8kSaV9eR65GHPk6oevT9p5DDxOS9GSSpWC0S2M36gzTapRlKR6J5iIbB5BrC6CEpOO3JLo9ZI1-TLdzcgaKemzXolnpRx2WpNqyux7ePzglVsKmbARNevBg_PlOzZB77gNjxjr2S_LlBltem7X2Vgt9q6AWyfHfulYKScjjDjzNkS212JGO6-m5n4LUwsRGrLlCrPlW3nku4M7YwK_c2DP7QcL78or1y9nsKu_OeeXSnT9KIgY1scZklZVnyqXNIN9UCFDoN6qNeIFT6q_xVdU1RZixJXqhh7UMLVLtwO8dk5nYBYjpOxcYL8DBw7aPSRkzkMfmCU4nUuYtK0FAUW8m8QxnC0vk4tvRuquQ80hFgR0KmZ9oKlc8DaFoHPMN9VJqiCxeu15nkCOU77pMXZ4ruN1HmfDZ2jeOSbHtBCl5jiHdXnAqkNJ1GkxMhBiE4vpK_7i4yLej6L3kUEEeb527WIQL1uvQ9aA-FMlHRj16IIHDwDRBLSWAwo7l2He_zYz0MGDpJlR2vuqRj7yjOSpVhe6X0h7Pa4YrcXKdzxhPl7GtP5UKn9-cYRof8pGSkK7VyLtaMOEa9Z3UC4zyXVwDsSAJdV9HRNpdrAJOMG0uogdyvgtkRywOK2EeYH8scdUbCYGnRZixcwxuQDiLGD8oB-vYQ1zZn5GO5mjQ563JgNITtq4UHQFjbsSVwLUNDc3DX8jo3_5zm3jRzPIdEWPgbTGBObriZV1uS_-hTybfGxH_gG3t_5iVOW8HbeprGD2k9koaVuMB8BOxRgEosZgi9oa61V1PdZCYJn3ofxYEaRN2AaDG7Z9M5Z51bpVJTuuqIpsiO8O1bV0bwfnWMSa3jr4vqEIrebQCqUiZUGx2-qEQ5ZiO_lljGoBBLOiPhU5qqopew6s6uJm6yR91Iuj_RsDsOg9unfP3qESVOi2__3SapaqD3nTX_Oinzo26g_yUauLysDD_9pTX8HNBT5zZL0VVYup5Y9cRxnjBxtS4y7hmCLpEkJiYxrDpp70QTeVBCw_JyKfSJtbEdFlHNZyiKTeKR4RWJdbGYqh3apPUrQDwHczybJNB8cFuCOe1em_trNz3pws648_23TsOoDsDmkH2FKe3SXitdjrLPbEV_YeWL9rKALbZsKkX2a-6a2Q_qHkv34kXUpbLQGDLDIAnqwOet2wjj5BfuT24ki2xkYY9LLMw3bk_s6mTkW0Munc04bkTb00vn5bcTDF9BIvARLPRzFD1P4m6tA7BrzA92jn_1_fMtwZ9vlnxvC_kN6R6B9NeduasCL1sI-PvS6TJKmZhfnIBH5Uo0QfNtkz30UNytKlVVRow43NnJ64IHhlRdRmf1UWCBWkereNogfkw3GDPPYbDIydb1gg9XksY9EN4wPvKWDZN6J7ARQHFcx-IoeCJ1ZvhGi5s1T4HE5VUMaU_JP_E_nm-Mn2WcgIRyqrVYLTuQuLKgsBo97FWlfm4gPScyT1RuHJFSn5qWCXJ6kKEk9ezwMU0wqOwVcjRAgmfUfQJf5X1HcRlueQ408HnNko0P-HpPSGzshkEYeYgCFL9u_EQorR4TZfvOVNAQnKI&cid=CAASJORooOPpiaFrGaded8NVmsyXOo7LuAhG-RH_1qrkFgZqc5uUWQ&rfl=1%2Chttps%253A%252F%252Fwww.socinvestigation.com%252F%240
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 3bb3d03e4e168e64c6a17b3c68c21734835e2a9eb813c511e9c4ceabf1c7bd22

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
content-encoding: gzip
last-modified: Tue, 11 Oct 2022 17:00:02 GMT
server: AmazonS3
x-amz-request-id: GRH4F52ME3YHRRAS
etag: "8e4eb5c07b277947d1ccfe91650570b9"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=20371
accept-ranges: bytes
content-length: 105732
x-amz-id-2: DNSnDbKheThnoButmbHaX6U9bUNYVjYOfi7EnD/bBByiwl7JYL0M+diNlqxFEX3OYUQ8dqPqLNQ=

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8CD4 41 KB
15 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 12:01:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42715
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 12:01:32 GMT

GET
H3 200 10938034927674496341
s0.2mdn.net/simgad/ Frame 8CD4 68 KB
68 KB 122ms
58ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10938034927674496341

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e38c932c32bb50ae5bee95b895a89fb417febaf1f35506744a2bf93fb48070e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 21:39:21 GMT
x-content-type-options: nosniff
age: 440046
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69212
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 16:30:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 21 Oct 2023 21:39:21 GMT

GET
H/1.1 200
OK /
d.agkn.com/pixel/10690/ Frame 8CD4 43 B
650 B 149ms
31ms Image
image/gif 3.126.163.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/10690/?che=2838164436&cmid=28492869&sid=6031710&pid=345923878&cgid=537543262&cid=177734702&aid=9902108&gdpr=&gdpr_consent=
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.163.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-163-185.eu-central-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Server: Apache-Coyote/1.1
Content-Type: image/gif
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6481 0
20 B 95ms
95ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B0-kdd8hZY-auBYWGb4KnocgKAAAAADgB4AQC&bg=!ysmlyY3NAAZPh4lnb4c7ACkAdvg8WmrWDTJ_lR6DMmvmPm0gthlB89H2cJTyXRsn1mHomaxMKdDIggIAAABVUgAAAARoAQeZAvc5tC-uz1TYJAvSQSJQ3VrfWvNJhcV5EoNLwqiVF5SLBVO5XDQT0BA2SBesNrX_3TuN5_xKaKOiAEO9iS1E98miRv_azCE2tLFEFSbOyJlkKYNuWuODn0hrJ2t34gKTuuYHeKfPCK1-mwZYlhaqIz959v1cuFMPFaS3RNT4oyiF6wubYIc7ROJQfB0Sy1U9WWJG2IQRAVeJw77BjPHfIUzWsCopwZPAeC4x24pF7Qhg5WRY6ipZZij5GhdKSZlf6eOvR1YuscLg2d-9VPWkHr617dG3g2OPXgP1Pa_1QIHUmpxAMJS9P00uOF9Pwwq7YdFsNu0rRg9sMEOFr4XCbX17X8lv-VttlbjphJmTzpzCqVUTF_5ru7uexqasjAtUYS3AIavuzm_MUknpnrB3e0KKcLuWkE0dAva1K_RzVzB5il_bzApwQd8KK97iRLzKa9uZ7-5Jycjdqm3oi7dLTqnWAENS66cGyf3SC3dmzsp0cYlimA_7RSNmmuPJE6D4Cfe8QCSZbWthdCf9TRnAoMu-nofVzZf8keZHWyOletOHWsSS2QbIM4Vq-ZTCACD7WWeStwYILTDkhL-rWyuPMEjisJYHuxCOvLG-VVr8rrA6Eef9jQEOY-ajSYBkDLDJ9G6oB7tYBzINKbxRRuZjzLUWd9IYM3oEbXiiCrTVTuoL84XdbkNfSe8px5s3YZK1tEQtP8syLchtNspkYQezVjjhS4yt5WpdqAW-_Vjms63nw1UwqyAfQ-t9RaGPulJ-_k9j_QkDwJ1j2gVUeFm_dxLmzTtnRJ_oIbnDbQXfKzKkn5ejmikHDf_xI-ixdmeDYZEqCVcR-EwxKCB4-8WZowNeQWBZh2mDMOFffLWDmBCxjIyxy8ma0T4aQVxrYfDWJqVH_57lHvipjeeb9bT5ev13ixEdUcEMnEkDO0ca5G3Y5JmKA-mU4mqdEx_DYSv-ssXLagPlwb09XkGjtG3tW5_131V5Evk3DdrDEZOYFZINIKhORPwHi3c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 206 file.mp4
r3---sn-5hnekn7z.c.2mdn.net/videoplayback/id/665a866fb510b6b9/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1698364407/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 1928 132 KB
0 130ms
104ms Media
video/mp4 2a00:1450:400e:4d::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:4d::8 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Range: bytes=0-

