simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

ns3203177.ip-141-95-33.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 07 Apr 2023 02:02:28 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 961.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9d9f1761-d6f0-4b32-a912-a024adbd819f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE3ODMwNjEzMDcxMzE0NTYzMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
320 B 22ms
22ms XHR
text/plain 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 07 Apr 2023 02:02:27 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dexchangereviwes.com%26pcid%3D802%26rid%3D152%26a%3D0&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dexchangereviwes.com%26pcid%3D802%26rid%3D152%26a%3D0&rid=esp&cc=1

85 B
203 B

133ms
132ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dexchangereviwes.com%26pcid%3D802%26rid%3D152%26a%3D0&rid=esp&cc=1
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 0d69eff7e4e9040564f34ec008a2e8deb8c0c2ad1bf339afe9efc5e1e8f44f4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-S8ZHtPtd9ik2KCkuCRZiIuMXzoY"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://simcast.com
location: /esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dexchangereviwes.com%26pcid%3D802%26rid%3D152%26a%3D0&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame B715
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELgqf896TBbyqhkhmVu8WdM&google_cver=1

43 B
273 B

60ms
28ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELgqf896TBbyqhkhmVu8WdM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUnVjzC29rMx2H5A8Osljd4HFNUctcZeev0UjINUYnDUEx8k70lisJH0SF1R0eRwNZzwrw9bKf_HCpEy1qwvamCmdU9frmPM7gSEsk4yKeu_rTy6GRrRAEMCh6uIEGaQrFK23TXcgKNlfwVrS5gD_I6ygzwwOjoQ8uHoCP-g_jaqclJiBZEZMNiL2iVbt1R3DGSRAzT5M2JctnUxaHvdpu527LBBQ
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:28 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELgqf896TBbyqhkhmVu8WdM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame B715 43 B
145 B 96ms
28ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUnVjzC29rMx2H5A8Osljd4HFNUctcZeev0UjINUYnDUEx8k70lisJH0SF1R0eRwNZzwrw9bKf_HCpEy1qwvamCmdU9frmPM7gSEsk4yKeu_rTy6GRrRAEMCh6uIEGaQrFK23TXcgKNlfwVrS5gD_I6ygzwwOjoQ8uHoCP-g_jaqclJiBZEZMNiL2iVbt1R3DGSRAzT5M2JctnUxaHvdpu527LBBQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame B715
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEOPi_9ou27JdRX5OQc9iwtI&google_cver=1

23 B
172 B

107ms
46ms

Image
image/gif

104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEOPi_9ou27JdRX5OQc9iwtI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUnVjzC29rMx2H5A8Osljd4HFNUctcZeev0UjINUYnDUEx8k70lisJH0SF1R0eRwNZzwrw9bKf_HCpEy1qwvamCmdU9frmPM7gSEsk4yKeu_rTy6GRrRAEMCh6uIEGaQrFK23TXcgKNlfwVrS5gD_I6ygzwwOjoQ8uHoCP-g_jaqclJiBZEZMNiL2iVbt1R3DGSRAzT5M2JctnUxaHvdpu527LBBQ
Protocol: H2
Server: 104.102.35.84 Hamburg, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

expires: Fri, 07 Apr 2023 02:02:29 GMT
pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEOPi_9ou27JdRX5OQc9iwtI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame B715 23 B
172 B 141ms
47ms Image
image/gif 104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUnVjzC29rMx2H5A8Osljd4HFNUctcZeev0UjINUYnDUEx8k70lisJH0SF1R0eRwNZzwrw9bKf_HCpEy1qwvamCmdU9frmPM7gSEsk4yKeu_rTy6GRrRAEMCh6uIEGaQrFK23TXcgKNlfwVrS5gD_I6ygzwwOjoQ8uHoCP-g_jaqclJiBZEZMNiL2iVbt1R3DGSRAzT5M2JctnUxaHvdpu527LBBQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.35.84 Hamburg, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

expires: Fri, 07 Apr 2023 02:02:29 GMT
pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 0CFD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEJP0eIlGXChpySybB1X86rc&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEJP0eIlGXChpySybB1X86rc&google_cver=1&__user_check__=1&sync_id=402dd055-d4e8-11ed-be74-191344880206

43 B
548 B

32ms
31ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEJP0eIlGXChpySybB1X86rc&google_cver=1&__user_check__=1&sync_id=402dd055-d4e8-11ed-be74-191344880206
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNVT8s7OTAcVmSo41wlyaUVvZ709TWBCLUi1Jlo8lRrAE_XrGrJrySfW3bfII8Usydag_bqJENBXUozXIzd5gnNkIdlcM2y5fmVJgRpUO9ZSZ-PEeSWbGOb4F_OLgM1ROpqbMgX42F4NJT5rHfZjgPFmZ4_Md48DBWn6DyOYG8EK0yOmpAEX3wr0lDNFHKCczSWOfHkBb4DyCuccpkD_xJvCPugCNg
Protocol: HTTP/1.1
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 10
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEJP0eIlGXChpySybB1X86rc&google_cver=1&__user_check__=1&sync_id=402dd055-d4e8-11ed-be74-191344880206
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 128
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0CFD
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NDAyZGExZmEtZDRlOC0xMWVkLWEwMzEtMTU1ZGE2ZmQwMzA2

170 B
188 B

32ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NDAyZGExZmEtZDRlOC0xMWVkLWEwMzEtMTU1ZGE2ZmQwMzA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNVT8s7OTAcVmSo41wlyaUVvZ709TWBCLUi1Jlo8lRrAE_XrGrJrySfW3bfII8Usydag_bqJENBXUozXIzd5gnNkIdlcM2y5fmVJgRpUO9ZSZ-PEeSWbGOb4F_OLgM1ROpqbMgX42F4NJT5rHfZjgPFmZ4_Md48DBWn6DyOYG8EK0yOmpAEX3wr0lDNFHKCczSWOfHkBb4DyCuccpkD_xJvCPugCNg

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NDAyZGExZmEtZDRlOC0xMWVkLWEwMzEtMTU1ZGE2ZmQwMzA2
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 88
Connection: keep-alive
Content-Length: 0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame 0CFD 0
38 B 23ms
23ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

user-registering
ads.stickyadstv.com/ Frame B050
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESELyLevWpiKY4nDh5NU4vLqA&google_cver=1

43 B
691 B

191ms
44ms

Image
image/gif

2.16.238.146
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESELyLevWpiKY4nDh5NU4vLqA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWhl8yiLwaaVEFqiCAstjJK2wNCIPT5D8bytHifqPm1NeEiL-BeOGSqrpA76rESVqpssiMLGaMfTe8AJI0pafXbGZTOadVSbdRD2WobsrYK4_F7svM7dDhsKjqnsAbSrMJXRhyqi6jmMpY_nENklQheGRA_ZaX_sMQrOg1g6UisOTnLiZFW4ssRFkUEYHhrPJSy-c1QIWdv9-SYLf5H9adc_ZqLaw
Protocol: HTTP/1.1
Server: 2.16.238.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-238-146.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: nginx
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43
x-sticky-vk: 1680832948796089-534
Expires: Fri, 07 Apr 2023 02:02:29 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESELyLevWpiKY4nDh5NU4vLqA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 317
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B050
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=11
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=ZDhmMTEwZDZhZTVlZDk3MTlkMzQ0ODc2M2VhODY2NGE=&gdpr=0&gdpr_consent=

170 B
188 B

32ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=ZDhmMTEwZDZhZTVlZDk3MTlkMzQ0ODc2M2VhODY2NGE=&gdpr=0&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWhl8yiLwaaVEFqiCAstjJK2wNCIPT5D8bytHifqPm1NeEiL-BeOGSqrpA76rESVqpssiMLGaMfTe8AJI0pafXbGZTOadVSbdRD2WobsrYK4_F7svM7dDhsKjqnsAbSrMJXRhyqi6jmMpY_nENklQheGRA_ZaX_sMQrOg1g6UisOTnLiZFW4ssRFkUEYHhrPJSy-c1QIWdv9-SYLf5H9adc_ZqLaw

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=ZDhmMTEwZDZhZTVlZDk3MTlkMzQ0ODc2M2VhODY2NGE=&gdpr=0&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1680832948776088-527
Expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H2

200

/
rtb-csync.smartadserver.com/redir/ Frame B050
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEKqeLvH8GIrNLAlTDL3vE8U&google_cver=1

43 B
113 B

123ms
29ms

Image
image/gif

185.86.139.94
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEKqeLvH8GIrNLAlTDL3vE8U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWhl8yiLwaaVEFqiCAstjJK2wNCIPT5D8bytHifqPm1NeEiL-BeOGSqrpA76rESVqpssiMLGaMfTe8AJI0pafXbGZTOadVSbdRD2WobsrYK4_F7svM7dDhsKjqnsAbSrMJXRhyqi6jmMpY_nENklQheGRA_ZaX_sMQrOg1g6UisOTnLiZFW4ssRFkUEYHhrPJSy-c1QIWdv9-SYLf5H9adc_ZqLaw
Protocol: H2
Server: 185.86.139.94 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:28 GMT
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEKqeLvH8GIrNLAlTDL3vE8U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
rtb-csync.smartadserver.com/redir/ Frame B050 43 B
114 B 155ms
29ms Image
image/gif 185.86.139.94
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWhl8yiLwaaVEFqiCAstjJK2wNCIPT5D8bytHifqPm1NeEiL-BeOGSqrpA76rESVqpssiMLGaMfTe8AJI0pafXbGZTOadVSbdRD2WobsrYK4_F7svM7dDhsKjqnsAbSrMJXRhyqi6jmMpY_nENklQheGRA_ZaX_sMQrOg1g6UisOTnLiZFW4ssRFkUEYHhrPJSy-c1QIWdv9-SYLf5H9adc_ZqLaw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.94 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:28 GMT
content-type: image/gif

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
380 B 40ms
39ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: fa1019e3c103466567d2563160696c7e0546ed859f93580f8c798f11b98216d7

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: ff9faab65a826e3dbc642d0238c55d6d
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 285

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 132ms
39ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Fri, 07 Apr 2023 02:02:29 GMT
server: Google Frontend
vary: Origin
via: 1.1 google
x-cloud-trace-context: 5e9dca4291e64408c66f6850e8de6d26