Response headers

expires: Wed, 26 Oct 2022 23:53:27 GMT
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-1580612/1580613
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1580613
last-modified: Wed, 28 Sep 2022 11:35:52 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
client-protocol: quic

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4D74 1 KB
643 B 59ms
58ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 42714
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 12:01:33 GMT
etag: 48472445140208031
expires: Thu, 27 Oct 2022 12:01:33 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 8CD4 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 21465f8e1016c25d1e2139c8c020d135b62f5625420dc0cf1afbac20eebc873d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7D71 22 KB
8 KB 59ms
58ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 42714
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 12:01:33 GMT
expires: Thu, 26 Oct 2023 12:01:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 4D74 35 B
464 B 102ms
31ms Image
image/gif 2620:116:800d:21:b314:a0ef:ab7c:d546
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOYdmUhgrsxZ5yFujjIKXc0&google_cver=1&google_push=AZmPxg_5VMaHw1iavOJsxMaSxUvxFFkJBAWfQC2viHIr-mYoe0bhOT2biHjP19KjgRAd0EluEOrEqE82yy1DJRI0Xyy5FEpas3Wo

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:b314:a0ef:ab7c:d546 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D74
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MkZISGd1dVgxT05RZDk1&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&google_cver=1&google_push=AZmPxg8ADxYMU18LSrUM5CQBy4iBSkM9C72faFtPM_6Sr61...

170 B
188 B

42ms
42ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MkZISGd1dVgxT05RZDk1&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&google_cver=1&google_push=AZmPxg8ADxYMU18LSrUM5CQBy4iBSkM9C72faFtPM_6Sr61wZ5fSPHWOwsMB2DWdR6in5xkqdGMPycRCx07khh5OOzl6XBL9_Y6W

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 26 Oct 2022 23:53:27 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-0a4402c7ccc8b73ba@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MkZISGd1dVgxT05RZDk1&google_gid=CAESEA21i2BKwpc006MnWQNE2Ew&google_cver=1&google_push=AZmPxg8ADxYMU18LSrUM5CQBy4iBSkM9C72faFtPM_6Sr61wZ5fSPHWOwsMB2DWdR6in5xkqdGMPycRCx07khh5OOzl6XBL9_Y6W
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D74
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGzCi6-4eIKOUmPhNeShEPs&google_push=AZmPxg9kWddCuw8QfOzDBVNrzBLKvBn762Zk6zbl6ki2QRmXNwxhlAe3ZA...

170 B
188 B

44ms
43ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGzCi6-4eIKOUmPhNeShEPs&google_push=AZmPxg9kWddCuw8QfOzDBVNrzBLKvBn762Zk6zbl6ki2QRmXNwxhlAe3ZAab0aa7yfkDkg0tMRRcMrtkHS_wq8PGbdESbvk7zWE

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-ewr18161-EWR
pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1666828408.912581,VS0,VE7
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGzCi6-4eIKOUmPhNeShEPs&google_push=AZmPxg9kWddCuw8QfOzDBVNrzBLKvBn762Zk6zbl6ki2QRmXNwxhlAe3ZAab0aa7yfkDkg0tMRRcMrtkHS_wq8PGbdESbvk7zWE
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 4D74 0
191 B 113ms
33ms Image
text/plain 66.155.71.150
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEJJYFT6Unysxl3lbu50F2mU&google_cver=1&google_push=AZmPxg9LPg1Z7Qy4aqMD-9OKT2IpMsUhFPw2u729f1B4_ahHUSb8Ls5OvI_19PpeVpBt75tYUmQSNO_3rf3s3DR6fNk0796xX9s
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.150 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D74
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEDxx4ob4uBzDI7LX6rWhMHw&google_cver=1&google_push=AZmPxg-adhBfQRnXtIPDjTY23srouwyuL3Iv6CmpzKKWydPqKA0AxCF3I4kN3hcBrHWjm-IAUaP0AkN7UVfML7pig...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-adhBfQRnXtIPDjTY23srouwyuL3Iv6CmpzKKWydPqKA0AxCF3I4kN3hcBrHWjm-IAUaP0AkN7UVfML7pigBAv346axnGr&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

170 B
188 B

41ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-adhBfQRnXtIPDjTY23srouwyuL3Iv6CmpzKKWydPqKA0AxCF3I4kN3hcBrHWjm-IAUaP0AkN7UVfML7pigBAv346axnGr&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 26 Oct 2022 23:53:27 GMT
pod: X-Sovrn-Pod: ad_ap6ams1
access-control-allow-methods: GET, POST, DELETE, PUT
location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg-adhBfQRnXtIPDjTY23srouwyuL3Iv6CmpzKKWydPqKA0AxCF3I4kN3hcBrHWjm-IAUaP0AkN7UVfML7pigBAv346axnGr&google_hm=FjE5uGZHnEOPK_WTQRmzmdln
access-control-allow-origin: *
access-control-allow-credentials: true
connection: close
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2 204 um
cs.emxdgt.com/ Frame 4D74 0
55 B 128ms
30ms Image
text/html 3.75.3.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.emxdgt.com/um?ssp=google_ob&google_gid=CAESEO8fiqLbwVIvlaWnTHrr6NM&google_cver=1&google_push=AZmPxg-e6UqyCRLFnoeNwnRXMTmup5f13lU3rT6MbNAkB7jqH_zNNYDr-5aRThCi3q1E873hBnUuk3VfwoQ6Mb8j0b3MVdU9aXC8Lw
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.75.3.113 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-75-3-113.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
content-length: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D74
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lbvKgJCI...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lb...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=c779c061-83a9-436e-8adf-6e023bade620&&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lbvKgJCIHKGGel1DPF4J-ezTVPp0gTrscRLIBRXCIU...

170 B
188 B

42ms
42ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=c779c061-83a9-436e-8adf-6e023bade620&&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lbvKgJCIHKGGel1DPF4J-ezTVPp0gTrscRLIBRXCIU14OLfIWuDp5TtXIeY27g0fSDB_2A

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=c779c061-83a9-436e-8adf-6e023bade620&&google_push=AZmPxg_RcjaGfndrLG-wbaxFK9HFe8d9lbvKgJCIHKGGel1DPF4J-ezTVPp0gTrscRLIBRXCIU14OLfIWuDp5TtXIeY27g0fSDB_2A
Date: Wed, 26 Oct 2022 23:53:28 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4D74 0
12 B 39ms
38ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IWb8I7bo4AphWcu0EAsP_CvlpW5AwZ7zeVHHxkshvRKq62Kuj58lxdPfnMKdgvAD_n3OK54kQ

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js Show response
pagead2.googlesyndication.com/bg/ Frame 7D71 36 KB
16 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d9aee9c7463bd35f930878be886e5ee224aa8c9800331d699b91a28ceccdf1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
last-modified: Thu, 20 Oct 2022 10:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 26 Oct 2023 17:17:30 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CD4 0
26 B 69ms
69ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 pixel.gif
px.moatads.com/ Frame 8CD4 43 B
274 B 60ms
32ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=WPROMOTE_PEACOCK_DCM_DISPLAY1&hp=1&ra=1&pxm=9&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.socinvestigation.com&lp=https%3A%2F%2Fwww.socinvestigation.com&t=1666828407705&de=450730434209&m=0&ar=e27dbc83ae5-clean&iw=a368aaa&q=2&cb=0&ym=0&cu=1666828407705&ll=2&lm=1&ln=1&em=0&en=0&d=28492869%3Aundefined%3A345923878%3A177734702&zMoatADV=9902108&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.socinvestigation.com%2F&id=0&ii=3&bo=socinvestigation.com&bd=socinvestigation.com&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=wpromotepeacockdcmdisplay515722200356&fd=1&it=500&ti=0&ih=2&pe=0%3A-%3A-%3A0%3A236&fs=200656&na=758546046&cs=0
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

unused62: 8096267
pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Oct 2022 23:53:27 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 8CD4 43 B
274 B 31ms
31ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&ra=1&pxm=9&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2Fsimgad%2F10938034927674496341&i=WPROMOTE_PEACOCK_DCM_DISPLAY1&ol=3714011060&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CG%24%3D!!t.PKm3M%3BI1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-aypgNwRTPmOps3zWES0UEhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-FEBSyfUptYrjUw%3D%3D&sc=1&os=1-gg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&h=250&w=300&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.socinvestigation.com%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fwww.socinvestigation.com&lp=https%3A%2F%2Fwww.socinvestigation.com&t=1666828407705&de=450730434209&cu=1666828407705&m=66&ar=e27dbc83ae5-clean&iw=a368aaa&cb=0&ym=0&ll=2&lm=1&ln=1&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=250&le=1&gm=1&io=1&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A-%3A-%3A0%3A236&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=49&cd=0&ah=49&am=0&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=28492869%3Aundefined%3A345923878%3A177734702&bo=socinvestigation.com&bd=socinvestigation.com&gw=wpromotepeacockdcmdisplay515722200356&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatADV=9902108&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=200656&na=1465009101&cs=0
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

unused62: 8096267
pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Oct 2022 23:53:27 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7D71 0
20 B 96ms
95ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BBEoDd8hZY43QGaqQ9u8P1c6PmAwAAAAAOAHgBAI&bg=!ZWalZiLNAAZPh4lnb4c7ACkAdvg8Wm2WI8EmF-w12-Z1SwNhOaHL3dAdZAuNtOntaEaXgpTPpkB02gIAAABIUgAAAAJoAQcKADb2cyLHawzMX3iSmu9yyqTqFbA7FyJ5BMZoW-M_b3NFT3y1iowFebu9EeUiHdtsXgJWYHDa9nmZAvKC-HznleCanTSiKEffsDjFFyDTQRh0c4pp-RhjCea_LZVqmedSbHDVNzspyMXazifzv98gWqVU5-4gRO5VvhmDCiCiUXRVZKoVqY4yDfCguqM5mv7-kgjCLOpa1KxsBJrdN0Ipug-O0ZIwHrf3ddrbqafpMlpsJKNeCNLvYLJoC_wpvb_cfFi04Rut1fh1kjCn5H9NgUlEaw8LGSIWnalTnhiI7JQrU8uFHikBs2pk1OthHwwPRaYuIRC_Nmn5Ah8kevmfrizGso02ubnuYVDTElHWqGqP_hqF6iBGgyC5t_568_6VwFHbOgQdpCj20851BQ4Ndf4tzX_cG8Rp7PH3qWty7w8C5xSCyzTiw-1hNXLtG3fHXDEvx-yLTWORbFAPJe-wBVecXk7J_SSDn2cmMves_fzuU6RxUOTGC5G--0Hv1nsTyveF1zMrYDhwXPD356ABzuJRLzGx5h2y4Mz59CzKHamA_C5UnkCb9il0USdGzyE1GaYCDmVLjIPjjYodvvpOxWlP6FFzYqsccWKmSAFABY2RDXxEjCNzca-l1-PZ60AVZnKYYqW3DEv1WINF49al_96SgH1ofWcH1N3R1Aadeg0XTREsYxVCS0FSBQY99aC7Os-stKPMDdFQ615rgk_skU-bHzIw1MMvSXIWQlQcDZeynFGknLOLrGcRrM1_gGA223Pf2FW-0YHL2Kil4NZ9gMBOECdyesMNkMnA5I3Ou5RXLg4Q8Kl0QGfPZhglAUaC4ZkCiTDqJ3MyjveLWySwSZ7AzkA9FJZvFlJ2bKkCKU46siEpxKIg_YIJk-Br-giZTPDqeFHih_KVmBrAPY-ipEa8xZZUHTMCPqrpgbhIxux7g_JFqQx1SNvaDFmpcn41KLd4dDRGpOkti0gzZnAN9vv3ZwbpNYtZT4Bscz9sH-RLOtUn2br3mEL3j0n8sq6evGkLsC6MRorN8DJFuhX-FN6MTrP3OEhTqGHqkWzIvO7_faOXSzl2cuoS4um8

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 69B6 6 KB
3 KB 32ms
31ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 23:53:25 GMT
expires: Thu, 26 Oct 2023 23:53:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 69B6 10 KB
999 B 75ms
75ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%7CGoogle%20Sans%20Display%3A400

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fa47715b2f758288c8a1bb97e79b02905c508b68d7a292eb645979af502751c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Oct 2022 23:53:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 23:24:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Oct 2022 23:53:28 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 69B6 2 KB
769 B 59ms
59ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:49:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32609
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:49:59 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 69B6 0
0 77ms
77ms Fetch
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C26mYd8hZY7qDEtLRgAerxZbICL3pwrpsl4jb-bUQpOfy7ZUCEAEgk9ycc2CRhKCFjBigAd-n2vkCyAEJ4AIAqAMByAPLBKoErwJP0Pycv3LTkBsdDF5V3TfdTldV-jjiLkv_mi-tE7PQZRFsHv1ufMSVsYGaBxhxj_pr1QXsIsp0OpHfzcVnrUcsSdWFIhzSRakLyzEBx96iViRY_Q202RrMg7gu0Yr9Zhood8EEq3YR0gJo8gd1dWwojqC-gXWuUSZGIUDQ-iBo8ec1fhqRinFmRvn6L1JPG_Yb4F5TD5A9jv5-UNX8ylFBIwt0aqy6O6I3sfrov2FKonuXD0k-p8-4YoT0iMgqZ8qioM2Cz-f0Irmgzm0t2qQAt7-OxIbm5BxJYquCLzgvFYllqGBRSiwdWNSjlRHREb4ntYGjMPgjhkAfazXL36R6ApyA7JRHNIK3DbcZ2j0fPDzZKFr7qmWoJKqzPWUK73Ra32fJY4NiPLBR1FCNyqHABMDnnLqfBOAEAZIFBAgEGAGSBQQIBRgEoAYugAeJ2KWGAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAPIHBBCJxQTSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAdgTDYgUAtAVAZgWAYAXAbIXHgocCAASFHB1Yi04NDczNzYzMzQxMDU0OTkzGKrnGg&sigh=cuAV8GOxFnI&uach_m=[UACH]&template_id=494
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame 69B6 23 KB
9 KB 63ms
63ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15b192d13c1d029346a73cb1b2eb3a1b8905dfe8df1aaf9ced37356de9380e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23760
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9268
x-xss-protection: 0
server: cafe
etag: 17746901142539384344
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 17:17:28 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 69B6 3 KB
1 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/window_focus_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:18:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9290
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 21:18:38 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 69B6 17 KB
7 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d99f77a187454fecc18b59b2f520b1598b246d01e142bfdc4de56eb7221a9330

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 14:49:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32639
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7367
x-xss-protection: 0
server: cafe
etag: 4759548068123418343
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 14:49:29 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 69B6 0
0 71ms
69ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSmnQoj6L166TIihEyUlrh0FYq0IRJtJRH5yVnvVYSejB7bxZzbPEJGAh84tq8eDHhgD06rL_Oa5znoWcFIqRBab3m4wA
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 69B6 152 KB
46 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47514
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1666784471914692"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:28 GMT

GET
H3 200 6d06f43d9219529f87f676616f1c0e3b.js Show response
www.gstatic.com/mysidia/ Frame 69B6 33 KB
14 KB 189ms
66ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/6d06f43d9219529f87f676616f1c0e3b.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19d9403b8b5963aaeae98991373ef1f4ec9ed98d649be55e657db8e1302578bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 12:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13940
x-xss-protection: 0
last-modified: Mon, 24 Oct 2022 21:55:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 24 Jan 2023 12:01:12 GMT

GET
H2 200 14150478324985323136_5799326240442316721.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 89 KB
89 KB 229ms
149ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/14150478324985323136_5799326240442316721.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c47b6fb0510af7930832cd6d9359e904119cf60b0b1cc31346f2e9dcd794edaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 25 Oct 2022 01:39:18 GMT
x-content-type-options: nosniff
age: 166450
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90953
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 12:20:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Oct 2023 01:39:18 GMT

GET
H2 200 6453803666773825728_11058625576061068247.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 62 KB
62 KB 224ms
145ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/6453803666773825728_11058625576061068247.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

58f7b8ee531e7f41c4aff920a9d826eadd3719c54bdd7cd7c265a970d212982a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 11:03:28 GMT
x-content-type-options: nosniff
age: 219000
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63329
x-xss-protection: 0
last-modified: Sat, 01 Oct 2022 00:28:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Oct 2023 11:03:28 GMT

GET
H2 200 4100957749628308718_9134974959651220942.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 66 KB
66 KB 213ms
134ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/4100957749628308718_9134974959651220942.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

042562ef67f684027513363277619a73fae68bc51e6fe1ebc336725a9dc24675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Sun, 23 Oct 2022 05:02:15 GMT
x-content-type-options: nosniff
age: 327073
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67322
x-xss-protection: 0
last-modified: Sat, 22 Oct 2022 00:44:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 05:02:15 GMT