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6318 0
20 B 54ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4105113233159&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6318 0
20 B 55ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4105113233159&version=m202301230201&ct=77&x=1&cor=11914685839672020000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6318 15 KB
11 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxjTMvsGcmt2J6KR7FEO_MgtTIWnhvT3pBh66_KDsaVrIeckrBuy_c-aGE54KmFvnpeIgt1lWxYclLeITNMpyNX0oFgX5ALQHHK0ID9UZVizDnDNU6sURfxGihqelQxg9t3_N4qX2RRfRpNF29-LrAuEQZCOAa0Ro4Xrj0ojLfkoj4xB0&cry=1&dbm_d=AKAmf-ABr9kBo19LeqhA4ohtAwM2sbOkBnB4bjCzA0GgYOn6UKwTBIs4Kg9-qG4i52jDag7rW2vtW-WVCaYRGlVBobxD2EmeY2VSZ2kG5x-fCqnAcfu9H5yzsHubV0ruw9UlLXllhA-NvT7wHmMx0eWL23CySeFHmvb9fErYwrqa9zsX6rQAVrpASrC_-joDUUc2hkXVzQTr9SuhHVXr5ZbeQHQRkpMWaK7tYY-n2kKs_F5tt72xeejM-KbTsTYv8_pzd12QSB_TtFYFC7XSOwl9l5ENtulhoyoEV65LT9JdyLQ4ezm205TDljYr3kinBSvfyB0CRPGQRfWSKk7DXq5xgjDUuwgUwPJfG8VsdkongUWcemmiZ4eiiCwx-N28tG_T2RIa0WfRmN_WppRR7hgFAeeeA_BYTuEc_Tw_ekXbngykl1SjLacEiDU7IfWrjtIZHAqIVwk7GcrN0lHXYDN-AgjjJA87M3F8ftEln2vUcyLu45WF6GX6jHFBfBBCj6man7HATOemiXszs8A3xQd3eDyKSO8iLOAUNLomPmMtCt4P9pcbUiqKQAFdhkbtXfHwrLwlrtvGoxd5Db1MoE2O9w9fnZYzwxuJZ5OtE8WvNl4ztv8Xaow3rUTr671ba0jAgjL8KdNtTmAi6EINbb7cRCt41LpD9WyJvuuw05AHGUGylmqgP6-jJnHZTWALDApuKCAfpBKD20d9Ud88rUklnU56AotKA977JVc0xAkDbr4i4StzfsM2V_RB9fFGPaDEIGG3V8e-89-oYUA8AVPBA-jMVVUkXMvi2OBKosfAt1rzgQj5qhyW_rEmPv5xsx4lS65qMQ9kuoOMw8QWoSuMsAN8hDnBukLqOX2UORMBzIJLuB5ZVxJ1u4jvN-09wDwiUCOAIauHi2PF-Zc5IOMfAIv19FvgpTaAmFVxpWzpfbnuNBtsxOpb10io0xl1Kv9Rx9HErHOjgpyBu1SUVNr37KFQjF3a7_Jj-KoL24OAlMnBLTMAE7n9-9EMiplBJ_3ZwLbfvjpytKVQb3nSjLr5-522BuWakR_-ITFn6z2rFi9Q959gqkmRhh9Aj8G4X6-EaRprltIT2wsk3uxAnCaLlCGPFDmAkJ5WkXNWTu4ATNsp2RLJhzZrv-hKHl7d982Am5dAO8nRMbqslt9H8SsiM3XMXpopNmiLkUcEnRCZzVnhXwniT4_BFAOs4M42_8rNZIWD4AYSp5lJEnZKEHhVlIDcsjppudfctcGWaFbEHGklxu2ig_0JyynNIi5a95XgG-wpl7Dss-MuCj-fXNYO_gnvmCf_NTpWPmfqhKdNNDucKgOn7x_LHRrT6msdlw1_7PCroNrYfIV4jJNj7V69TgeXqz-QYgZ-5fDRFSn-bD5BuDZ0ucTGzuih0rmKUDw2C6CUymqp3EcZx3zBhurca2KNP2TNh_frHdcUyjdCN5TM_ROGzrorgxbbfA8rTuBVkethP9hifeB7st1RYjgguLiUTSeyYQ-x2MElOL96fALSHy9MrhX2eF-z5hZD2r8IQG5YCrqCei2Y7Jw_VpznYAlPWqH27i-OrpgNt7h3kGAvEjosGrKkzzRa7ewcgRBVTeft_Sa7nPMPtXzvVLKYDyLUYPIhnYARNTcfUZf5bTvJtlhx5VfLgE6dsxiOOnzoKxUeR3aOfXY0R1AFAOYaVyquoWrGwgPifKcR1_EAAsNr3C-iBk9znsJA29BQZgjBAxQwyIf5ji4l1EYPZSDLg7EcTHRnmldl4JzjdKqFHcUlpGj9ZEI05vuUT0ZDICu0gR5-Nk300Nkc6W8Jk4G4UiEGrHkU9qX6bWzWn1WVq7lBOc49y5HoZkgIk_miDsW1Qj2oBEopT6n2PooLtJyaYDLnqhz2501mC894S0S30B-WDB4Ib6t_w-hodLso4hxQg3evcpS-HSGgBEZyzkSASxI1LoUqP3YixlIdzjAIeRRtnFKZ6s5vN_qwAvd_b01zxhyzPmcJYJVDKVCa5n83_Dq9-AIJxry60ksWJB1dltINeDpyHpD7UWvb3IG3oH9TIdG-NlQrAcqZXDSLRmltyOAoly-qd5wUYsAvl3x8NjFO1bMHMq50vOm5fDI2TzHfV-21APZ2fXfRKDa41qM3Zh8bUexgDV9cxLLGIxjKJOrIsazUQlbh_NWxN_jEcZvt3XPOZJH-Hi0RFTJZJ4xG2Efn7Eey7i346LRKys_6rzJvAe1HP3ZeugftlWg28a_l_lR32uAeA3o-a4SxuPVIq-AcOlGk_MukAFSwrV5tdCva1Cns3y4jRNAk9XbO6725-QdrrIiaKo-tdjzfFcgpMyFK8yAETNG3JnmCP9VyHZyLEJTNWQGzb8CU5MOsrDuFuxYpoKXLS1I5lm8_BtYyoWdQOcIumEe_CacW2m6NTq3Hh3Fq9oj3JNk2MySg_PzDZDeUOiv8GDCjxT0vvpCnTLcYPQ2etPvR2O5XB5BUbr-oOmeWtGy_K1obSW6GusuY1iUOf9FBph8IuhzRFRo7PYdFD7Bso5IbuRrrEuHAS07llkfrdpzKOWb-9mI0-oovqgPOfN6qlEiyOhWqwbDf_8vTabCdJP-gnvVZcG1RwEe1Y6rjPX5jn2ze8FyH9JyEdR3FAcOOCbS8ihlUihId9n5sSEwu5AZhbeU3H41IdUoz39TW_7TCzp0eTSU3DgPBnpeCimILXGQmt3ptk_5QMVZTF0jMkP-amsbCX4Xy8pU1Oomj4TTnSdKbkJ-rqLQC8P1SBIpjuF-DfAxxRAe3VqAX3ruS5juSRXuO5hxXNjRD9FTPnDWud_GJ8ZsIKSsYOCDYvZpw7OQoqsF1olgry_Ry18BerklbK3eevx4wN3_vFl8heN0bzZYosebf387FeT-G0nNIdVa03OJoppGjbEJ6Hk7bocy2FjXcoV65O2ZDIRoPooDYY5v8XeoTKjZtGFwdctGVv-Q5pXmcw3re36FKtg66qgSEGYeHDIfGsnY7By84GIrqi22vkKdeOwp17Wyad8Ln-mvBllNyWh5DzWPNabgCc3SEKVB_anThWzLj6cv0mCaeIGP_MPbI6Z9bnbxlN5qB6XiG3mBfdcsUuiQw6TU0D9ZgkDy9LgK98awo5AnVELvAimjw-1oLx76yoYxH9iROd5cWSABVlKGRM19U8gP5gYPZlGmQV8cOgDIdUL5d6TwP1-OJ3vDCD0o3cKkPmzjEQ_ZPYYv7Q3JR-6svDQzjeADC_3n_PQ5kF3I9R_48ksVbacPVZsakt70y_Mk11WLudasVmctiheb6FSrJi0jRFx8-Ayt13fUZumOtiBL6eKwPCB82oA7MgZnS3LEZpCnGbBYVTEqenq8ieK1Z0gtRDFE8yQAq8-UfmVgOt_jS8Vf2F2pCJD0-mrVX2r3AF4wSWr3nMTUafBCWOc0GqG8VThhCfo-wKGbwzWcm2PWVvz_RU4LIICJWsUL2sIxbptSzkWIJIv0AtSULlOtV4ew_qA&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=11914685839672020000&adk=2086295851&idt=104&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a16ebcb2f2ae0d2ca93b38669460a82825a237af5bc5bf59228501a7a9ad412

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11269
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6318 41 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxjTMvsGcmt2J6KR7FEO_MgtTIWnhvT3pBh66_KDsaVrIeckrBuy_c-aGE54KmFvnpeIgt1lWxYclLeITNMpyNX0oFgX5ALQHHK0ID9UZVizDnDNU6sURfxGihqelQxg9t3_N4qX2RRfRpNF29-LrAuEQZCOAa0Ro4Xrj0ojLfkoj4xB0&cry=1&dbm_d=AKAmf-ABr9kBo19LeqhA4ohtAwM2sbOkBnB4bjCzA0GgYOn6UKwTBIs4Kg9-qG4i52jDag7rW2vtW-WVCaYRGlVBobxD2EmeY2VSZ2kG5x-fCqnAcfu9H5yzsHubV0ruw9UlLXllhA-NvT7wHmMx0eWL23CySeFHmvb9fErYwrqa9zsX6rQAVrpASrC_-joDUUc2hkXVzQTr9SuhHVXr5ZbeQHQRkpMWaK7tYY-n2kKs_F5tt72xeejM-KbTsTYv8_pzd12QSB_TtFYFC7XSOwl9l5ENtulhoyoEV65LT9JdyLQ4ezm205TDljYr3kinBSvfyB0CRPGQRfWSKk7DXq5xgjDUuwgUwPJfG8VsdkongUWcemmiZ4eiiCwx-N28tG_T2RIa0WfRmN_WppRR7hgFAeeeA_BYTuEc_Tw_ekXbngykl1SjLacEiDU7IfWrjtIZHAqIVwk7GcrN0lHXYDN-AgjjJA87M3F8ftEln2vUcyLu45WF6GX6jHFBfBBCj6man7HATOemiXszs8A3xQd3eDyKSO8iLOAUNLomPmMtCt4P9pcbUiqKQAFdhkbtXfHwrLwlrtvGoxd5Db1MoE2O9w9fnZYzwxuJZ5OtE8WvNl4ztv8Xaow3rUTr671ba0jAgjL8KdNtTmAi6EINbb7cRCt41LpD9WyJvuuw05AHGUGylmqgP6-jJnHZTWALDApuKCAfpBKD20d9Ud88rUklnU56AotKA977JVc0xAkDbr4i4StzfsM2V_RB9fFGPaDEIGG3V8e-89-oYUA8AVPBA-jMVVUkXMvi2OBKosfAt1rzgQj5qhyW_rEmPv5xsx4lS65qMQ9kuoOMw8QWoSuMsAN8hDnBukLqOX2UORMBzIJLuB5ZVxJ1u4jvN-09wDwiUCOAIauHi2PF-Zc5IOMfAIv19FvgpTaAmFVxpWzpfbnuNBtsxOpb10io0xl1Kv9Rx9HErHOjgpyBu1SUVNr37KFQjF3a7_Jj-KoL24OAlMnBLTMAE7n9-9EMiplBJ_3ZwLbfvjpytKVQb3nSjLr5-522BuWakR_-ITFn6z2rFi9Q959gqkmRhh9Aj8G4X6-EaRprltIT2wsk3uxAnCaLlCGPFDmAkJ5WkXNWTu4ATNsp2RLJhzZrv-hKHl7d982Am5dAO8nRMbqslt9H8SsiM3XMXpopNmiLkUcEnRCZzVnhXwniT4_BFAOs4M42_8rNZIWD4AYSp5lJEnZKEHhVlIDcsjppudfctcGWaFbEHGklxu2ig_0JyynNIi5a95XgG-wpl7Dss-MuCj-fXNYO_gnvmCf_NTpWPmfqhKdNNDucKgOn7x_LHRrT6msdlw1_7PCroNrYfIV4jJNj7V69TgeXqz-QYgZ-5fDRFSn-bD5BuDZ0ucTGzuih0rmKUDw2C6CUymqp3EcZx3zBhurca2KNP2TNh_frHdcUyjdCN5TM_ROGzrorgxbbfA8rTuBVkethP9hifeB7st1RYjgguLiUTSeyYQ-x2MElOL96fALSHy9MrhX2eF-z5hZD2r8IQG5YCrqCei2Y7Jw_VpznYAlPWqH27i-OrpgNt7h3kGAvEjosGrKkzzRa7ewcgRBVTeft_Sa7nPMPtXzvVLKYDyLUYPIhnYARNTcfUZf5bTvJtlhx5VfLgE6dsxiOOnzoKxUeR3aOfXY0R1AFAOYaVyquoWrGwgPifKcR1_EAAsNr3C-iBk9znsJA29BQZgjBAxQwyIf5ji4l1EYPZSDLg7EcTHRnmldl4JzjdKqFHcUlpGj9ZEI05vuUT0ZDICu0gR5-Nk300Nkc6W8Jk4G4UiEGrHkU9qX6bWzWn1WVq7lBOc49y5HoZkgIk_miDsW1Qj2oBEopT6n2PooLtJyaYDLnqhz2501mC894S0S30B-WDB4Ib6t_w-hodLso4hxQg3evcpS-HSGgBEZyzkSASxI1LoUqP3YixlIdzjAIeRRtnFKZ6s5vN_qwAvd_b01zxhyzPmcJYJVDKVCa5n83_Dq9-AIJxry60ksWJB1dltINeDpyHpD7UWvb3IG3oH9TIdG-NlQrAcqZXDSLRmltyOAoly-qd5wUYsAvl3x8NjFO1bMHMq50vOm5fDI2TzHfV-21APZ2fXfRKDa41qM3Zh8bUexgDV9cxLLGIxjKJOrIsazUQlbh_NWxN_jEcZvt3XPOZJH-Hi0RFTJZJ4xG2Efn7Eey7i346LRKys_6rzJvAe1HP3ZeugftlWg28a_l_lR32uAeA3o-a4SxuPVIq-AcOlGk_MukAFSwrV5tdCva1Cns3y4jRNAk9XbO6725-QdrrIiaKo-tdjzfFcgpMyFK8yAETNG3JnmCP9VyHZyLEJTNWQGzb8CU5MOsrDuFuxYpoKXLS1I5lm8_BtYyoWdQOcIumEe_CacW2m6NTq3Hh3Fq9oj3JNk2MySg_PzDZDeUOiv8GDCjxT0vvpCnTLcYPQ2etPvR2O5XB5BUbr-oOmeWtGy_K1obSW6GusuY1iUOf9FBph8IuhzRFRo7PYdFD7Bso5IbuRrrEuHAS07llkfrdpzKOWb-9mI0-oovqgPOfN6qlEiyOhWqwbDf_8vTabCdJP-gnvVZcG1RwEe1Y6rjPX5jn2ze8FyH9JyEdR3FAcOOCbS8ihlUihId9n5sSEwu5AZhbeU3H41IdUoz39TW_7TCzp0eTSU3DgPBnpeCimILXGQmt3ptk_5QMVZTF0jMkP-amsbCX4Xy8pU1Oomj4TTnSdKbkJ-rqLQC8P1SBIpjuF-DfAxxRAe3VqAX3ruS5juSRXuO5hxXNjRD9FTPnDWud_GJ8ZsIKSsYOCDYvZpw7OQoqsF1olgry_Ry18BerklbK3eevx4wN3_vFl8heN0bzZYosebf387FeT-G0nNIdVa03OJoppGjbEJ6Hk7bocy2FjXcoV65O2ZDIRoPooDYY5v8XeoTKjZtGFwdctGVv-Q5pXmcw3re36FKtg66qgSEGYeHDIfGsnY7By84GIrqi22vkKdeOwp17Wyad8Ln-mvBllNyWh5DzWPNabgCc3SEKVB_anThWzLj6cv0mCaeIGP_MPbI6Z9bnbxlN5qB6XiG3mBfdcsUuiQw6TU0D9ZgkDy9LgK98awo5AnVELvAimjw-1oLx76yoYxH9iROd5cWSABVlKGRM19U8gP5gYPZlGmQV8cOgDIdUL5d6TwP1-OJ3vDCD0o3cKkPmzjEQ_ZPYYv7Q3JR-6svDQzjeADC_3n_PQ5kF3I9R_48ksVbacPVZsakt70y_Mk11WLudasVmctiheb6FSrJi0jRFx8-Ayt13fUZumOtiBL6eKwPCB82oA7MgZnS3LEZpCnGbBYVTEqenq8ieK1Z0gtRDFE8yQAq8-UfmVgOt_jS8Vf2F2pCJD0-mrVX2r3AF4wSWr3nMTUafBCWOc0GqG8VThhCfo-wKGbwzWcm2PWVvz_RU4LIICJWsUL2sIxbptSzkWIJIv0AtSULlOtV4ew_qA&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=11914685839672020000&adk=2086295851&idt=104&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 18:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Apr 2024 18:11:20 GMT