GET
H2 200 4862487689214010279_11022970624161348516.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 198 KB
198 KB 201ms
122ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/4862487689214010279_11022970624161348516.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebca85c12a5c492c7cf9d82c86e5546561532cca58af76035ed14e624a92882d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Sun, 23 Oct 2022 05:35:44 GMT
x-content-type-options: nosniff
age: 325064
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202874
x-xss-protection: 0
last-modified: Sat, 22 Oct 2022 08:02:36 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 05:35:44 GMT

GET
H2 200 1071829736511705042_6374652804995438935.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 72 KB
72 KB 218ms
139ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/1071829736511705042_6374652804995438935.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70cc4251adb0049f81b4999d2527d2c7140ef6586201f6687427e512b4a61e92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 25 Oct 2022 21:08:07 GMT
x-content-type-options: nosniff
age: 96321
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73833
x-xss-protection: 0
last-modified: Sat, 01 Oct 2022 00:25:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Oct 2023 21:08:07 GMT

GET
H2 200 12937272876599405804_11154888735938831555.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 65 KB
65 KB 207ms
128ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/12937272876599405804_11154888735938831555.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a7e6a1e7fafa222413f5fa76f66fae5fa87571bbe4fef9c33c7096e182ae975

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 13:35:33 GMT
x-content-type-options: nosniff
age: 209875
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66398
x-xss-protection: 0
last-modified: Sat, 01 Oct 2022 00:26:32 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Oct 2023 13:35:33 GMT

GET
H2 200 5625194476237556241_12773961687806043020.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 103 KB
104 KB 107ms
32ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/5625194476237556241_12773961687806043020.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6447d596c90e1618448770fc46b8c2fafedd3127737028f2217d466d5eef22b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 25 Oct 2022 02:06:59 GMT
x-content-type-options: nosniff
age: 164789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 105588
x-xss-protection: 0
last-modified: Thu, 29 Sep 2022 00:17:32 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Oct 2023 02:06:59 GMT

GET
H2 200 8247874069324199662_11172872863979014654.png
static.doubleclick.net/dynamic/5/382691437/ Frame 69B6 57 KB
57 KB 141ms
65ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/382691437/8247874069324199662_11172872863979014654.png

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

342e7821019b4f9f34e3a1634f0e129f4afe6da3e22ef83de10fb4e42fe5de54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 10:19:10 GMT
x-content-type-options: nosniff
age: 221658
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57999
x-xss-protection: 0
last-modified: Sat, 01 Oct 2022 00:25:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Oct 2023 10:19:10 GMT

GET
H3

200

9201656655325074596
tpc.googlesyndication.com/simgad/ Frame 69B6
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKCfzLzSRRDYBBjYBDII6q-gdOZTvjE
https://tpc.googlesyndication.com/simgad/9201656655325074596

45 KB
45 KB

64ms
59ms

Image
image/jpeg

2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9201656655325074596

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

263a37118dacf1c86e314e8c71f5ce51693821d31e2e15fe55666d5c9866f9a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 24 Oct 2022 15:56:51 GMT
x-content-type-options: nosniff
age: 201397
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45723
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 20:48:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 24 Oct 2023 15:56:51 GMT

Redirect headers

date: Wed, 26 Oct 2022 14:36:46 GMT
x-content-type-options: nosniff
server: cafe
age: 33402
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/9201656655325074596
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 25 Nov 2022 14:36:46 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4F2A 1 KB
643 B 60ms
58ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 42715
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Oct 2022 12:01:33 GMT
etag: 48472445140208031
expires: Thu, 27 Oct 2022 12:01:33 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 69B6 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 690e2e276c7815e09e1e3af1dcf2e1269ea1a89a86b4e15a85f1611d767f0d37

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 69B6 28 KB
28 KB 60ms
60ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%7CGoogle%20Sans%20Display%3A400

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 08:44:44 GMT
x-content-type-options: nosniff
age: 54524
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 08:44:44 GMT

GET
H3 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame 69B6 20 KB
20 KB 81ms
80ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%7CGoogle%20Sans%20Display%3A400

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 21:33:43 GMT
x-content-type-options: nosniff
age: 440385
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20784
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:21:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Oct 2023 21:33:43 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 1928 0
17 B 323ms
112ms Ping
image/gif 2607:f8b0:4004:c1b::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~l9qali28&c=3861975625142&slotId=1930987812571&qqid=CPrbrtiL__oCFeLsEQgd3hwGnw&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=947&mt=video%2Fmp4&vs=576x1024&ulv=1&cll=0&vast_v=2.0&vmfc=12&vhc=0&msm=1&aits=0%2C18%2C22%2C37%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=347&vsrc=web_video_ads&ape=1&ple=0&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221024_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::78 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4F2A
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECfdo9fVGJ6Qqe19lK1HbXI&google_cver=1&google_push=AZmPxg-9hkhdKh7G_jwsLMUe523DUHh3NqDzk2eUwvLEDEcDgCUGOYsmaZ...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AZmPxg-9hkhdKh7G_jwsLMUe523DUHh3NqDzk2eUwvLEDEcDgCUGOYsmaZRm6UjNLucXy6ZGxNPjiem7VLDLTejEN4ItTZQSeUtP&google_hm=bRP3k1Al_N2E...

170 B
188 B

57ms
42ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AZmPxg-9hkhdKh7G_jwsLMUe523DUHh3NqDzk2eUwvLEDEcDgCUGOYsmaZRm6UjNLucXy6ZGxNPjiem7VLDLTejEN4ItTZQSeUtP&google_hm=bRP3k1Al_N2EYGkLmcdhIw

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AZmPxg-9hkhdKh7G_jwsLMUe523DUHh3NqDzk2eUwvLEDEcDgCUGOYsmaZRm6UjNLucXy6ZGxNPjiem7VLDLTejEN4ItTZQSeUtP&google_hm=bRP3k1Al_N2EYGkLmcdhIw
pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 4F2A 0
104 B 150ms
45ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFuTOd35Nnp3XXMi5xljUaA&google_cver=1&google_push=AZmPxg_6tCGW2NeAliBM61mZtMf2qv4HDLRNs7BwIPZDW2OSllj8r1VExRT-5nyFoI7Fi7qdi95aVs4sLIGrxXHh4qXdlPndRnxR
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4F2A
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEAP-M927Bc7sUB55byM9Hvc&google_cver=1&google_push=AZmPxg8q7_gdLshJKENDMmQOhrhQ2n3-MY-nFik7f4U4ZpmFubFi489peNFSg3TYIytAgDE1LVj2o06L5pw...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AZmPxg8q7_gdLshJKENDMmQOhrhQ2n3-MY-nFik7f4U4ZpmFubFi489peNFSg3TYIytAgDE1LVj2o06L5pwDZa9daDZNM32I3zYS&google_hm=e8sl0_5lQKyy8P1kcbTEVpA

170 B
188 B

42ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AZmPxg8q7_gdLshJKENDMmQOhrhQ2n3-MY-nFik7f4U4ZpmFubFi489peNFSg3TYIytAgDE1LVj2o06L5pwDZa9daDZNM32I3zYS&google_hm=e8sl0_5lQKyy8P1kcbTEVpA

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:27 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AZmPxg8q7_gdLshJKENDMmQOhrhQ2n3-MY-nFik7f4U4ZpmFubFi489peNFSg3TYIytAgDE1LVj2o06L5pwDZa9daDZNM32I3zYS&google_hm=e8sl0_5lQKyy8P1kcbTEVpA
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4F2A
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEGOmlvS-W1Z1FofN4-Cz4qQ&google_cver=1&google_push=AZmPxg8daEfGIrxuh6mSRby5wLTXfC94qqHXAbGINSr1RKD9jqDVGVWVpHkjh2_saej29LookoiMVgB8ox-XbTh0U...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg8daEfGIrxuh6mSRby5wLTXfC94qqHXAbGINSr1RKD9jqDVGVWVpHkjh2_saej29LookoiMVgB8ox-XbTh0Uh3R9fi1znah&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

170 B
188 B

41ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg8daEfGIrxuh6mSRby5wLTXfC94qqHXAbGINSr1RKD9jqDVGVWVpHkjh2_saej29LookoiMVgB8ox-XbTh0Uh3R9fi1znah&google_hm=FjE5uGZHnEOPK_WTQRmzmdln

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 26 Oct 2022 23:53:28 GMT
pod: X-Sovrn-Pod: ad_ap6ams1
access-control-allow-methods: GET, POST, DELETE, PUT
location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AZmPxg8daEfGIrxuh6mSRby5wLTXfC94qqHXAbGINSr1RKD9jqDVGVWVpHkjh2_saej29LookoiMVgB8ox-XbTh0Uh3R9fi1znah&google_hm=FjE5uGZHnEOPK_WTQRmzmdln
access-control-allow-origin: *
access-control-allow-credentials: true
connection: close
access-control-allow-headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4F2A
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESECOFQ55G10X1irMvDh1q014&google_cver=1&google_push=AZmPxg9SUjptT4Np2wU1eeuNWbifs90vfjM8w9grnjbnEuVzohRsw0XRUjdzqnaOCyfuJxpGFhjoUM6gg4rUG--8QPfdfc...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg9SUjptT4Np2wU1eeuNWbifs90vfjM8w9grnjbnEuVzohRsw0XRUjdzqnaOCyfuJxpGFhjoUM6gg4rUG--...

170 B
188 B

52ms
41ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg9SUjptT4Np2wU1eeuNWbifs90vfjM8w9grnjbnEuVzohRsw0XRUjdzqnaOCyfuJxpGFhjoUM6gg4rUG--8QPfdfcMguEOa

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=odrul5P4Sg-l7f8nkvM9xQ&google_push=AZmPxg9SUjptT4Np2wU1eeuNWbifs90vfjM8w9grnjbnEuVzohRsw0XRUjdzqnaOCyfuJxpGFhjoUM6gg4rUG--8QPfdfcMguEOa
access-control-allow-origin: *
date: Wed, 26 Oct 2022 23:53:28 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4F2A
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESENPchvVVG75QC9NH-wzlWXA&google_cver=1&google_push=AZmPxg9qjgFk3_tFkq0pQJij8HAONz3j5XPoEfhHmeYPWRo0ZPVWVB8KY1dFysWxO_Ub64b0ug...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg9qjgFk3_tFkq0pQJij8HAONz3j5XPoEfhHmeYPWRo0ZPVWVB8KY...

170 B
188 B

53ms
42ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg9qjgFk3_tFkq0pQJij8HAONz3j5XPoEfhHmeYPWRo0ZPVWVB8KY1dFysWxO_Ub64b0ugK3fNCTQT5UqmUU1kgTMWeT6n5QUg

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1zdHlIR1pORTJ1R0cwcmI2Sk9lTFVmemJ0N19nMzU1OX5B&google_push=AZmPxg9qjgFk3_tFkq0pQJij8HAONz3j5XPoEfhHmeYPWRo0ZPVWVB8KY1dFysWxO_Ub64b0ugK3fNCTQT5UqmUU1kgTMWeT6n5QUg
date: Wed, 26 Oct 2022 23:53:28 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 um
cs.emxdgt.com/ Frame 4F2A 0
45 B 34ms
32ms Image
text/html 3.75.3.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.emxdgt.com/um?ssp=google_ob&google_gid=CAESEH8EPBfagWIuNsnZITGQw-M&google_cver=1&google_push=AZmPxg8FLAZctUZyTv926hh8O4SdfYTjfwH13jpTtHWgxZvqKOSCLir92zXg17koXsJErJjs_XWTNVVIbw6tjF_ZFVwKSCUDLh3I
Requested by: Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.75.3.113 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-75-3-113.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
content-length: 0
content-type: text/html

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4F2A 0
12 B 49ms
48ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kms48-y007aJAYC1T_SXwi1J09MNAXn7WY0O0rJFEgivjH8SId74lfpdNHt3sVKcDINT2j-S4

Requested by

Host: c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
URL: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js Show response
pagead2.googlesyndication.com/bg/ Frame 70F1 36 KB
16 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d9aee9c7463bd35f930878be886e5ee224aa8c9800331d699b91a28ceccdf1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23758
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
last-modified: Thu, 20 Oct 2022 10:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 26 Oct 2023 17:17:30 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 406B 0
0 67ms
67ms Fetch
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssI4yLHsKpB1wycWizjO9Al1_Oe2dCkPoitdmeo-cD6WxZPlmpL5AaQttUzApFmcyoaA2R-mJuR2FRkeeKKlFAHgQN9Dmyw73J3KqV3faiOjEHm5OKxhkPLAdyFqxaFJY442loDqR0SyNnLeBiszXOrzZJ8KyhamMl7nbFgbAwQWWMXwLo0tFWDhnXp_SS2IrLeEYSZZYxcGH-w2o4vuH5P4bV9xlvZnV38tuwpfi6L_2XRCp5w7C8r6PMegTN0oI_KQ-Cpo-8T3nMrS8ree4YM3wCbza4Rq_K_DrKTEdk9I_jayt5dK3gIFHjq0U3Pb4WCbmQ&sai=AMfl-YQdhpH7CmUX-wN-KMzKKYjHxHn1OFQAFiHOmJHv3luXxTUZxOfW52D02yycUwpCOMMucnsmAz2x5T3jbMc4IMnArJV9pPhumir9-Uu8iJ6UCXWuV9WRJ8_gsIZqiwX1&sig=Cg0ArKJSzOJbksOTLzTWEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame 406B 23 KB
9 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15b192d13c1d029346a73cb1b2eb3a1b8905dfe8df1aaf9ced37356de9380e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23760
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9268
x-xss-protection: 0
server: cafe
etag: 17746901142539384344
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 17:17:28 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 406B 3 KB
1 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:18:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9290
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 21:18:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 406B 0
0 65ms
65ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRhg8tnfQj8EBxBxeAG2FjAiGzVRwbSkS2hcIdhRA6TaiYy73hPcAQ3iLrpdKl2BeTFDFU0iPICP-Sl3O21s_yVva7j4g
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 406B 152 KB
46 KB 364ms
363ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47514
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1666784471914692"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:28 GMT

GET
H3 200 12916864002368197138
tpc.googlesyndication.com/simgad/ Frame 406B 197 KB
197 KB 59ms
59ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12916864002368197138

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02f88e8ee35072c3296ee05886dde29eb28beb2f3dbdc3b6173138537bb43f89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:55:09 GMT
x-content-type-options: nosniff
age: 460699
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 201591
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:39:48 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 21 Oct 2023 15:55:09 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 14F8 42 B
64 B 102ms
101ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvGCutMnGcOylyi4i7tXWy4EJoeWRMRhZ7ue91XZtcYjM2cEp-9HKbYAH9oE-TNo4GnBUKtmOzgUvw7sMH8QXYuft4s29ZlrXmDtMzOvZXV6clTJzZz5USXIoGZ4WbyCiaed1PJLw&sai=AMfl-YTgDh5Dsw5diL7fEUE6dwhE8DZ1LdME6jmY6WyZ20sZ9mwVviOamajSYU_qQekD09wafYYh-q7bwQqGoxL1XElQl2OcElsNGAmUDkY8MGiWoQ61QCD2dPT6Ipb5pcQ&sig=Cg0ArKJSzMc4PEBKiG6GEAE&cid=CAASJeRoNAsQ-KzNIoEIR6DMBEwZjEtREtzYQA5bLpX7C91HJ3esLBI&id=lidar2&mcvt=1015&p=122,606,372,1576&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&v=20221026&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2161349176&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1666828406804&rpt=563&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 406B 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b36ac44002c0d5c516da5746548478ea57d2225cbde2c55d5e265e06f8333161

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 08D4 0
0 68ms
68ms Fetch
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvBmVp_tgtDnFi4Gj-m-o6UBmIY-antZeVbeRI1VACWuMztI03W0wVBY43pX_8_06fKBq0t2UfS4Q0w0n1fMm1nAy4w9EgUcNTmiUIqDcYxK3ztC0fI9mql63yS9ygYEZuO2rBfXlD8ES9mwhhKX7iAf3wB3QtYihfmdyLgoAZD0xoZXgAYEq3J0SmSzCbxvcBrPTcNN5qv4sOPq8UKMKnWqoo27fpwM8A21f4qKJ_ojG3Gk1YMrXCjzK5dpuYFLHsZ-GGC6KQeL46UHoO4M1HeBGCBRzAwmPheM_fU4a9KRTlYJ94yKmuT9nNMQaS9FceAa-FMOpshRqGE&sai=AMfl-YQAtM5AG3aA04eEsi4DDZ3BnwIdnk5pWKfC3O_TiDRWm8Ni1B7kggVBUk9Ytd_WGarsx0pT50T-CS7DIfDMUo7tiLxmLoES3gwTVMtl_S5x4mmMj0NGLZ0R_3MuH2As&sig=Cg0ArKJSzJDdRDDnR7SqEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/ Frame 08D4 23 KB
9 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15b192d13c1d029346a73cb1b2eb3a1b8905dfe8df1aaf9ced37356de9380e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 17:17:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23760
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9268
x-xss-protection: 0
server: cafe
etag: 17746901142539384344
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 17:17:28 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/ Frame 08D4 3 KB
1 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221025/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 21:18:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9290
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 21:18:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 08D4 0
0 65ms
65ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSlycsBosveVJM9FLkqYdJBe7OvW3BXYp0KZSV9iZLwIAifreER0jyOfCt4b4aThhmMq_LWwOGOo2rldo3wRUXLWO_J-g
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 08D4 152 KB
46 KB 137ms
136ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47514
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1666784471914692"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Oct 2022 23:53:28 GMT