GET
H/1.1 200
OK vjdy8w6hewcq Show response
hal9000.redintelligence.net/zone/ Frame 6318 11 KB
4 KB 106ms
30ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/vjdy8w6hewcq?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbzv7tHkvZMzrH9ih7_UPxa6GiAWm5b2gaZWTnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTbAU_QBCl9qNbaLYwMZRpBvv58ZCaqBs2MJZ9lCZeUHDphiUBOgKegh_AMAoSQG5O8M6Hdz3aEXefQCbiAJ_zAa9Ax_GruH0vuUx8jLjdlRAzfavHfKQpwHoj3E4tdcYGT9ryln2bDY6jlbEHVf5kVxIvyUvgxzY4LFMGs0JleKHz4LctAgd3QKBPwH5nCt58SdKEZ4MyRI9QHtr4rLpEoIbQI6Z7-6bAuRXlPvduRxmpwUHf1h2PfKLKvXvfhp7fpG_FkwART9IDjX-YZwE2QXPwCpD9jA_hp8v1_0cAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3PJXkXxRPfX-sAICG2cXkaFC98Og%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DKfGuOEtm4TFY58-yJPig6DtB2ZXBvOFGO3n6sVyLWmV2LXQRLpnwjdJMI5IihnsbRBkdjtipc0WVa6jIAJIJXOphrdjHff3SC8B3fVBU29qELTWSKQILvH8JpnfwD7lCiqyAS6diz4qp5tKkD57ylqEehlhIKUnHpMECMNEhxObG9_Hs%26cry%3D1%26dbm_d%3DAKAmf-AymG3_uizAn7GiBCQWVHr6wma8RsK7KlHnaFtGB7lkFDTVU2gl3YKAghSjC1jgnck74_3IH-c1NvPpwjQPCdJCiU1nE4H55nUWWiqc78eT6sV5IsPG5k2-Y7rMO8F4W5W3b_vkK5dAP6xID3bJjPBxzF3b1PH7mNuepQSTZ37_3l61kAlDnsfomUYu4flTNlzYJWeacz_aI7Ti-FMKr4M5wRV0EmbuqKdNiiIkiFFUZ0C_do8ftnoQgBZolbkg8yy_Vd5cYcpT4iQTGUwR4_Iq-bwKzWIe0vL4nywuyZ2TBwyHveMnf5b_T2g74r2vXPpV4c3hcp9u7zHqso4f9XIIwRPndLtGNNzMHhSt_zGNxnbzzSqXHZFAapPyPV8PjhrtS1gBAy1uwePYdFFIRkjUydeS5_WvkupGCwSUdQEHS2Ki20HaSytXZTKHgsrWegFwf0JZ99ToqCu3nhympyG5HGdFki7yvYtHI6u_aMQAPRvYzfRUM5ON7MM_cTOBsT6WNoA7RnpmeAeLllYA2CZiuPFbbRJK-D5gBCtrMGk6cxFRZzL69BOemd2U43wQAbqwS6B71VvaTOFtALrG8mqmOaXirA%26adurl%3D
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 73aa6b63199704a10e56f43839315ec529e9fdb537d6977e7d1003dc0f89b237

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4089
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E15F 0
20 B 56ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9421351648290&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E15F 0
20 B 54ms
53ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9421351648290&version=m202301230201&ct=77&x=1&cor=1326364446201457400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E15F 15 KB
11 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CjaL9SnQAWp7s3ZD2hElevynUI7d_hTk4yn4OcX5QL3bJ8SpVVdtiLt3tFei-X00KwMHu2XLLMryY_Q--VnZ4REmISlOyjhC_gVkfiGUSI9wr66hPhQL5eV_2lxq2SIUfMnw49pb6A64DIqu9-xsO1wga_b8QrjfB-sGBUKKtY_y2Kkq8&cry=1&dbm_d=AKAmf-DvaepOLHx0DtEJiLEL2ckICPGqeQRM-MZ5joNshkYuzLMP4zGKSfLCpE716cKTlJhH0BrEMylOXGFkmY9SpqlbNPNqQZKNjtw0oscGPg-eLsSJ3RgGok__bON2_dkf3GBpZcOR-MFwRBFxDoDNYr9fHvyGvojgXw6fAjyQDAHypI3re1tOJqSy1Px7_NOBEC508S-cw8yQUTiiJcpvcWeSHgvLDHq2WihulEZeUeYbzzZLZ4Zqbtg0UkL-jikbr9wP09--czfqP2HzAIGpkaM_H0Gh4mFCBiRDwbq4JctMB-hP7CKYZAFQ1ZobBeqIWWcycM7telcuRSCNQAaB6c6YzToKCCqdNJWVDBg7dOydNwNxwEMyfahO6dArYRk9YbT1NKhoEX7NbjwmI-v-BbBeNlhd_FMC491rz06PFowoysLXqsYaGmYvkv8jmgoOu1A5TFC-fJb0-9Cw3UZimbHxNaM5IIpqFlKhVrVSANuCC2YipcfbrO0yWFZ1Xk378R2uQpwpM08B1gG9Ee6UQXThOLqGYWFjyB1JEynx8NWzuQY75PWvB9yaRCREH3KqlAk19ZpXo04W39Fuv_O83G3Tflkmkr7GLkkPMBZyW21e_2gbulYOEv7AMVJnZpQBlDVnHyujUapSR9yoqberP04yY5iyQ84JQejB2Y4AeJvA6v3ENCARIr6oHWJXyu8QgeXhKqtw1x-89vFEjeHqHrOZR4_dgCKebNsYjbsH_lIqj822DiYSnLEITPoFE2WkyadMX3PPIsB1jO2kKhjCRha3hCeTKlpOTmLLCnEPnrFyMNAHmbOcsJ2QsuQm7_MmXajT1_5To5_tELsQVqg4RURzly1oH0DlZpO9lNhndxHKJutJIELyDK25h5IFt-lAzl5wf4cVKmTymcb424Xdi86dLm4Ipo-954fb4Yn71c8T95zdnZQfC7L40BVbZcXNeK6iZwFrO-TDQL5h8ZiJ_5NtFTcJlXC-hCo5RSSuRSP2kl77JhzGqiAT6rJ5PbogwDqBz9YFnVvypwHu7gXI_VerbYFrsBuZjqxxLFV9FgJuGgGsn51OmSC8YeaK4xRajRoeygblm4-asFyZLR3ZxNkLyiIW6k9BCLm0KlCHedT8nWPooZwid8EwyhE-YLgyD9x3KVsb94mEDCbj5nMYDeHDhZS7PkJN_oaFzfIfVvleA7JNZNGqWaTSCIcwE3OScXF-zyYk3DpMA6caEzRnR5qlcppRoOj2v7jKWv-dz9pMl00sKt1MiHv04JjGNgjJJzMlUaflDisiTIc6kL0zKEp8qt5s_hCDbUCCh9VqYfcLzcEll1CBhSUU-tuDPdZ7frx0WVY6C43xNEcGz2a_Dl9_rV29hNL304z7rblFKZ9P4s5qOk3wU8UfFg8uuJn1g5bUh8DzQVfKgO-qMqRhntDgVwXlXU8Y4QjijRJl5tbCfM9mx0TagjqMxXQsNp0Xrr4o8g_u336-eO_mKPlXv7hj0glaTDR4X6HPhuBA-IkLMMxumH4IAX7MaNJQUK45gSa5Yn_6-yx5XpwRhXiDh_7QvA2OQTw_dIQYfKKyi5L7g80nGJ6ui03AKQVK7fEqp9z0xt66fMmjlGZ7IualuqDVeqF3hdPpOMOrs4KjdZMqQz6krWOHD301C_4MmisIh6RxKcJwaCeQeMQDe5uMFGnESfOV1pCjq0b0n13_gD62wRVySSXQ7izTedgPN-w3OVW3UPaxrjN9HuEuv-g23LQtE4ONtiUtJi9iHzbeFp8rAPjf8BzqXx4G0QWfAspn_LQnZ_wfG6zMfzh84zEda04dkSv0xuI0k2AhBAlj9sIvmwS2FPjB-O4sSc54idnUQss6XVfI-XRIywjVOrJi4NIxII_LpJEdxg2AS8XlrPNoug0jdl59pWDzk1W1F8Udsgx5iFiy7hKooQYzQct95dyyrQIU0PwT_vAWLFJTsbnjdPboPuaLgsU_ZzCFXarA9Kf-EniVhJ43QLIkBzpiLyPLbzBDBW6BsfjdF11KGfytEgdKpZCGWX18G-koklADY9TkkdmpB5qiM4x0itN32QMIkDl1eW8bM5v8HdtOpWNWvxBQb1mRLNWUMfiGytBZzkUFmfgl9bzn5SlA3d9TgzuWLBkwpqh436MXBnTOcqXPKqjqZyC579PIx6CdDI_uKz1v2lvlaXGWzsajGIRboN4kilA7D-2YutgiSAvfQO8vOE8EY9FSXmSP0J-uWpje3S8BM2dCcEwehXHkEVxNKC_uzowzhYcTEqadQLtq2mZThUnMJxhdJ3v-wClsXTsVZQJAFpXYKRQKivHfWZcW4uaEA9nIMT_M1uDsNZL9UBgl7RzmxyWj9we--yh4N38lU94OF2eN7WaVMbKBwF_2052GqsXScxCpq9o6zonRDF2N3YjpAXpkChnFMRN4S-UDbYjNnpc0WlxbC6F02_FsV4QMRH4bG156Qg2IqZkafS55MJ1WhHdsf7awNA_ANOxwxJ6FACWodQ32DCl4UY_6Jhmx-7l01ZFSBoExI2SWGnjUilEK3SCUvah_zvuD4B0TZJloFkzpgNikh2TqgZOihebRThazRzgxiNVPvSymLYkfVxwKRQx-O7uF4yTqgWGAj45xZfXSbsECFcb7sXTwv45Rkk2Vk2f9uUO97y5bKoaZiNnD3hBq3-grTGjoDo3YhYPaESgVhym59VLOdu3nQ5BmXI72JURBCng5CAWHEUWP7EPCYaFkOJ0iiYws-N9A6WmGB5-SWIh6fFCeIMTlNhQfeJCgiRus2O82iXvumQVoSWxDQ-Qv3sV0bjhgrq4seUbv-y-5sCUFwfwg1QgEKJNuKkMaZJbKaqWf9R4BsXrwS4bevUTh9bByH23Mpnb8Lyvttwnb1JkLymcCIqZabiHtDKAOf2YN-qZdXEK4YcZgpGtdm_UPYPq8VdEmNmVk8GSrEYA2vldPWIGYzN9kovpGXEYOi-GGhbO8cv-eeVRnLo4tHzCae4VCEioYGpYwK93HbFS0vtE71ZOEZna7d90MLeg0mdMe98DRQ8OLONX9MH11Klz8aiAHnQew8cvTp76S76zL8jnJtO6V8Hh1c7wsDJF3Ziv-bnU4YgdHZjNvzx80n5G-3TTzGFrRAOu9BmsaiNc5-T2nwI6MFZ-OplviI0ucF72LfLnSo60XfStQraC4biXTY0iZdsZrXAuwUrg15hE6WAuWk7sVgjKhIwwXDaQKkGR42p8g40WPC_Hg1wT1dj8AFrQyLug4jueBwqRXp0IrjA9Pn0Nf3gkEfWEXrfshO_qaZbjSfDyvxDY3NQhlQeDxmEHPNAeDKDEjMrDiLiSD4Ebb43G5HEguftI5nMDykuGFvxj9s8biYg1DDf9_B5gqkQ5uP-rRmLBCYumTGQ1EwivXa6WJ_WCuFU-Ta5wzlB0Dzm3D0obZEVRo_XoxXlUKSSUcwBxJKgmYupafHBsOoOLx2-zizKUEiYR2iipgvg&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=1326364446201457400&adk=3690638929&idt=156&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cfc105583076ba3c29354245ec73a100921ce33917f42c95e9f012c5dafb46d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7091 0
20 B 54ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7408604831152&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7091 0
20 B 54ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7408604831152&version=m202301230201&ct=77&x=1&cor=18013588274607501000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7091 15 KB
11 KB 64ms
63ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CWAGf_PvPLV99oQ18oEswXnceoeVHQL-QMwYnZEDhcdCgW3fyLcEmnQd7RwEGR10aiAi1T5EZNcv4vqNZZMUTZDGDQEv0g8cUNTcnNdWed1XrtmApecUn9h34r8hlKQo3sXmPU-pI0myPaZl9Piz27oFUDfdFHCt3Aiv_KSvpgPLy9iAU&cry=1&dbm_d=AKAmf-DSYInI9G4jwHafEDxD04W56y81qrEpyirv7MVqrqWwFq-ClhnlhJ-uDEp2lo5RlNbMGoi9QnPKETQbcbLEJCW6bPisFXaX69rUymAKBz6Kimy6zHFul7V6sLHOizPAuwCvXOHlvqOoK4nXmU2WJpYIWWYFdXq50LTPANLQHMd0klPaYSS7hlAIHMfqNCMIfxeKDqKhDYP4jpazhRa43nrdT4CmFwDby8o7txoOfKfTgdUh22z2kQQSiVNbosaqR5jH4vZ-AxD_5tyIZUxw2c7h2NVKCqQvLIbpBbKh3ApDP8oPmd04ay8MXVX1rHdTvNDgCwjnpDUZ7HimljNMDa-STAP7nGkiVHKftQXsr4-NL6L9MNjnuns6h7fxzQ6mQs34a-JUPnt9B6jiLgHFdGlKFzPpLlYEGtyVinl0bVs9S3omTSvJ6Wlyu2Mim_DcJHZzqn9alqmFu7xnmg52eNBnMjsbag05vZE9TiUSnpda7YkJuhg_2cAk3zAmqV-mL6QUNFJ4sTSz0OgU2YpnrPfY1q7vNnwb3aLA1s6N7RUJceWZVN6MA47KkvA4RkRHQaBSeS4IoCfalMQAdQv8s1IDoQ4Q06h37lxhlzt1dJlnw8N9kyNo_XzDyU81XNyU0PYR1DA_VLRGCf6KgCGp-Hl5hS3kPp8zCJOkse0fuqvHwJx9briHaV_mC0sw57lTb1-Si5sV-y_t7t4XzhEQqWsnfrnzdUldZCQwHCvcW9Rvn4QSEvU02RNm5Ppo7MNHQxWPr0RqumAhy9I_S-qdyFUquhv0K_uRgVeQ9zNvXIJigvIiJj2hbqhqGSURjNd7FbJYYblysVIMuI-A_rTFWNu39lfTMNsnTkXr9zD_SS2fqA8PFs6Dm4zWg8bBlleUJWuPgKLP_didrnpCiM1z9sQgBFgd11bU7-HFhkXTW9ZMPoea-2JjG4eWcMQhkyK0yorRi2bEab5oFpxyVTdEn8fr3j5EK8C2VyZdae3rRbSfVMZQ4PGLmZ_QdRkoj3wE5f3_1LYOvxiajJbN3dyOIVHPpdTSaDLIL-hstbW7vejj29sHV3WNjdy-r_NbFFWu5qfTR3Va8FahsXiPEeFfTXk60FUD9B4fhouvoaiigpk49gr3QF76r8jmnaUj5jVAMkDiASVOI-07uMcaX5w7WbO3lP96oor1uj3HunGPdpuSaZ0uO1V5naymurM9PdLr9LfYZGuX46nrg1grfQCaj8Bl2wf1gM8pb30gIi0raJFMdX_lYvHfZqRT1HIAf86KYyxf6BfCl5bGpynC75L3jIGKT8ehk5knVC3sSxB4kT4r3Hfw-4V3y7iAWfaLmEUm3imBxVoL1WwSULuSk9TCy6oGfXj98acAuipVmwzrSBKREb7Bb8XFtg0Ga6ljBKW4RX3EL9m_5RQE8OlaJeiLTwO06XopQ2iiyX1sQnqeoa2v4a83_741fV3zxUkyJQ0VkIDtF4hrDWy16JFBveNJXX4Mie68HwgRc82wfyg-3a_nvEhC7q72HA3_Q4jxfaqEx6PFXOWtBK4w825Ayoy0HfFnAVK8b06gULnFV_ZzxCD3QypqdZCEof3IEzjcz5VuEBbYiSU2mZbWeCOnTMORHAhace_w4CjLODl2XgoalLRbcU1Jn4CnswjbnT7ZYo5-5zcJuavv_zDhGisfGktpuMCjC77bdFVgtbWiMeRN6Wg-oeN1ErRQ-GWtrKDfWIrxMztUD_9KB_rfpqh-yy6W9g95g9fcDJzDvOO3voMtM_XP7T1MOkPN5QY19eOoGwQWEI0WFJevTZxVEU4oYUwVc4qxOiqe8EO3_cn-YPk7CLGbNPkYZ_Teo2VB-qGYGaNn1CWd7U8D1ebWWePn2HMlv5UNgmi3Pn5qAkcN_BhPRXSp5tP0rQIoILaLBufMdKgantGKhqsOxPo7r9yYKEoNTZrA3v-NLowtRyu7cBGsrLIsemZn5RtmL93rNHTEawEDxQA-TvZIYdm05OzCSpzMqcgR4S_opL1YXc7PJYyb2bnanKGFZq0RoK82VWsLa2SYdd1Cy-syBPb5sDY6cJu7uJA9ggy5ne_0TUlrQddAOr0Zg2m1aK8V6FTmJcku1X2SriTDcRI1VVHo5r-NL8UqE31687hknaqvj-7paWl915N7-GLAItehsFHmTk-SbqfWHt3qapCIwKZLP_DFSriJgzHOkj7QhaZrAD9YY46Q-VklzzjaIOJG4EH0XM-5aaNRAzQYxr1C-B0LRsYSKdeWYvt79QjQ1VsEya-mcyr6Dy6PETKm1fQTd1Uq3_UcIZc0Tf16B12hTlWnQpCOUPJaj5a1_ZSXVDuu5_4eksJMdrwqpugovymAtGw2cf6Xw-teW4wv3eQgYDKRFnHNbiQMkJeWIbgMAfv-TE7K4jwH56klyg-f7NlZBVg9HKbGHSYqxSQTZateQyAhwXflOX3rnBAlFJ7svGEXChPQrERxxGLO4AhKv_qLPJZpifEgie8OvLbySRBQbFHZzGB24sb8n2tQfxnfFd-y1fTuzWtHnt5dV2fkeaDHRaJV-eIvQ7JJi-V-Ua3LAffKZxkp9lq5Kj94io-8pi69A9twFcnN7QQZ7zHVWauLk4NGLyV872qIzRJaCTMHYtv770-AmN29f3ekZmP6rvOXuZJv5zwKMYqdGkTmOkjHVtVKOgKlkOenbcsS8EHiLMY849iKhY8ka6K2U7QaSjlJlhD95XlEZDE375Oep3bHRxtXwZa9CDt9Z29ewrEWtN0DjolTK1VzdxI-uwZJyyWFK-lGAPPLflNSbEhBHYr7LZgvtTU47NTEoTbslIY-cB1WQ-qoADxRyXTK5o86BK6bJqJ9vJ_PaFvEiXBlpfsSoxQNgQtwlx-Infgv-N7o3hC9ZhcVy5-fEcJF-stQ-HN93iOzuEykGyy8lv_Wn0kBhH2oEV_0vjAUAhcZSzkTrK9zN0gaNmKUwkdX2Nx6mAjWOfPUE5gjb_Cft4DCJGSnw7fnA7hvdG9Il-SBcJUbPaStdyay4_rozomF65Jn9i6dmq5mehIbx2-dWdBJZapwioh13H1BkUi0fs3a17bJoTj3QoEeRew5mr5Sow1c_luxHoZn_CJTeDgNkIUuff-W-y7fJaBh0AuxVQhsFUsFTwF_GwN9JXTXLBqlNmLbtC6mia19ks88_bGhJ1tqptFf83k_r0VmWnutU8DX9dHu6RQPOnZSUJ2In6CzMwT08SJI6aI6fg3wZUOb80AiDc1Q_4AYL8pzNBXYeBn6gC25CH6HtlS2VsBmiZuBBFLIMRQZ5QVnLPFLXZ3OvKU3jePX_cDRc-XIlAfEAiK9H8VoBOSTpjCAr7A2lNPhrNyrCQ1h_WCreUmlsNzLN4zSsT66o6TdK007Xgqg3gB_Ok7L_5NAY3idxEZ9Sfe714PAlTknjDWUFUM3od4jODq_gBzmrUybun5JSWFTS7192RlGM-Z7YJfQqrZtvYgDi6GCL8e73eaTmeJC8oL3uo8VyF0&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=18013588274607501000&adk=943508955&idt=167&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b6bf6caf290fd5cf52d28aa8cddb081701373bcef9bf7e39747cd3d9786cac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11443
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5F0E 0
20 B 54ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1967412048599&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5F0E 0
20 B 53ms
53ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1967412048599&version=m202301230201&ct=77&x=1&cor=5822999043167644000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5F0E 15 KB
11 KB 88ms
88ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AQh_GBXdPfPH4_wDwKJI7lkmpCKCbWgq5OWPNbVwSyvz42HraQO8H0H3qLhL8FStc_gADKzIERLtpJk6BFdoKPxLPMxGGekr9hbp3GXrS0hFLT9M-NOBd-XlIYW-p3VdslMbKMjLio1kuNZaJ2jiEah2qYymrlbpicCqZKoRXLso2gNIM&cry=1&dbm_d=AKAmf-D3jjX5J121n6hRK9eFCAbQRKg8yFhJml13pkV91OnQHCCQPRECE1b8Uxy3BPF1TbNlYaXvF0mvpeglW0dp1lllO-pIkQQXKC_JgrGicUwzPzsZsZ-4NMu5GzagH9UPLp3pgb5SCsuojrRynlMZqAesSciOISLbCJWs_KhCZgnFYwvCwNDXWRZfCVRajk1TTGL9Iwot5nQ_fm3_9CTW21hnFv-AJ_nVrSwpsPvK2I9CSaEBS_LhiTLQSNa2y8KSUX6EfLn7Z_SwoGFMqbTc5bYwCr8Ba_-ntdKD8kDWb31KzbDtfwlSRVtk1ENQkS2bvVnAMv4xczu3kodJCqozURnz_jWz9bC9i6nSZM3H5pT61nNsjVk08xJl5IjGjgP7uuRtquF3X1iUS7afBTaY4DBNLNFx8oFWAgUseIM8XvUskNEsfXNldq11Ni2DCDJe_X8gsEN_EN1Tm5THu4mzUgWm5NMEgfkY919dOB24tFsfSWPbEhgGM60-cHGS_Nsjq4SZCuCTOYxI4qGO7FFAp6iiH7asIe79PU0TXKCG74iot30qSZ1siDIzmJ4BRUmZevmYHfdkUvMzJWecr20kNzmLXmXF6MkrbR639SXhfatiIDTGJko3qHRN3sVkAIX7lgkLaR3Ojlfma9H91NlwqLmkVnSJKs0NGPytI7Tt45MeL96i9ZrEntuEvOo2fthW8hWypz2QUItlis-DcHZ1i8hfbOHd5D6ZcfjJneCkOybG-A0DR5Dpw8ZiWVmIkyF9DWjeja438xcTZaDVNVjEGlgU9qsSgMZg9d3iBYy_kfuRxRx2BXQ9u2yN1ek5CCuvGlq6D-BOEdPQWmBsfW96uZzYJITmLIGGbbKCKvf_jn4-bNK0NpVdom2e1aZcFzyI-5EDr4hqHOMEIoduE4tp0nvBTAmpUIGKyJK9AQBBM8Mn7Ei6nKmE512Pl3l2c01uy7-ddpFEAzwnI5u3zq4YONh-BFPNPkWSPH-FzKLN3ArHCvZxc5hbIxEyZBfdMDhCG10ThqQkZSDvtKNxkWcUROsgiEWauGny2eViwVg2HBKsgIGSsvgHB2SHXhhHf--j_fmodKhQOl28MmkUlt0sx2e-vcJOeAlVBs_tSH3_1Xj56SrQNYTZy71jkGzqacq8avUlrGsgF1lOwHtsBZKYGq1L1SRHI4_AOcQO_yo-NitxCyijjEd7SThLOa8KLi2WIVNPyKwPx1ar3DNomgcdVI_Oi5yBMn-pCLgV4WUojHu3Obg_VGVsI32v54iIfY_qm2l3XKYxxPF_2dyuwrgIz6WKa55i1qKYREwN4fmFlg1_nbTiSok0VhlcAibyxOvIZagx2J6Xy9AEkY2mU6M2sHNUAiVz8Lac0AwG9bCUsIbo7dWZ1FwFrmpZLHmvN-A4tYA7hnnGFg0iaY700nZyxAzf1eQJrHgg_SyI0j8fhqSr9ZiI8cjOg5OzXdmphnLQKAUAMRWfE7P3nMk07Hzy0zBAAwnvf-RW7vG1jvWT76DsuH82UoyTG9fllG6kxrSuSZCGn5WWMBDFPFrNVwedjtSG2rmeNP1cwObktAO4x8oulOb8j9CuIVcUFflHazrSEu9Vpp9HHcMORoZxlB-e37oNVqJn97TNO3SRORKqKIqBoOZakyOJgECB4RAtq_MOeXJbu6wHODulAkoGTHNy89mPyLA8aKduYhgLwCkW7-eGuWcVw7o4lFaWCE12H5Eich8qgserrCDwZtrCSj6BqriunElAfz_PRYHjejfUhyzccV31HqKrqpYSOl70J0GiMgZpDr-s4P-4M0RDLZ-_fujLHNFpOdXUbLVes3A_Yg3pWcZrtRje2zApuPjlx6S70zHhnvrEXYgZd6B6Ap9S0FjJ9fXW6IN23gTeWwFs5AXxIyqye-t3BjJ9YSFR2Avq_2N3iwYmrKP3n1zMk3vdUdH1yI6dkB8Y5cigHYMUs_fvJ9dZB7v1E-qxMIRm2wKepalEQmGqLkljOLljc0v5KLAVqi-IWeAQznTVNKojy_Rll_ESiGVYyNovMz-45OAgK04l3uRsZVpl-5dC_2e4sLlJ46oOW3243dBP5uKRnvOLwCt-wGRaIBIvxAkcmN-POcY2WBjg9_A2u5p8iIIflUCR1YUFMUME2stJBQujC4tHFjxvPjk4ipRQAcL5-4NILNaiOzSplzmFGRQVtg0rlM-cOTK9aoFerioerOQgGgxtlsFZHQ2daDiT0AfDmbZib8yWG8FTF0oKDdya5C1Var3l96W3QOTkm8bPmXKdMd5TmxHVrBQUegxCCOzHbWjTqlxo0socAs3iDbUi5w9rSJHgdeT2gPhqRzaX6OhOiL_w0VGTCzNacxupR1VuOsS9N3zlePYwZMtQTyyUzBAceXy4aBxNRME20gE8kLfY8FqxIZkxhFYVufSuBjT5AaTYEGeNLVzmR_MzbViISjxnCNd7H2auLSKwou3quEay58AHyShAS1yenf4pspotNzFiDti8DB8eNudbf379XB7AbKC2T8tohqmxtpM0F3Q5rNavy4XZ76JsB9n905APX0u8Sxi8pNwDZyiSn3zW9yoE7pcjz5b8TlK3-loqZVLz6JKCumrHFmIov10I9jZR8KSOBeIZCsOf_RRYmrlPZtSyFzbraVy9GqFFBiv4DfG2YUTzIytw5Kl60Po68ug6Azhfnm7UtRuQpoTuEjPDC2CjuiL03qpOD2r3io3VLQUvJ4wDFetSz-7EBd188c4WpQGBHYdaYhpIbCFaZTBn3vgt5K-Hvqf3VAzVEVOXbUms-h0io9weMjl1dj_KGvNXsDkV_i7_CTlG69KG_nTp6QTxS_GTolIH8bA4XhoJ4OGIDnQAKFsJlia1eHc4ZMeveKzYVeg4xBBRlRwkpmUP8C3cbolOuDdoDFt22BFoJ6nDc1Tv01dX-gXVPgMLgwLkallejHVgKmRmeiRK_usJB55joa1cJlColqG790tMcld5FC_P7RkZELL5J11RV74-QYRE-VN2cWcsmNxzBNQkz3zj-8qn_orjZOrtjCJtyvdiaCvasEBHkhDk_0L9RWVto2AxC8CW7PwKlrztPPAS6nJFPqnnBKinM31I5_UQahFK5_YHOHGZpJTs6CGRUT1Rj2-MUUqDp98q9DFVAlsDK6lRNO84qwOuq0PvN6jN-RLoBCgihFKYgg-qzHQJdymSm2TgWuwfNLG8WQautLomVvN4Pl32xBRm_ievo1iaWdqPmpnYB557CeFJBORohN7iDq-nLWBmO9cVdqec3tItqLQ-YmwFUDkECNUe_RbA5RxJPALUTrHvlAItXkoDtXBmcG6Nrcprd9KyFgn_8mkr5BnQ7587e6futX94V0mUlHclnAdmyYsH77B5b1QfF8nOVArRC6l66FzDeK6FUG3u7QyOOqI4cWtkl0upWxr8_tMmgrADG_cF680nlYlb5zJDYOsVYQQbtVWYofYPyXutKOOurNju62Mqrf3zGU-aaHlrS5tu4UkWiOY&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=5822999043167644000&adk=3944675600&idt=174&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63e62081bd63e9836a16860cbe82a57d3e20288861cf0a84203799360ab2114d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11486
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BD20 22 KB
8 KB 21ms
21ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
expires: Fri, 05 Apr 2024 09:37:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js Show response
pagead2.googlesyndication.com/bg/ Frame BD20 36 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