GET
H3 200 17473150382721750854
tpc.googlesyndication.com/simgad/ Frame 08D4 135 KB
135 KB 61ms
60ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17473150382721750854

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022102401.js?cb=31070529

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc17fed30ecc52c6c54360f0964d72858377723e66ac5e8114e3a22609878707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 22:28:20 GMT
x-content-type-options: nosniff
age: 437108
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138618
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 18:01:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 21 Oct 2023 22:28:20 GMT

GET
DATA 200
OK truncated
/ Frame 08D4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07af4d32493f172360e95b652e42bed9bfaa9221a9399513a64263347e68719f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 406B 0
0 69ms
68ms Fetch
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssxMvqxVECmm6MXml25-Farj_2lTfpv6Ee3wX1OQCQ6i_sePO1wBU8KBgWSVZsVK4XMCit_kQKDyAY2hOQz23PfurCKiTslWZ1CDY9yzXFrQkh-94LTeaUUP3KIQkUCDF9dWpKzKAMxmgKEpihzmkJQr9VwdvZSC1TN0k0fbvFg7Ri0RffaNdbgsRdepkqWSNI3OyYg7ra4bl-1FpcLGbCzFrd_RqN6oPwyH8TlKCE1kUh46H_s2_Q1BJo0oKdBrWHtOy_fanpCAJbsC5iiotKFfl-Op80bcG5HaP19qwsVUA-KMqvdgDuZ2GHIaRJtZqfyFbtybw&sai=AMfl-YSj0--WHJ166u5G2G-Qd3YCcVtqSrMrC6Eb52_lHlzXD6txb1qiWeiTm-zY3VmbTQjKA0qGVNpP02fLwSO3bcJR8wq72cXewETWfECfn2yOPMTwk1uoERDL0At3oFOc&sig=Cg0ArKJSzMnDnEIoMyivEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 26 Oct 2022 23:53:28 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 08D4 0
0 67ms
67ms Fetch
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuwqCGy5YpEcH0nKQmwerESSZL83kTAdWYzykbJIUgX7cAGBqJcEnWgzkwe7TyAH8KrkrEfsodJcf_llbrKp5YkPRDX_twj1EknJJgJ-GxDn8pxif-n-KIbJL-BDCfyqqYoCNM87ktdLTnCk2xRQUUwDJoBPLmo_H6HBPWq3rqR5tObFhyFhhwnLYJ2PpFnJl6RL4mMLGVp-qiSWq6hcX1wcCDFicYLFC0jmJS9L2FpzVecHs8KkdWj_2JSCTJt6Ot_TV5bvMfVcyBrCdwW403zmEinS5pqZuyWKjUCcYeW5A-O5QLHBLKjlfE49wyhgUBONOid1PYeVcFWxxI&sai=AMfl-YR2oS4XSsXiUSlY5EpIKmHL6HwIo0f_REvnmve8RHFbmHPKARMxI1vE-kWPy6X52mif2vcSs4hYZTypNq392u98U6_3040fl3wkZvP0qCLX4FWUCLLR51sprXQaFk7K&sig=Cg0ArKJSzAhpYaJi7hlbEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 23:53:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 26 Oct 2022 23:53:28 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 08D4 42 B
64 B 94ms
93ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv7syfu4v8gjtrSYQmpN2aakptRNblb_qHr0NLjsORvrfegykMWf0076vFUHjN2cUBm9KnnRARqc_tD2_55x8hpVH6-kiF3wu5DnpQCBFpeWLAlWH60&sig=Cg0ArKJSzJnrL_MbeSB7EAE&id=lidar2&mcvt=1000&p=781,1022,1381,1322&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&v=20221026&bin=7&avms=nio&bs=1600,1200&mc=0.7&vu=1&app=0&itpl=3&adk=3262068692&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1666828408629&rpt=207&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Oct 2022 23:53:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

254 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

38 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.prebid.a-mo.net/	1970-01-20 15:46:04	Name: __amc Value: 1_1666828404_1666828404
.doubleclick.net/	1970-01-20 07:00:32	Name: DSID Value: NO_DATA
.adnxs.com/	1970-01-20 09:10:04	Name: uuid2 Value: 6577824828712182117
.simpli.fi/	1970-01-20 15:47:30	Name: suid Value: B0094347CD66430CACCAEE55B36AA9E8
.casalemedia.com/	1970-01-20 09:10:04	Name: CMPS Value: 2161
.adform.net/	1970-01-20 07:45:06	Name: C Value: 1
.demdex.net/	1970-01-20 11:19:40	Name: demdex Value: 90990959478385712721908256373894623988
.lijit.com/	1970-01-20 15:46:04	Name: ljt_reader Value: FjE5uGZHnEOPK_WTQRmzmdln
.adform.net/	1970-01-20 08:26:52	Name: uid Value: 4605284689594816416
.turn.com/	1970-01-20 11:19:40	Name: uid Value: 3020886442931103800
.cbsi.demdex.net/	1970-01-20 11:19:40	Name: cbsi Value: 90990959478385712721908256373894623988
.yahoo.com/	1970-01-20 15:46:26	Name: A3 Value: d=AQABBHfIWWMCEAnzfdn3Ff0j8LhPQ-3VQkEFEgEBAQEZW2NjYwAAAAAA_eMAAA&S=AQAAAvORO2Ykl2MqScsf0i20NeQ
.casalemedia.com/	1970-01-20 15:46:04	Name: CMID Value: Y1nId2VlQafzC7SYC6QH.QAA
.casalemedia.com/	1970-01-20 09:10:04	Name: CMTS Value: 2140
.casalemedia.com/	1970-01-20 09:10:04	Name: CMPRO Value: 2161
.360yield.com/	1970-01-20 09:10:04	Name: tuuid Value: a1daee97-93f8-4a0f-a5ed-ff2792f33dc5
.360yield.com/	1970-01-20 09:10:04	Name: tuuid_lu Value: 1666828407
.analytics.yahoo.com/	1970-01-20 15:46:04	Name: IDSYNC Value: 18yx~27xz
.go.sonobi.com/	1969-12-31 23:59:59	Name: HAPLB8S Value: s87150\|Y1nIe
.tribalfusion.com/	1970-01-20 09:10:04	Name: ANON_ID Value: axnseFsKBRgFmDqU7pexYdCIJt50DP5Ie3GbDvITS4ahngTl07QUP8dpVTyLewyf6l5NZak3b6833bvZbQ1iSu
.adnxs.com/	1970-01-20 09:10:04	Name: anj Value: dTM7k!M41.D>6NRF']wIg2IlknSU)U!]tbPl1M>e)ZlrFUfJ+tGXxp:Q4<F88yVEiHQ>^f:+%=2Ert#6[8209h^)PW3If)y3KL9D3I?+a$tC/7
.pubmatic.com/	1970-01-20 07:01:54	Name: KTPCACOOKIE Value: YES
.agkn.com/	1970-01-20 15:46:04	Name: ab Value: 0001%3AGVW0XGwwN9o%2F5UGxZh6AzaEOWHMfu%2Fyc
.agkn.com/	1970-01-20 15:46:04	Name: u Value: C\|0EAAq7IT3KuyE9wAAAAAAAQAHAAAAAAGyxEX__x4AAAAAAFwJXgAAAAAUnmEmAAAAAAqYBC4AAAAAIApCXgA
.pubmatic.com/	1970-01-20 09:10:04	Name: KADUSERCOOKIE Value: 3F9E14E1-4C0F-46AD-822B-3810286E5F74
.quantserve.com/	1970-01-20 09:10:04	Name: d Value: EAkBCQG2J4EA
.quantserve.com/	1970-01-20 16:30:42	Name: mc Value: 6359c877-b0397-c9af4-6021f
.w55c.net/	1970-01-20 16:30:42	Name: wfivefivec Value: 2FHHguuX1ONQd95
.w55c.net/	1970-01-20 07:43:40	Name: matchgoogle Value: 5
.everesttech.net/	1970-01-20 15:46:04	Name: everest_g_v2 Value: g_surferid~Y1nIdwADAuK0IQAW
.bidswitch.net/	1970-01-20 15:46:04	Name: tuuid Value: c779c061-83a9-436e-8adf-6e023bade620
.bidswitch.net/	1970-01-20 15:46:04	Name: c Value: 1666828407
.bidswitch.net/	1970-01-20 15:46:04	Name: tuuid_lu Value: 1666828408
.ctnsnet.com/	1970-01-20 15:46:04	Name: gid_CAESEAP-M927Bc7sUB55byM9Hvc Value: 1
.ctnsnet.com/	1970-01-20 15:46:04	Name: cid_7bcb25d3fe6540acb2f0fd6471b4c456 Value: 1
.doubleclick.net/	1970-01-20 16:22:04	Name: IDE Value: AHWqTUlYzpnmz_RTdMwGsd9p6fHFdeqLvy_5N7WMD5MwcbofRO28LEKFXvnS7MtJaw4
.socinvestigation.com/	1970-01-20 16:22:04	Name: __gads Value: ID=5af278386182e2bf:T=1666828405:S=ALNI_MasBIcRoGgKl4RK91VMZ7zlF7844A
.socinvestigation.com/	1970-01-20 16:22:04	Name: __gpi Value: UID=00000b78aa760f1d:T=1666828405:RT=1666828405:S=ALNI_MZRUkW7-Z9xllk6noHkWOnyujDs7g