786addb7e1ae880b2d60304114f4651dedfaaaee2e9209d8e8fe9e2a314168db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 10:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55441
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14213
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 13:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 05 Apr 2024 10:38:28 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E15F 41 KB
15 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CjaL9SnQAWp7s3ZD2hElevynUI7d_hTk4yn4OcX5QL3bJ8SpVVdtiLt3tFei-X00KwMHu2XLLMryY_Q--VnZ4REmISlOyjhC_gVkfiGUSI9wr66hPhQL5eV_2lxq2SIUfMnw49pb6A64DIqu9-xsO1wga_b8QrjfB-sGBUKKtY_y2Kkq8&cry=1&dbm_d=AKAmf-DvaepOLHx0DtEJiLEL2ckICPGqeQRM-MZ5joNshkYuzLMP4zGKSfLCpE716cKTlJhH0BrEMylOXGFkmY9SpqlbNPNqQZKNjtw0oscGPg-eLsSJ3RgGok__bON2_dkf3GBpZcOR-MFwRBFxDoDNYr9fHvyGvojgXw6fAjyQDAHypI3re1tOJqSy1Px7_NOBEC508S-cw8yQUTiiJcpvcWeSHgvLDHq2WihulEZeUeYbzzZLZ4Zqbtg0UkL-jikbr9wP09--czfqP2HzAIGpkaM_H0Gh4mFCBiRDwbq4JctMB-hP7CKYZAFQ1ZobBeqIWWcycM7telcuRSCNQAaB6c6YzToKCCqdNJWVDBg7dOydNwNxwEMyfahO6dArYRk9YbT1NKhoEX7NbjwmI-v-BbBeNlhd_FMC491rz06PFowoysLXqsYaGmYvkv8jmgoOu1A5TFC-fJb0-9Cw3UZimbHxNaM5IIpqFlKhVrVSANuCC2YipcfbrO0yWFZ1Xk378R2uQpwpM08B1gG9Ee6UQXThOLqGYWFjyB1JEynx8NWzuQY75PWvB9yaRCREH3KqlAk19ZpXo04W39Fuv_O83G3Tflkmkr7GLkkPMBZyW21e_2gbulYOEv7AMVJnZpQBlDVnHyujUapSR9yoqberP04yY5iyQ84JQejB2Y4AeJvA6v3ENCARIr6oHWJXyu8QgeXhKqtw1x-89vFEjeHqHrOZR4_dgCKebNsYjbsH_lIqj822DiYSnLEITPoFE2WkyadMX3PPIsB1jO2kKhjCRha3hCeTKlpOTmLLCnEPnrFyMNAHmbOcsJ2QsuQm7_MmXajT1_5To5_tELsQVqg4RURzly1oH0DlZpO9lNhndxHKJutJIELyDK25h5IFt-lAzl5wf4cVKmTymcb424Xdi86dLm4Ipo-954fb4Yn71c8T95zdnZQfC7L40BVbZcXNeK6iZwFrO-TDQL5h8ZiJ_5NtFTcJlXC-hCo5RSSuRSP2kl77JhzGqiAT6rJ5PbogwDqBz9YFnVvypwHu7gXI_VerbYFrsBuZjqxxLFV9FgJuGgGsn51OmSC8YeaK4xRajRoeygblm4-asFyZLR3ZxNkLyiIW6k9BCLm0KlCHedT8nWPooZwid8EwyhE-YLgyD9x3KVsb94mEDCbj5nMYDeHDhZS7PkJN_oaFzfIfVvleA7JNZNGqWaTSCIcwE3OScXF-zyYk3DpMA6caEzRnR5qlcppRoOj2v7jKWv-dz9pMl00sKt1MiHv04JjGNgjJJzMlUaflDisiTIc6kL0zKEp8qt5s_hCDbUCCh9VqYfcLzcEll1CBhSUU-tuDPdZ7frx0WVY6C43xNEcGz2a_Dl9_rV29hNL304z7rblFKZ9P4s5qOk3wU8UfFg8uuJn1g5bUh8DzQVfKgO-qMqRhntDgVwXlXU8Y4QjijRJl5tbCfM9mx0TagjqMxXQsNp0Xrr4o8g_u336-eO_mKPlXv7hj0glaTDR4X6HPhuBA-IkLMMxumH4IAX7MaNJQUK45gSa5Yn_6-yx5XpwRhXiDh_7QvA2OQTw_dIQYfKKyi5L7g80nGJ6ui03AKQVK7fEqp9z0xt66fMmjlGZ7IualuqDVeqF3hdPpOMOrs4KjdZMqQz6krWOHD301C_4MmisIh6RxKcJwaCeQeMQDe5uMFGnESfOV1pCjq0b0n13_gD62wRVySSXQ7izTedgPN-w3OVW3UPaxrjN9HuEuv-g23LQtE4ONtiUtJi9iHzbeFp8rAPjf8BzqXx4G0QWfAspn_LQnZ_wfG6zMfzh84zEda04dkSv0xuI0k2AhBAlj9sIvmwS2FPjB-O4sSc54idnUQss6XVfI-XRIywjVOrJi4NIxII_LpJEdxg2AS8XlrPNoug0jdl59pWDzk1W1F8Udsgx5iFiy7hKooQYzQct95dyyrQIU0PwT_vAWLFJTsbnjdPboPuaLgsU_ZzCFXarA9Kf-EniVhJ43QLIkBzpiLyPLbzBDBW6BsfjdF11KGfytEgdKpZCGWX18G-koklADY9TkkdmpB5qiM4x0itN32QMIkDl1eW8bM5v8HdtOpWNWvxBQb1mRLNWUMfiGytBZzkUFmfgl9bzn5SlA3d9TgzuWLBkwpqh436MXBnTOcqXPKqjqZyC579PIx6CdDI_uKz1v2lvlaXGWzsajGIRboN4kilA7D-2YutgiSAvfQO8vOE8EY9FSXmSP0J-uWpje3S8BM2dCcEwehXHkEVxNKC_uzowzhYcTEqadQLtq2mZThUnMJxhdJ3v-wClsXTsVZQJAFpXYKRQKivHfWZcW4uaEA9nIMT_M1uDsNZL9UBgl7RzmxyWj9we--yh4N38lU94OF2eN7WaVMbKBwF_2052GqsXScxCpq9o6zonRDF2N3YjpAXpkChnFMRN4S-UDbYjNnpc0WlxbC6F02_FsV4QMRH4bG156Qg2IqZkafS55MJ1WhHdsf7awNA_ANOxwxJ6FACWodQ32DCl4UY_6Jhmx-7l01ZFSBoExI2SWGnjUilEK3SCUvah_zvuD4B0TZJloFkzpgNikh2TqgZOihebRThazRzgxiNVPvSymLYkfVxwKRQx-O7uF4yTqgWGAj45xZfXSbsECFcb7sXTwv45Rkk2Vk2f9uUO97y5bKoaZiNnD3hBq3-grTGjoDo3YhYPaESgVhym59VLOdu3nQ5BmXI72JURBCng5CAWHEUWP7EPCYaFkOJ0iiYws-N9A6WmGB5-SWIh6fFCeIMTlNhQfeJCgiRus2O82iXvumQVoSWxDQ-Qv3sV0bjhgrq4seUbv-y-5sCUFwfwg1QgEKJNuKkMaZJbKaqWf9R4BsXrwS4bevUTh9bByH23Mpnb8Lyvttwnb1JkLymcCIqZabiHtDKAOf2YN-qZdXEK4YcZgpGtdm_UPYPq8VdEmNmVk8GSrEYA2vldPWIGYzN9kovpGXEYOi-GGhbO8cv-eeVRnLo4tHzCae4VCEioYGpYwK93HbFS0vtE71ZOEZna7d90MLeg0mdMe98DRQ8OLONX9MH11Klz8aiAHnQew8cvTp76S76zL8jnJtO6V8Hh1c7wsDJF3Ziv-bnU4YgdHZjNvzx80n5G-3TTzGFrRAOu9BmsaiNc5-T2nwI6MFZ-OplviI0ucF72LfLnSo60XfStQraC4biXTY0iZdsZrXAuwUrg15hE6WAuWk7sVgjKhIwwXDaQKkGR42p8g40WPC_Hg1wT1dj8AFrQyLug4jueBwqRXp0IrjA9Pn0Nf3gkEfWEXrfshO_qaZbjSfDyvxDY3NQhlQeDxmEHPNAeDKDEjMrDiLiSD4Ebb43G5HEguftI5nMDykuGFvxj9s8biYg1DDf9_B5gqkQ5uP-rRmLBCYumTGQ1EwivXa6WJ_WCuFU-Ta5wzlB0Dzm3D0obZEVRo_XoxXlUKSSUcwBxJKgmYupafHBsOoOLx2-zizKUEiYR2iipgvg&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=1326364446201457400&adk=3690638929&idt=156&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 18:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Apr 2024 18:11:20 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame E15F 11 KB
4 KB 81ms
30ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsar9tHkvZM_rH9ih7_UPxa6GiAWm5b2gaYWVnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTdAU_QhSleM7BjU0PzTVwDgU-A4kTQ381V9PpX3uuXcBtQ7Gev1knl_1c6b3Rvyj3XJ6S4y0eLjGLRa7UKZU3UFbfVmJkwXM7TRAXmkQPmwJLzDsb3McfMQftKGBTDe9ZN8CYbJPOJdqZcuInLgrjgr22JA_p7t1slPYin8IpHQdItNIHXaXM6dDan06XWVrWmK0K-h6s9D_35CAHd1HbHDps1ml88C-ClarW_LGdu1Znqd1uKcdZBUTXtSrtYntCU9wnhfbY_6mf2kpZ2aUYQbUDnh2YlpJ1bHtlukTZpwATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBPMnNkS0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3OKTWX7LiUytysTzVY47YYUzwl4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CTdq-SdslnqQz2WUFx7hwg2ev6tev_Fn_zkkkX7blfRmKGhA1fJJTp1ngy7HNeXOFdvKAxvOVZqNBZ2CprdNqZ4b8__38l9AUqL3W5d_43pq6WyJZ8hrxq9a5B3hF7PGBPvpoe9kVm5Q-zWjUG7AFcPVvjknXCXrBZrZAfBHzvz3HDPYw%26cry%3D1%26dbm_d%3DAKAmf-B2dRtFtJNdjh3KXFcYhBjd7rz09ih4iv8QFhP1137J3KuQaFe5N0ILso5l4wJSgs8QBsjGabZuoFuaJzGASNApDZuPI0eET1Y1tfoZ6okE0GZSGCI3-ZklLjlviGIbGZeJES4DtUMXof9qvHvDOp7TKSSFILevffZKx_kMZ0SXo8xFrT9_eeDTVjpjow1kLylu7zsSDk8PggXqn0cE_ms9Jx2ntT-AMrh1FfDypeSq9n-hYBnINxSSsPQzDyEwM_0IcK4jlAvbjGIoFti0BBWXwB_SC7ONn77UEsvDJtPAwW0w3dTYfskx-hMNhDr_hSUKzKJRVaKtsSojNcfNDtZhoUvTTzfpGlmIoV5XH0rueuVAqyJfPCM3wuI7MfA3Qv01l0rnPgvsBMzO0HGuST3FCPuz4smEWcxxnMt64iOx6PaaHZy1r-9-Ib_Capsqgu_rhBa20L2Kd1fpWUEaDKq7mxwOgzfvMdPbRw-y46YFcnKjnufl3BmkqW11ivwDhzp6TgN2VuyKQG3r6i62eJ3r8Co4ObJiITbb84MlWcGmEDZUM-MrdJTt2ZUAwAXn5s_l2VPcJdtMUMke3S4TtMpR4dVnlA%26adurl%3D
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 8a6b5c9b50cf55b92864543c971cd9cf97bc389d6bae7d66d589be6e74bf7804

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4093
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7091 41 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CWAGf_PvPLV99oQ18oEswXnceoeVHQL-QMwYnZEDhcdCgW3fyLcEmnQd7RwEGR10aiAi1T5EZNcv4vqNZZMUTZDGDQEv0g8cUNTcnNdWed1XrtmApecUn9h34r8hlKQo3sXmPU-pI0myPaZl9Piz27oFUDfdFHCt3Aiv_KSvpgPLy9iAU&cry=1&dbm_d=AKAmf-DSYInI9G4jwHafEDxD04W56y81qrEpyirv7MVqrqWwFq-ClhnlhJ-uDEp2lo5RlNbMGoi9QnPKETQbcbLEJCW6bPisFXaX69rUymAKBz6Kimy6zHFul7V6sLHOizPAuwCvXOHlvqOoK4nXmU2WJpYIWWYFdXq50LTPANLQHMd0klPaYSS7hlAIHMfqNCMIfxeKDqKhDYP4jpazhRa43nrdT4CmFwDby8o7txoOfKfTgdUh22z2kQQSiVNbosaqR5jH4vZ-AxD_5tyIZUxw2c7h2NVKCqQvLIbpBbKh3ApDP8oPmd04ay8MXVX1rHdTvNDgCwjnpDUZ7HimljNMDa-STAP7nGkiVHKftQXsr4-NL6L9MNjnuns6h7fxzQ6mQs34a-JUPnt9B6jiLgHFdGlKFzPpLlYEGtyVinl0bVs9S3omTSvJ6Wlyu2Mim_DcJHZzqn9alqmFu7xnmg52eNBnMjsbag05vZE9TiUSnpda7YkJuhg_2cAk3zAmqV-mL6QUNFJ4sTSz0OgU2YpnrPfY1q7vNnwb3aLA1s6N7RUJceWZVN6MA47KkvA4RkRHQaBSeS4IoCfalMQAdQv8s1IDoQ4Q06h37lxhlzt1dJlnw8N9kyNo_XzDyU81XNyU0PYR1DA_VLRGCf6KgCGp-Hl5hS3kPp8zCJOkse0fuqvHwJx9briHaV_mC0sw57lTb1-Si5sV-y_t7t4XzhEQqWsnfrnzdUldZCQwHCvcW9Rvn4QSEvU02RNm5Ppo7MNHQxWPr0RqumAhy9I_S-qdyFUquhv0K_uRgVeQ9zNvXIJigvIiJj2hbqhqGSURjNd7FbJYYblysVIMuI-A_rTFWNu39lfTMNsnTkXr9zD_SS2fqA8PFs6Dm4zWg8bBlleUJWuPgKLP_didrnpCiM1z9sQgBFgd11bU7-HFhkXTW9ZMPoea-2JjG4eWcMQhkyK0yorRi2bEab5oFpxyVTdEn8fr3j5EK8C2VyZdae3rRbSfVMZQ4PGLmZ_QdRkoj3wE5f3_1LYOvxiajJbN3dyOIVHPpdTSaDLIL-hstbW7vejj29sHV3WNjdy-r_NbFFWu5qfTR3Va8FahsXiPEeFfTXk60FUD9B4fhouvoaiigpk49gr3QF76r8jmnaUj5jVAMkDiASVOI-07uMcaX5w7WbO3lP96oor1uj3HunGPdpuSaZ0uO1V5naymurM9PdLr9LfYZGuX46nrg1grfQCaj8Bl2wf1gM8pb30gIi0raJFMdX_lYvHfZqRT1HIAf86KYyxf6BfCl5bGpynC75L3jIGKT8ehk5knVC3sSxB4kT4r3Hfw-4V3y7iAWfaLmEUm3imBxVoL1WwSULuSk9TCy6oGfXj98acAuipVmwzrSBKREb7Bb8XFtg0Ga6ljBKW4RX3EL9m_5RQE8OlaJeiLTwO06XopQ2iiyX1sQnqeoa2v4a83_741fV3zxUkyJQ0VkIDtF4hrDWy16JFBveNJXX4Mie68HwgRc82wfyg-3a_nvEhC7q72HA3_Q4jxfaqEx6PFXOWtBK4w825Ayoy0HfFnAVK8b06gULnFV_ZzxCD3QypqdZCEof3IEzjcz5VuEBbYiSU2mZbWeCOnTMORHAhace_w4CjLODl2XgoalLRbcU1Jn4CnswjbnT7ZYo5-5zcJuavv_zDhGisfGktpuMCjC77bdFVgtbWiMeRN6Wg-oeN1ErRQ-GWtrKDfWIrxMztUD_9KB_rfpqh-yy6W9g95g9fcDJzDvOO3voMtM_XP7T1MOkPN5QY19eOoGwQWEI0WFJevTZxVEU4oYUwVc4qxOiqe8EO3_cn-YPk7CLGbNPkYZ_Teo2VB-qGYGaNn1CWd7U8D1ebWWePn2HMlv5UNgmi3Pn5qAkcN_BhPRXSp5tP0rQIoILaLBufMdKgantGKhqsOxPo7r9yYKEoNTZrA3v-NLowtRyu7cBGsrLIsemZn5RtmL93rNHTEawEDxQA-TvZIYdm05OzCSpzMqcgR4S_opL1YXc7PJYyb2bnanKGFZq0RoK82VWsLa2SYdd1Cy-syBPb5sDY6cJu7uJA9ggy5ne_0TUlrQddAOr0Zg2m1aK8V6FTmJcku1X2SriTDcRI1VVHo5r-NL8UqE31687hknaqvj-7paWl915N7-GLAItehsFHmTk-SbqfWHt3qapCIwKZLP_DFSriJgzHOkj7QhaZrAD9YY46Q-VklzzjaIOJG4EH0XM-5aaNRAzQYxr1C-B0LRsYSKdeWYvt79QjQ1VsEya-mcyr6Dy6PETKm1fQTd1Uq3_UcIZc0Tf16B12hTlWnQpCOUPJaj5a1_ZSXVDuu5_4eksJMdrwqpugovymAtGw2cf6Xw-teW4wv3eQgYDKRFnHNbiQMkJeWIbgMAfv-TE7K4jwH56klyg-f7NlZBVg9HKbGHSYqxSQTZateQyAhwXflOX3rnBAlFJ7svGEXChPQrERxxGLO4AhKv_qLPJZpifEgie8OvLbySRBQbFHZzGB24sb8n2tQfxnfFd-y1fTuzWtHnt5dV2fkeaDHRaJV-eIvQ7JJi-V-Ua3LAffKZxkp9lq5Kj94io-8pi69A9twFcnN7QQZ7zHVWauLk4NGLyV872qIzRJaCTMHYtv770-AmN29f3ekZmP6rvOXuZJv5zwKMYqdGkTmOkjHVtVKOgKlkOenbcsS8EHiLMY849iKhY8ka6K2U7QaSjlJlhD95XlEZDE375Oep3bHRxtXwZa9CDt9Z29ewrEWtN0DjolTK1VzdxI-uwZJyyWFK-lGAPPLflNSbEhBHYr7LZgvtTU47NTEoTbslIY-cB1WQ-qoADxRyXTK5o86BK6bJqJ9vJ_PaFvEiXBlpfsSoxQNgQtwlx-Infgv-N7o3hC9ZhcVy5-fEcJF-stQ-HN93iOzuEykGyy8lv_Wn0kBhH2oEV_0vjAUAhcZSzkTrK9zN0gaNmKUwkdX2Nx6mAjWOfPUE5gjb_Cft4DCJGSnw7fnA7hvdG9Il-SBcJUbPaStdyay4_rozomF65Jn9i6dmq5mehIbx2-dWdBJZapwioh13H1BkUi0fs3a17bJoTj3QoEeRew5mr5Sow1c_luxHoZn_CJTeDgNkIUuff-W-y7fJaBh0AuxVQhsFUsFTwF_GwN9JXTXLBqlNmLbtC6mia19ks88_bGhJ1tqptFf83k_r0VmWnutU8DX9dHu6RQPOnZSUJ2In6CzMwT08SJI6aI6fg3wZUOb80AiDc1Q_4AYL8pzNBXYeBn6gC25CH6HtlS2VsBmiZuBBFLIMRQZ5QVnLPFLXZ3OvKU3jePX_cDRc-XIlAfEAiK9H8VoBOSTpjCAr7A2lNPhrNyrCQ1h_WCreUmlsNzLN4zSsT66o6TdK007Xgqg3gB_Ok7L_5NAY3idxEZ9Sfe714PAlTknjDWUFUM3od4jODq_gBzmrUybun5JSWFTS7192RlGM-Z7YJfQqrZtvYgDi6GCL8e73eaTmeJC8oL3uo8VyF0&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=18013588274607501000&adk=943508955&idt=167&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 18:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Apr 2024 18:11:20 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 7091 11 KB
4 KB 78ms
30ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqD-TtHkvZM7rH9ih7_UPxa6GiAWm5b2gaa2VnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgThAU_Q-V-Gmh-0fz912amR4z5TlcLqELdr-2HNPQHoF2FcPKqHGTkssUlboX5Ar-cu0Z-9EM5cuXqLq3tw5YjarvqFChGRN26PIWjYp9t8swHQnEGf-hZK75iVr7sRzyP_SsRKxFckcYqdoo4YiWENHAIdtcfGaL4L_AfAQkhFSOIZjmG2hTpH7yyAGHro4fbPkHXK22K0GZ-wVEM65AcaLIqNYngLXN2Hl91dxuhWYBdTs3GkEzt7KIaF04V8g02UH5p2G3T6g7vdi6Rn7SkG97xMdVQzAtXUzIZ3POGJgUWDg8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_2ppgnaPMXFN9W7uwrkFpS9gcqYQA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AzXjn2Xxjl86V6lSvoOz98dknSn1w5cxKRMD9-2PXIu3MzeSKWtUEO30smJqQcB5vr0MHxPPAMDkM1zmcZYPFjscfT4E2XxlUHqe5fL_CwLovOtNX5ks2XXo6w9X51BG2ueIE-h6c-cbQdx8W0j1KrjGivaj7jM9e-PcjW_-zvlxDUY5c%26cry%3D1%26dbm_d%3DAKAmf-ACJajHll1mUrDvA15-suNEYFMdoFuO5JmpJho0kBys4P17Ncwwmgp8lygeCGit109ehDEy4OdaM05gdLUcbccYLamPSY3coJdIqilRgfEhnFKOh05gB8QQD9AYzJM7fFjv9dsiU5BLJ81xnyiDvASQLWP1gJvdBDmmEa-tCl1stUHeIluC1btSrgKF-lbZWUWMzR-8AXvYRPpQ6W3VjI_MrdOrM5rnS4Q7N__ZjbD9xjKXHmoAgFqtz9vsz6KZMrcU92FM-UG0XvvclTWKFCEJaoBziKO1cvKLIe8J29ZXcScLrKfAJiul5OeFn_i-GSKZdQZnnYd8c1w1B6NUa3kkf2Vjix9_8JfRoSYmGkXfsCZHWZYqu8Mq7GkOzyIpTpSn6IJBoiaPIFKrCNNNpMSWdJNvrYPtWZPE85qrgjdb6NK5WuZKg4RLWGDE5gJg6FwTcqVua4GtwN-u2dykCRzqflZbSKtp1asK2Y-vGCiUiaagYMZft-2u6pC1l1MTd4JptIt8CO0C3pHzGX1zbtBFSUTi8JR-4EUzi47B6QjnwWINYvfDkfdilQyEUyj6tMiqYjGZVuxc5FcTrL9yflG8kILz0Q%26adurl%3D
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: b19105f2057fc0ac5dc39415e1fb65d80324628107e5103a8a51030a3f05a9d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4095
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

request.php Show response
hal900013.redintelligence.net/ Frame 6318
Redirect Chain

https://hal900013.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900013.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

144ms
93ms

Script
application/x-javascript

116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbzv7tHkvZMzrH9ih7_UPxa6GiAWm5b2gaZWTnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTbAU_QBCl9qNbaLYwMZRpBvv58ZCaqBs2MJZ9lCZeUHDphiUBOgKegh_AMAoSQG5O8M6Hdz3aEXefQCbiAJ_zAa9Ax_GruH0vuUx8jLjdlRAzfavHfKQpwHoj3E4tdcYGT9ryln2bDY6jlbEHVf5kVxIvyUvgxzY4LFMGs0JleKHz4LctAgd3QKBPwH5nCt58SdKEZ4MyRI9QHtr4rLpEoIbQI6Z7-6bAuRXlPvduRxmpwUHf1h2PfKLKvXvfhp7fpG_FkwART9IDjX-YZwE2QXPwCpD9jA_hp8v1_0cAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3PJXkXxRPfX-sAICG2cXkaFC98Og%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DKfGuOEtm4TFY58-yJPig6DtB2ZXBvOFGO3n6sVyLWmV2LXQRLpnwjdJMI5IihnsbRBkdjtipc0WVa6jIAJIJXOphrdjHff3SC8B3fVBU29qELTWSKQILvH8JpnfwD7lCiqyAS6diz4qp5tKkD57ylqEehlhIKUnHpMECMNEhxObG9_Hs%26cry%3D1%26dbm_d%3DAKAmf-AymG3_uizAn7GiBCQWVHr6wma8RsK7KlHnaFtGB7lkFDTVU2gl3YKAghSjC1jgnck74_3IH-c1NvPpwjQPCdJCiU1nE4H55nUWWiqc78eT6sV5IsPG5k2-Y7rMO8F4W5W3b_vkK5dAP6xID3bJjPBxzF3b1PH7mNuepQSTZ37_3l61kAlDnsfomUYu4flTNlzYJWeacz_aI7Ti-FMKr4M5wRV0EmbuqKdNiiIkiFFUZ0C_do8ftnoQgBZolbkg8yy_Vd5cYcpT4iQTGUwR4_Iq-bwKzWIe0vL4nywuyZ2TBwyHveMnf5b_T2g74r2vXPpV4c3hcp9u7zHqso4f9XIIwRPndLtGNNzMHhSt_zGNxnbzzSqXHZFAapPyPV8PjhrtS1gBAy1uwePYdFFIRkjUydeS5_WvkupGCwSUdQEHS2Ki20HaSytXZTKHgsrWegFwf0JZ99ToqCu3nhympyG5HGdFki7yvYtHI6u_aMQAPRvYzfRUM5ON7MM_cTOBsT6WNoA7RnpmeAeLllYA2CZiuPFbbRJK-D5gBCtrMGk6cxFRZzL69BOemd2U43wQAbqwS6B71VvaTOFtALrG8mqmOaXirA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1294385852350&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 3fd09de5946d943c42b2194c7808970d2958d40658e4a7225ead80b105942fc9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 60320400009337604444990012287013
Connection: close
Content-Length: 1350
Expires: Fri, 07 Apr 2023 03:02:29 +0200