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://z.moatads.com/wpromotepeacockdcmdisplay515722200356/moatad.js(Line 137) Message: The deviceorientation events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
ad.turn.com
adservice.google.com
adservice.google.nl
ap.lijit.com
bid.g.doubleclick.net
c1.adform.net
c6eff910001f9072e2f632d3ee079520.safeframe.googlesyndication.com
cbsi.demdex.net
cdn.hooliganmedia.com
cm.g.doubleclick.net
cms.quantserve.com
cs.emxdgt.com
csi.gstatic.com
d.agkn.com
dclk-match.dotomi.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
gcdn.2mdn.net
gcm.ctnsnet.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
image6.pubmatic.com
imasdk.googleapis.com
match.360yield.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel-sync.sitescout.com
pm.w55c.net
prebid.a-mo.net
px.moatads.com
r.turn.com
r3---sn-5hnekn7z.c.2mdn.net
rtb.openx.net
s.tribalfusion.com
s0.2mdn.net
securepubads.g.doubleclick.net
ssum-sec.casalemedia.com
static.doubleclick.net
sync-tm.everesttech.net
sync.go.sonobi.com
sync.teads.tv
tpc.googlesyndication.com
um.simpli.fi
ups.analytics.yahoo.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.socinvestigation.com
x.bidswitch.net
z.moatads.com
104.18.19.126
142.250.184.226
147.75.85.234
151.101.194.49
172.217.18.2
18.194.101.27
185.64.190.78
185.80.39.216
185.89.211.84
2001:678:cb4:bbbb::11
205.185.216.10
216.52.2.30
216.58.212.162
23.11.239.181
23.35.237.151
2606:4700::6812:19ad
2607:f8b0:4004:c1b::78
2620:116:800d:21:b314:a0ef:ab7c:d546
2a00:1450:4001:801::2003
2a00:1450:4001:806::2006
2a00:1450:4001:80b::2002
2a00:1450:4001:80b::2004
2a00:1450:4001:80e::200a
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:813::2002
2a00:1450:4001:827::2003
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2006
2a00:1450:4001:830::200a
2a00:1450:4001:831::2001
2a00:1450:4001:831::2002
2a00:1450:400e:4d::8
2a02:fa8:8806:12::1400
2a06:98c1:3120::3
3.123.150.182
3.126.163.185
3.126.56.137
3.75.3.113
34.252.9.30
34.91.62.186
35.186.193.173
35.186.253.211
37.157.6.247
51.89.9.253
54.229.2.193
66.155.71.150
69.166.1.12
74.125.133.157
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
00f2cb9932cf77c587cc8f03c84e1c1432be58cc6a935344cd90d91d63c4020b
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
02f88e8ee35072c3296ee05886dde29eb28beb2f3dbdc3b6173138537bb43f89
042562ef67f684027513363277619a73fae68bc51e6fe1ebc336725a9dc24675
04a5a33c6fac83565e0f8bfe9575db1e8c635e3c3e01800c5e5da28acdab850e
06affebe3ff598a04bdbb98e7440365dc63e81a496ed82424edd6c9e827fb694
07af4d32493f172360e95b652e42bed9bfaa9221a9399513a64263347e68719f
09cc503b39f0ff23111123eecb3886bf2f40b8151815ac6c03b7ba8ce11b7026
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c89871faf7d2b59c948ff5e12f2d4971d7cad0e9bc23d2ab8379d8210d7f5cd
0da4791b446818516f710c51707081aec7b23a7c5212fc0b2629c973210136a4
0e38c932c32bb50ae5bee95b895a89fb417febaf1f35506744a2bf93fb48070e
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
136ef8cd3222fdd91a301ea2b4218430b1cdbb6389d69f79013e92e49726984c
15b192d13c1d029346a73cb1b2eb3a1b8905dfe8df1aaf9ced37356de9380e32
1612e528df544acdb2987f4816f50a2f4032dd03fa5f8699e9b456ba9ceb81dd
1794a3cf13f7bb6847ad633beedd9dc4c09773165073a6718b73d1314d4b87a2
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
19d9403b8b5963aaeae98991373ef1f4ec9ed98d649be55e657db8e1302578bc
1a525a2e5c92b17dc4a7f505b744c4b28084c5e538c60f1573daef91777a7f64
1aba8eb54c69cadbe19c10812b93c0115706ded00a24e57beb690137ada9019b
1b70f64a3a0b1313d2c9d7b6f839e42e24c7b762b3a36ff492c1cfc7c81098cf
1c8ef9dfc9dd03c8c921452506e8036676c465f9f4ccb62c33934319506b99e3
1cb5dcdb11eda07425f9584041552e161f7ff7395cf52d201e023dcd869157f2
1d9aee9c7463bd35f930878be886e5ee224aa8c9800331d699b91a28ceccdf1d
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
1f9871deb2852386fc1f11dcd8f7e76d071efd031366901c16fac4fa82310658
21465f8e1016c25d1e2139c8c020d135b62f5625420dc0cf1afbac20eebc873d
235be8bfdd19de9bbd0b0291b2b588b6c295093a33120f06d1e1b8803708c7fb
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
263a37118dacf1c86e314e8c71f5ce51693821d31e2e15fe55666d5c9866f9a1
272fd4e2790248a70d7aafdcaea641d52bd7242e85c9d0b7464dc8a374a40337
2b6e18132b3e4c063dadb4994dc4bd9821d761b1123bf55bf1875b737f7787b3
2ef0e3ab3c5f4c424d6a778b7cc5e5cbd94a00cbe69fea62696d2bfed3e49de1
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3378fb808052472987b9ee3c79eb6f23c831d883f1ec3381c903fee00ddd768f
33a765d12fcf0854f5e0cddfd2d926cf1e4de070b6e02c871398ae2e64be5b29
342e7821019b4f9f34e3a1634f0e129f4afe6da3e22ef83de10fb4e42fe5de54
35a3430524543dd9933b01089961dc9d0fbaf84b74af1cfc246c162ee0d3125f
35bb05c7fe024e3e2a137bb4e0fe9f14fdc9fb9e022740452e8bfdef0a900ffc
35d22c1685889f79c4d92edd7544e5a0c2d58b8126190bc181474e518042c0ba
383947decf3f80b59ea39cecaac0876a456eff9d0477c0760b8d08a8e6140183
39a5002bda56d66137a61bd2e5a140310f8c85e3aee91a958effe526aaa5471d
3a1782b55bd2cfba5280382ae4f11bdd0b6784ba012982be940295c9b34ad57f
3bb3d03e4e168e64c6a17b3c68c21734835e2a9eb813c511e9c4ceabf1c7bd22
44c4ed1af3bdda941698f1c946b68b6662aceb96ea833c246a4ae3a2cc420151
47d0d2867473bc7627004dcdb05af0abc5fa4cb44a5592a50e412cb909377fe4
4873ba0ba5324f78b074263f4946dcb088b1b1beea174e14f9b8f60007de6926
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7
494d714b114dca21c5b1b3b840dd6be5fd46c8da9f3a5169f1aebde0667e0c00
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4ad93b26ed81f9c28a344c6997214ce734422cb5a09d4abe1fe31b47356035f2
4af2b962e68f5848d571c9faca60d5c26db34d3dd1d027323a38c7665479d76a
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c49b03685563b28f6f12ef05b608288482ea816882b82ab7bc5d9542fc4eddd
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e70f196596d57a6f3570a0983040f63d9ed88bb9da8849a302ad19fea617dd2
4f4d20dfc97b1d181ea138840c23110bbca3d2bb930c059b7051a443230b894a
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51a7253d7470a5568df4c781f29ddf530a892a6a044ef91a4dafff95dcd0d265
53bab0882e74b131f6e7ed91c8ac092d03e8a199dd3aaf89d59b2eac192cde17
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5601922898e1de0402042c3c0d826ad07a8f09fdd0bda775c6a058e918195b2b
58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488
58f7b8ee531e7f41c4aff920a9d826eadd3719c54bdd7cd7c265a970d212982a