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbzv7tHkvZMzrH9ih7_UPxa6GiAWm5b2gaZWTnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTbAU_QBCl9qNbaLYwMZRpBvv58ZCaqBs2MJZ9lCZeUHDphiUBOgKegh_AMAoSQG5O8M6Hdz3aEXefQCbiAJ_zAa9Ax_GruH0vuUx8jLjdlRAzfavHfKQpwHoj3E4tdcYGT9ryln2bDY6jlbEHVf5kVxIvyUvgxzY4LFMGs0JleKHz4LctAgd3QKBPwH5nCt58SdKEZ4MyRI9QHtr4rLpEoIbQI6Z7-6bAuRXlPvduRxmpwUHf1h2PfKLKvXvfhp7fpG_FkwART9IDjX-YZwE2QXPwCpD9jA_hp8v1_0cAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3PJXkXxRPfX-sAICG2cXkaFC98Og%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DKfGuOEtm4TFY58-yJPig6DtB2ZXBvOFGO3n6sVyLWmV2LXQRLpnwjdJMI5IihnsbRBkdjtipc0WVa6jIAJIJXOphrdjHff3SC8B3fVBU29qELTWSKQILvH8JpnfwD7lCiqyAS6diz4qp5tKkD57ylqEehlhIKUnHpMECMNEhxObG9_Hs%26cry%3D1%26dbm_d%3DAKAmf-AymG3_uizAn7GiBCQWVHr6wma8RsK7KlHnaFtGB7lkFDTVU2gl3YKAghSjC1jgnck74_3IH-c1NvPpwjQPCdJCiU1nE4H55nUWWiqc78eT6sV5IsPG5k2-Y7rMO8F4W5W3b_vkK5dAP6xID3bJjPBxzF3b1PH7mNuepQSTZ37_3l61kAlDnsfomUYu4flTNlzYJWeacz_aI7Ti-FMKr4M5wRV0EmbuqKdNiiIkiFFUZ0C_do8ftnoQgBZolbkg8yy_Vd5cYcpT4iQTGUwR4_Iq-bwKzWIe0vL4nywuyZ2TBwyHveMnf5b_T2g74r2vXPpV4c3hcp9u7zHqso4f9XIIwRPndLtGNNzMHhSt_zGNxnbzzSqXHZFAapPyPV8PjhrtS1gBAy1uwePYdFFIRkjUydeS5_WvkupGCwSUdQEHS2Ki20HaSytXZTKHgsrWegFwf0JZ99ToqCu3nhympyG5HGdFki7yvYtHI6u_aMQAPRvYzfRUM5ON7MM_cTOBsT6WNoA7RnpmeAeLllYA2CZiuPFbbRJK-D5gBCtrMGk6cxFRZzL69BOemd2U43wQAbqwS6B71VvaTOFtALrG8mqmOaXirA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1294385852350&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 07 Apr 2023 03:02:29 +0200

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 62F2 22 KB
8 KB 21ms
21ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
expires: Fri, 05 Apr 2024 09:37:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5F0E 41 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AQh_GBXdPfPH4_wDwKJI7lkmpCKCbWgq5OWPNbVwSyvz42HraQO8H0H3qLhL8FStc_gADKzIERLtpJk6BFdoKPxLPMxGGekr9hbp3GXrS0hFLT9M-NOBd-XlIYW-p3VdslMbKMjLio1kuNZaJ2jiEah2qYymrlbpicCqZKoRXLso2gNIM&cry=1&dbm_d=AKAmf-D3jjX5J121n6hRK9eFCAbQRKg8yFhJml13pkV91OnQHCCQPRECE1b8Uxy3BPF1TbNlYaXvF0mvpeglW0dp1lllO-pIkQQXKC_JgrGicUwzPzsZsZ-4NMu5GzagH9UPLp3pgb5SCsuojrRynlMZqAesSciOISLbCJWs_KhCZgnFYwvCwNDXWRZfCVRajk1TTGL9Iwot5nQ_fm3_9CTW21hnFv-AJ_nVrSwpsPvK2I9CSaEBS_LhiTLQSNa2y8KSUX6EfLn7Z_SwoGFMqbTc5bYwCr8Ba_-ntdKD8kDWb31KzbDtfwlSRVtk1ENQkS2bvVnAMv4xczu3kodJCqozURnz_jWz9bC9i6nSZM3H5pT61nNsjVk08xJl5IjGjgP7uuRtquF3X1iUS7afBTaY4DBNLNFx8oFWAgUseIM8XvUskNEsfXNldq11Ni2DCDJe_X8gsEN_EN1Tm5THu4mzUgWm5NMEgfkY919dOB24tFsfSWPbEhgGM60-cHGS_Nsjq4SZCuCTOYxI4qGO7FFAp6iiH7asIe79PU0TXKCG74iot30qSZ1siDIzmJ4BRUmZevmYHfdkUvMzJWecr20kNzmLXmXF6MkrbR639SXhfatiIDTGJko3qHRN3sVkAIX7lgkLaR3Ojlfma9H91NlwqLmkVnSJKs0NGPytI7Tt45MeL96i9ZrEntuEvOo2fthW8hWypz2QUItlis-DcHZ1i8hfbOHd5D6ZcfjJneCkOybG-A0DR5Dpw8ZiWVmIkyF9DWjeja438xcTZaDVNVjEGlgU9qsSgMZg9d3iBYy_kfuRxRx2BXQ9u2yN1ek5CCuvGlq6D-BOEdPQWmBsfW96uZzYJITmLIGGbbKCKvf_jn4-bNK0NpVdom2e1aZcFzyI-5EDr4hqHOMEIoduE4tp0nvBTAmpUIGKyJK9AQBBM8Mn7Ei6nKmE512Pl3l2c01uy7-ddpFEAzwnI5u3zq4YONh-BFPNPkWSPH-FzKLN3ArHCvZxc5hbIxEyZBfdMDhCG10ThqQkZSDvtKNxkWcUROsgiEWauGny2eViwVg2HBKsgIGSsvgHB2SHXhhHf--j_fmodKhQOl28MmkUlt0sx2e-vcJOeAlVBs_tSH3_1Xj56SrQNYTZy71jkGzqacq8avUlrGsgF1lOwHtsBZKYGq1L1SRHI4_AOcQO_yo-NitxCyijjEd7SThLOa8KLi2WIVNPyKwPx1ar3DNomgcdVI_Oi5yBMn-pCLgV4WUojHu3Obg_VGVsI32v54iIfY_qm2l3XKYxxPF_2dyuwrgIz6WKa55i1qKYREwN4fmFlg1_nbTiSok0VhlcAibyxOvIZagx2J6Xy9AEkY2mU6M2sHNUAiVz8Lac0AwG9bCUsIbo7dWZ1FwFrmpZLHmvN-A4tYA7hnnGFg0iaY700nZyxAzf1eQJrHgg_SyI0j8fhqSr9ZiI8cjOg5OzXdmphnLQKAUAMRWfE7P3nMk07Hzy0zBAAwnvf-RW7vG1jvWT76DsuH82UoyTG9fllG6kxrSuSZCGn5WWMBDFPFrNVwedjtSG2rmeNP1cwObktAO4x8oulOb8j9CuIVcUFflHazrSEu9Vpp9HHcMORoZxlB-e37oNVqJn97TNO3SRORKqKIqBoOZakyOJgECB4RAtq_MOeXJbu6wHODulAkoGTHNy89mPyLA8aKduYhgLwCkW7-eGuWcVw7o4lFaWCE12H5Eich8qgserrCDwZtrCSj6BqriunElAfz_PRYHjejfUhyzccV31HqKrqpYSOl70J0GiMgZpDr-s4P-4M0RDLZ-_fujLHNFpOdXUbLVes3A_Yg3pWcZrtRje2zApuPjlx6S70zHhnvrEXYgZd6B6Ap9S0FjJ9fXW6IN23gTeWwFs5AXxIyqye-t3BjJ9YSFR2Avq_2N3iwYmrKP3n1zMk3vdUdH1yI6dkB8Y5cigHYMUs_fvJ9dZB7v1E-qxMIRm2wKepalEQmGqLkljOLljc0v5KLAVqi-IWeAQznTVNKojy_Rll_ESiGVYyNovMz-45OAgK04l3uRsZVpl-5dC_2e4sLlJ46oOW3243dBP5uKRnvOLwCt-wGRaIBIvxAkcmN-POcY2WBjg9_A2u5p8iIIflUCR1YUFMUME2stJBQujC4tHFjxvPjk4ipRQAcL5-4NILNaiOzSplzmFGRQVtg0rlM-cOTK9aoFerioerOQgGgxtlsFZHQ2daDiT0AfDmbZib8yWG8FTF0oKDdya5C1Var3l96W3QOTkm8bPmXKdMd5TmxHVrBQUegxCCOzHbWjTqlxo0socAs3iDbUi5w9rSJHgdeT2gPhqRzaX6OhOiL_w0VGTCzNacxupR1VuOsS9N3zlePYwZMtQTyyUzBAceXy4aBxNRME20gE8kLfY8FqxIZkxhFYVufSuBjT5AaTYEGeNLVzmR_MzbViISjxnCNd7H2auLSKwou3quEay58AHyShAS1yenf4pspotNzFiDti8DB8eNudbf379XB7AbKC2T8tohqmxtpM0F3Q5rNavy4XZ76JsB9n905APX0u8Sxi8pNwDZyiSn3zW9yoE7pcjz5b8TlK3-loqZVLz6JKCumrHFmIov10I9jZR8KSOBeIZCsOf_RRYmrlPZtSyFzbraVy9GqFFBiv4DfG2YUTzIytw5Kl60Po68ug6Azhfnm7UtRuQpoTuEjPDC2CjuiL03qpOD2r3io3VLQUvJ4wDFetSz-7EBd188c4WpQGBHYdaYhpIbCFaZTBn3vgt5K-Hvqf3VAzVEVOXbUms-h0io9weMjl1dj_KGvNXsDkV_i7_CTlG69KG_nTp6QTxS_GTolIH8bA4XhoJ4OGIDnQAKFsJlia1eHc4ZMeveKzYVeg4xBBRlRwkpmUP8C3cbolOuDdoDFt22BFoJ6nDc1Tv01dX-gXVPgMLgwLkallejHVgKmRmeiRK_usJB55joa1cJlColqG790tMcld5FC_P7RkZELL5J11RV74-QYRE-VN2cWcsmNxzBNQkz3zj-8qn_orjZOrtjCJtyvdiaCvasEBHkhDk_0L9RWVto2AxC8CW7PwKlrztPPAS6nJFPqnnBKinM31I5_UQahFK5_YHOHGZpJTs6CGRUT1Rj2-MUUqDp98q9DFVAlsDK6lRNO84qwOuq0PvN6jN-RLoBCgihFKYgg-qzHQJdymSm2TgWuwfNLG8WQautLomVvN4Pl32xBRm_ievo1iaWdqPmpnYB557CeFJBORohN7iDq-nLWBmO9cVdqec3tItqLQ-YmwFUDkECNUe_RbA5RxJPALUTrHvlAItXkoDtXBmcG6Nrcprd9KyFgn_8mkr5BnQ7587e6futX94V0mUlHclnAdmyYsH77B5b1QfF8nOVArRC6l66FzDeK6FUG3u7QyOOqI4cWtkl0upWxr8_tMmgrADG_cF680nlYlb5zJDYOsVYQQbtVWYofYPyXutKOOurNju62Mqrf3zGU-aaHlrS5tu4UkWiOY&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=5822999043167644000&adk=3944675600&idt=174&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 18:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Apr 2024 18:11:20 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 5F0E 11 KB
4 KB 77ms
26ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCmqotHkvZM3rH9ih7_UPxa6GiAWm5b2gab2TnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTeAU_Q38ChnYHge-hiWilxxbd39eiBFQ2I_czJYOwGwok2ODxOSlyzjho3M3N06EfEfAIN0XEjGBGkYKW0y3umq4UFVu7GiZQdIwanwxyBXu6lxLPCHGQaCTnDMmAKCqtRyHoxb-lTUwogXKvaLNg3UBOQSzlUtw6brtdX-69cJgJExuWdQhRFED3cIGXVk5VlmlOGQsZE-pLRWjoZpxP9OHY-b9NxD_L7jfI3pOtOfsivEWkolgMcKwmAmQ6NNy834dmfOtxNLpR08PNLZncor5tJ_n79f_lm9E1642D-I8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_1jzQMJRjSq2-Oll9TVLzdPeJXRAA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DxRNLgRNfY5kgvF8FBV69wur63DtvYY-24z7yZHwnGTPavdfcVNseNcjbGBF6D3yz3oZphq2lM4twyUu8J56fMthxEd11c1zxeZvjl10qK8XSQxYX8tZqwbl7fv5268kstlBPDBBg-Fz0OEzrcSm56-zxxCPT1DQ2JxKLtwMgdPJSvlCM%26cry%3D1%26dbm_d%3DAKAmf-AoBSqlMd-pgHvgweMHczP6KPJcnZ-hOzNtE4p0AYfccJ3VqhbmdWkVDH_RQmlGky3m4mV8JqxH4pMnXd_kI6_M4v-nPRvQCO3dwa1phX25-4KDt7NizZpNT_dMmEnhKLGadif1cXwFkVI0qrDc8xyWB-bDLCerBDX9bgww5hayBsevcWvayUaR6YZf5Cjb2dliN6jXMABHYEo_Bweqy05ckrVIYD4Lzp2ovS39CTWLnSSFBSW2-pNOi_apQ-izCNX2RhUEMpJe6ec3B-qTJnyRzrtDmh78SFLK-93Nk3Cq1oW84PiJRS1xA_tiKZN36Iqq-b7PKcsJSnq1fyHDGUAZZqw28f4KfHvF9QDDTSjQbJ9bGMwaqHsmJbOWdRbtWC6fxSuN1wE7tm2CHsngRcIl5gSc_BD5emexB96JNZJ_QjA54X1I51iHjmQ7osWR6exWm-yfTv7-edRGjvvo-ZoJ1esStv9QAyLk530dgLogs9nOyrTP-jrez6xspooLPNpgfhN1ltNr_A0APK_5N-cwSxcmX3h9h-Ax9LG1mV-2uHYupCWG8V6OmPu2xLf76zaxmxcWzz0poo_d9TRBHLSocx_IDg%26adurl%3D
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 8f0c64970636909d5eb88bed498f065aaa5cbeee44744a18d132274def34f447