5a7e6a1e7fafa222413f5fa76f66fae5fa87571bbe4fef9c33c7096e182ae975
5c3cb71138ba89f1cf2419b37b83b35f896ec41631b116926520ae31541fd9bb
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5ca2151931b6171d626697be44acd541120b59d13418f1e3ce9965e66dd905df
60e9796f6dd85dadb59f4025ebef2f9dabe2f98e63884a5c28ff0742f99de20c
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62f3acb0192b1e8f397ad3f646ed9ef1f00fd933e52519963b676fcada9e16cb
6447d596c90e1618448770fc46b8c2fafedd3127737028f2217d466d5eef22b2
65513e686b4874559d231936804fb5881e1f300c3c7dd4c63e9033c63ebd1f69
684dfe949ae87a38c2afbcee199f51b0025dd9121b524d62e881cf40846cdd21
690e2e276c7815e09e1e3af1dcf2e1269ea1a89a86b4e15a85f1611d767f0d37
6956cbfddf2ce28aee043ecd2b7dbc3ada3954646d7009c6dd1b5ca173f136f9
6bd6ef384f95c63760a90ab5e6d0ddc45ecee28a134fd869dd7d6ff629a7b274
6c1b2722be99e0f2c4cd70c48f342eb543a3ee0bec1b5dc6f1d72b034e013b47
6da84a88a91dde82ea2be848ad71993f5e164efd25c397f87cdd35a3ac9f29fd
70cc4251adb0049f81b4999d2527d2c7140ef6586201f6687427e512b4a61e92
79bbd067eff59b0e77f2c105b6a23129e341e4e0ed12a27e2618216fc1e850e0
7a9d9add68e7f5c3ac92ca43c42ad16d7ce5021c11bfd5f03d1129a04402e19d
7bfed7fcc395671d82ccbeab04b29455102a75310511cd6ebfd951cbe5e0ae8b
7c19c4de4eb4160edae6eab4a733a624718ab361141cbd77f6c476e2ac4bbb78
7ea31a72e208889ba7cf10d12da43cc3dc1d2a80678e39d36fce67d667586556
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
87a0cdc19e16664e0bdfa53b8b3c9b4dfa11b5b46a3fe3cedc629499f45f72a6
89340946079058ec32f6a455fdf05e55fcb627a5be2617fcdb0fc0d393195608
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8c91490b6256ccd1996f725a45e5d4b33c18fb963f6852dd5d387e1de1aa2c53
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
99babef827b92a462e8fdc99e29f05fdd5df82272ade774e837541eb2fc6b9d1
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9bd85f417a69a46dff7efd6551f5448e04516de7838d180dadfeb6f9277d1c87
9d61b86c85eff864247eac5a28be6b3c4abb337cfbe3a65856914cd74337404a
9dbd3e2effee9b0dd96eabf2e5cbccb01041446a0dc3f3304538087f75410e7f
9fb8fc0fca51d2214c6485a972df3cdb255e228d216c3ffa884e51d427543355
9fda5ff8910b86411087b7c4c614e66b41eea77a892c9e816840f46c5fb8e9d2
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a09c3f27b293ba21c778817f5de3e54fd625ceba7e06ce3fe252f2d4e6bf8ab9
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0ea2fa35271c78084c0244430b865af459ba144154779a691b70fedb0a3f0e8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76
a4e0bb8ef7599f6358fd347657c38363a35e021d5262da9c31748a8b9326c47e
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940
a9c216dc2c163cef46ce19c9156c05aa2edfae28210be29ccfbf902a75190293
ac32377ae624ac720172de6cd59d7fad67c0c78fe658c7a7b2b43be14b9d74ab
acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b36ac44002c0d5c516da5746548478ea57d2225cbde2c55d5e265e06f8333161
b438bfaec498b9ae1119d3ff6b17032850d54007c059a3642abdd61ba57536cd
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
bb96d10b4b71a90568c571d4420edd4e2e38e7faf4eafe7f9adba5374c14fc60
bc64ca4f9ac377de71a30b14be28b0b131109a99dd385a7f4c6c4fdad46b0899
bc821678522f6a89487b0b9310900e882dfb6ecee4bb2ac39a0afdf02d1a60dd
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bfa877887bb9830e0eee4a15d162589c393e494b3f9c86805a68302be0e7b140
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c47b6fb0510af7930832cd6d9359e904119cf60b0b1cc31346f2e9dcd794edaf
c5c50d946b71f3b8f8d411acd873d00c741a090d6dbddf1b31c3ddbc4b607c85
c5e52ac1307c87c338523edd19d7932e73ceee567678f87833496fe3b8e06c76
c70da34747fb31860fa118ff5d6736f81661838a0f50f077aa29d63ad7b00e4a
c927356cd5c29976ac4448b1fc160316d88a24de40405b287ec05a71e355e7ba
c943b419d090488721aca8e822663c98d7cb6cc483dae5636914088f059d8907
c9a612722eed86936463bc8772a9d4509e0c24f22485221beaa583a60079fef2
cb8e968d27846d9b5f945472c551af104bf55e88416fda2c9a844badc7d930d2
cc17fed30ecc52c6c54360f0964d72858377723e66ac5e8114e3a22609878707
cd546e0797df6341ade99f3157cb1b513143ae03e2f877b4d143da3754fecc1d
cda5f084c2c6f858fafe20b03ed46c19082233f70cb20282f1090ac1a2415719
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d5e0684697fa8aeb5266b010e4cf40320640ebb988b51b26017c28dc5d7e93bf
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
d8016275febfece8b113cd5ad403b83b787ec3cdee3f5c27c64a02820ab50a77
d99f77a187454fecc18b59b2f520b1598b246d01e142bfdc4de56eb7221a9330
e0929528a043980b48d039f2617741bba2b75a983b132eb7fad7ad3e2b60a740
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e249765e273a74656063470fe2148a7f4aed395b8731d4efe2a828c52da018d8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6c92b4124a497573949aea82322dee37fc8f522ef4f59ce7ef1411fbe148976
e9bc46a916a7d35fa3988bde53f9a339b436d531431ce865ea179d0c38aaf215
ebca85c12a5c492c7cf9d82c86e5546561532cca58af76035ed14e624a92882d
ec3466e07dd20b5a8044969e6b4ef2341096b43e98adf35d8a3c3fe94958b851
ecac8e33a0fd1eb7b02faa8fc41d9987d06dd8252ec989568900910458098880
eccd0b825996a53f95f8f1d8508bfc2dcfda6a26e12a603db48894a007516357
ee1c191eca53bf9c56a2a13712a48ac9a3def467d15607be90fe26d5657a8fdf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f14f5588e3126579115888a2ffa0e22c2f851c6b884bc0f157c8c905d8e85710
f33b474a31d1481a85b01fedea079932e130b99cb03f108a096dbf579195ce2a
f3c7289e46b8cbc58837a9719245eeb078e1fdf34276b53c4d4aea13cf385982
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f5d406027dde7ba57b063eb276e1e19de171361a999a80278b2072f5f08c7c9f
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f69a3291a73787cd086a9d165630512c48bde188f68c53ef33aba67a0f9b8696
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
fa47715b2f758288c8a1bb97e79b02905c508b68d7a292eb645979af502751c7

www.socinvestigation.com Open in urlscan Pro 2a06:98c1:3120::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

267 Requests

88 %HTTPS

44 %IPv6

37 Domains

54 Subdomains

39 IPs

9 Countries

5576 kBTransfer

10013 kBSize

38 Cookies

18 Outgoing links

Redirected requests

267 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.socinvestigation.com Open in urlscan Pro
2a06:98c1:3120::3 Public Scan

Screenshot
Live screenshot

Full Image

267
Requests

88 %
HTTPS

44 %
IPv6

37
Domains

54
Subdomains

39
IPs

9
Countries

5576 kB
Transfer

10013 kB
Size

38
Cookies

267 HTTP transactions
14 data transactions