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4098
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 13FC 22 KB
8 KB 21ms
21ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
expires: Fri, 05 Apr 2024 09:37:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal90005.redintelligence.net/ Frame E15F
Redirect Chain

https://hal90005.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90005.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

151ms
101ms

Script
application/x-javascript

138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsar9tHkvZM_rH9ih7_UPxa6GiAWm5b2gaYWVnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTdAU_QhSleM7BjU0PzTVwDgU-A4kTQ381V9PpX3uuXcBtQ7Gev1knl_1c6b3Rvyj3XJ6S4y0eLjGLRa7UKZU3UFbfVmJkwXM7TRAXmkQPmwJLzDsb3McfMQftKGBTDe9ZN8CYbJPOJdqZcuInLgrjgr22JA_p7t1slPYin8IpHQdItNIHXaXM6dDan06XWVrWmK0K-h6s9D_35CAHd1HbHDps1ml88C-ClarW_LGdu1Znqd1uKcdZBUTXtSrtYntCU9wnhfbY_6mf2kpZ2aUYQbUDnh2YlpJ1bHtlukTZpwATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBPMnNkS0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3OKTWX7LiUytysTzVY47YYUzwl4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CTdq-SdslnqQz2WUFx7hwg2ev6tev_Fn_zkkkX7blfRmKGhA1fJJTp1ngy7HNeXOFdvKAxvOVZqNBZ2CprdNqZ4b8__38l9AUqL3W5d_43pq6WyJZ8hrxq9a5B3hF7PGBPvpoe9kVm5Q-zWjUG7AFcPVvjknXCXrBZrZAfBHzvz3HDPYw%26cry%3D1%26dbm_d%3DAKAmf-B2dRtFtJNdjh3KXFcYhBjd7rz09ih4iv8QFhP1137J3KuQaFe5N0ILso5l4wJSgs8QBsjGabZuoFuaJzGASNApDZuPI0eET1Y1tfoZ6okE0GZSGCI3-ZklLjlviGIbGZeJES4DtUMXof9qvHvDOp7TKSSFILevffZKx_kMZ0SXo8xFrT9_eeDTVjpjow1kLylu7zsSDk8PggXqn0cE_ms9Jx2ntT-AMrh1FfDypeSq9n-hYBnINxSSsPQzDyEwM_0IcK4jlAvbjGIoFti0BBWXwB_SC7ONn77UEsvDJtPAwW0w3dTYfskx-hMNhDr_hSUKzKJRVaKtsSojNcfNDtZhoUvTTzfpGlmIoV5XH0rueuVAqyJfPCM3wuI7MfA3Qv01l0rnPgvsBMzO0HGuST3FCPuz4smEWcxxnMt64iOx6PaaHZy1r-9-Ib_Capsqgu_rhBa20L2Kd1fpWUEaDKq7mxwOgzfvMdPbRw-y46YFcnKjnufl3BmkqW11ivwDhzp6TgN2VuyKQG3r6i62eJ3r8Co4ObJiITbb84MlWcGmEDZUM-MrdJTt2ZUAwAXn5s_l2VPcJdtMUMke3S4TtMpR4dVnlA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8178197468759&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.165 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: ddfae2e5929757bd4d02bb4530a9d57680c2d0bd1d617d561f90383c4855c19a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 11705700010568104444550012287005
Connection: close
Content-Length: 1305
Expires: Fri, 07 Apr 2023 03:02:29 +0200

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsar9tHkvZM_rH9ih7_UPxa6GiAWm5b2gaYWVnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTdAU_QhSleM7BjU0PzTVwDgU-A4kTQ381V9PpX3uuXcBtQ7Gev1knl_1c6b3Rvyj3XJ6S4y0eLjGLRa7UKZU3UFbfVmJkwXM7TRAXmkQPmwJLzDsb3McfMQftKGBTDe9ZN8CYbJPOJdqZcuInLgrjgr22JA_p7t1slPYin8IpHQdItNIHXaXM6dDan06XWVrWmK0K-h6s9D_35CAHd1HbHDps1ml88C-ClarW_LGdu1Znqd1uKcdZBUTXtSrtYntCU9wnhfbY_6mf2kpZ2aUYQbUDnh2YlpJ1bHtlukTZpwATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBPMnNkS0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3OKTWX7LiUytysTzVY47YYUzwl4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CTdq-SdslnqQz2WUFx7hwg2ev6tev_Fn_zkkkX7blfRmKGhA1fJJTp1ngy7HNeXOFdvKAxvOVZqNBZ2CprdNqZ4b8__38l9AUqL3W5d_43pq6WyJZ8hrxq9a5B3hF7PGBPvpoe9kVm5Q-zWjUG7AFcPVvjknXCXrBZrZAfBHzvz3HDPYw%26cry%3D1%26dbm_d%3DAKAmf-B2dRtFtJNdjh3KXFcYhBjd7rz09ih4iv8QFhP1137J3KuQaFe5N0ILso5l4wJSgs8QBsjGabZuoFuaJzGASNApDZuPI0eET1Y1tfoZ6okE0GZSGCI3-ZklLjlviGIbGZeJES4DtUMXof9qvHvDOp7TKSSFILevffZKx_kMZ0SXo8xFrT9_eeDTVjpjow1kLylu7zsSDk8PggXqn0cE_ms9Jx2ntT-AMrh1FfDypeSq9n-hYBnINxSSsPQzDyEwM_0IcK4jlAvbjGIoFti0BBWXwB_SC7ONn77UEsvDJtPAwW0w3dTYfskx-hMNhDr_hSUKzKJRVaKtsSojNcfNDtZhoUvTTzfpGlmIoV5XH0rueuVAqyJfPCM3wuI7MfA3Qv01l0rnPgvsBMzO0HGuST3FCPuz4smEWcxxnMt64iOx6PaaHZy1r-9-Ib_Capsqgu_rhBa20L2Kd1fpWUEaDKq7mxwOgzfvMdPbRw-y46YFcnKjnufl3BmkqW11ivwDhzp6TgN2VuyKQG3r6i62eJ3r8Co4ObJiITbb84MlWcGmEDZUM-MrdJTt2ZUAwAXn5s_l2VPcJdtMUMke3S4TtMpR4dVnlA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8178197468759&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 07 Apr 2023 03:02:29 +0200

GET
H3 200 eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js Show response
pagead2.googlesyndication.com/bg/ Frame 62F2 36 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

786addb7e1ae880b2d60304114f4651dedfaaaee2e9209d8e8fe9e2a314168db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 10:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55441
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14213
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 13:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 05 Apr 2024 10:38:28 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E399 22 KB
8 KB 21ms
21ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
expires: Fri, 05 Apr 2024 09:37:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal900021.redintelligence.net/ Frame 7091
Redirect Chain

https://hal900021.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900021.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

143ms
93ms

Script
application/x-javascript

144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqD-TtHkvZM7rH9ih7_UPxa6GiAWm5b2gaa2VnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgThAU_Q-V-Gmh-0fz912amR4z5TlcLqELdr-2HNPQHoF2FcPKqHGTkssUlboX5Ar-cu0Z-9EM5cuXqLq3tw5YjarvqFChGRN26PIWjYp9t8swHQnEGf-hZK75iVr7sRzyP_SsRKxFckcYqdoo4YiWENHAIdtcfGaL4L_AfAQkhFSOIZjmG2hTpH7yyAGHro4fbPkHXK22K0GZ-wVEM65AcaLIqNYngLXN2Hl91dxuhWYBdTs3GkEzt7KIaF04V8g02UH5p2G3T6g7vdi6Rn7SkG97xMdVQzAtXUzIZ3POGJgUWDg8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_2ppgnaPMXFN9W7uwrkFpS9gcqYQA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AzXjn2Xxjl86V6lSvoOz98dknSn1w5cxKRMD9-2PXIu3MzeSKWtUEO30smJqQcB5vr0MHxPPAMDkM1zmcZYPFjscfT4E2XxlUHqe5fL_CwLovOtNX5ks2XXo6w9X51BG2ueIE-h6c-cbQdx8W0j1KrjGivaj7jM9e-PcjW_-zvlxDUY5c%26cry%3D1%26dbm_d%3DAKAmf-ACJajHll1mUrDvA15-suNEYFMdoFuO5JmpJho0kBys4P17Ncwwmgp8lygeCGit109ehDEy4OdaM05gdLUcbccYLamPSY3coJdIqilRgfEhnFKOh05gB8QQD9AYzJM7fFjv9dsiU5BLJ81xnyiDvASQLWP1gJvdBDmmEa-tCl1stUHeIluC1btSrgKF-lbZWUWMzR-8AXvYRPpQ6W3VjI_MrdOrM5rnS4Q7N__ZjbD9xjKXHmoAgFqtz9vsz6KZMrcU92FM-UG0XvvclTWKFCEJaoBziKO1cvKLIe8J29ZXcScLrKfAJiul5OeFn_i-GSKZdQZnnYd8c1w1B6NUa3kkf2Vjix9_8JfRoSYmGkXfsCZHWZYqu8Mq7GkOzyIpTpSn6IJBoiaPIFKrCNNNpMSWdJNvrYPtWZPE85qrgjdb6NK5WuZKg4RLWGDE5gJg6FwTcqVua4GtwN-u2dykCRzqflZbSKtp1asK2Y-vGCiUiaagYMZft-2u6pC1l1MTd4JptIt8CO0C3pHzGX1zbtBFSUTi8JR-4EUzi47B6QjnwWINYvfDkfdilQyEUyj6tMiqYjGZVuxc5FcTrL9yflG8kILz0Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4398711972981&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: a13595752800dd8f8618b6606bf67be912e5a7b6b7615aa5507c54b448c0e633

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 68076200009422004444554012287021
Connection: close
Content-Length: 1305
Expires: Fri, 07 Apr 2023 03:02:29 +0200

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqD-TtHkvZM7rH9ih7_UPxa6GiAWm5b2gaa2VnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgThAU_Q-V-Gmh-0fz912amR4z5TlcLqELdr-2HNPQHoF2FcPKqHGTkssUlboX5Ar-cu0Z-9EM5cuXqLq3tw5YjarvqFChGRN26PIWjYp9t8swHQnEGf-hZK75iVr7sRzyP_SsRKxFckcYqdoo4YiWENHAIdtcfGaL4L_AfAQkhFSOIZjmG2hTpH7yyAGHro4fbPkHXK22K0GZ-wVEM65AcaLIqNYngLXN2Hl91dxuhWYBdTs3GkEzt7KIaF04V8g02UH5p2G3T6g7vdi6Rn7SkG97xMdVQzAtXUzIZ3POGJgUWDg8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_2ppgnaPMXFN9W7uwrkFpS9gcqYQA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AzXjn2Xxjl86V6lSvoOz98dknSn1w5cxKRMD9-2PXIu3MzeSKWtUEO30smJqQcB5vr0MHxPPAMDkM1zmcZYPFjscfT4E2XxlUHqe5fL_CwLovOtNX5ks2XXo6w9X51BG2ueIE-h6c-cbQdx8W0j1KrjGivaj7jM9e-PcjW_-zvlxDUY5c%26cry%3D1%26dbm_d%3DAKAmf-ACJajHll1mUrDvA15-suNEYFMdoFuO5JmpJho0kBys4P17Ncwwmgp8lygeCGit109ehDEy4OdaM05gdLUcbccYLamPSY3coJdIqilRgfEhnFKOh05gB8QQD9AYzJM7fFjv9dsiU5BLJ81xnyiDvASQLWP1gJvdBDmmEa-tCl1stUHeIluC1btSrgKF-lbZWUWMzR-8AXvYRPpQ6W3VjI_MrdOrM5rnS4Q7N__ZjbD9xjKXHmoAgFqtz9vsz6KZMrcU92FM-UG0XvvclTWKFCEJaoBziKO1cvKLIe8J29ZXcScLrKfAJiul5OeFn_i-GSKZdQZnnYd8c1w1B6NUa3kkf2Vjix9_8JfRoSYmGkXfsCZHWZYqu8Mq7GkOzyIpTpSn6IJBoiaPIFKrCNNNpMSWdJNvrYPtWZPE85qrgjdb6NK5WuZKg4RLWGDE5gJg6FwTcqVua4GtwN-u2dykCRzqflZbSKtp1asK2Y-vGCiUiaagYMZft-2u6pC1l1MTd4JptIt8CO0C3pHzGX1zbtBFSUTi8JR-4EUzi47B6QjnwWINYvfDkfdilQyEUyj6tMiqYjGZVuxc5FcTrL9yflG8kILz0Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4398711972981&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 07 Apr 2023 03:02:29 +0200

GET
H3 200 eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js Show response
pagead2.googlesyndication.com/bg/ Frame 13FC 36 KB
14 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

786addb7e1ae880b2d60304114f4651dedfaaaee2e9209d8e8fe9e2a314168db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 10:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55441
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14213
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 13:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 05 Apr 2024 10:38:28 GMT

GET
H/1.1

200
OK

request.php Show response
hal900030.redintelligence.net/ Frame 5F0E
Redirect Chain

https://hal900030.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8d2422fb23&subid=&uid=54ca0bf6e9ec849c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900030.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8d2422fb23&subid=&uid=54ca0bf6e9ec849c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

195ms
144ms

Script
application/x-javascript

136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8d2422fb23&subid=&uid=54ca0bf6e9ec849c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCmqotHkvZM3rH9ih7_UPxa6GiAWm5b2gab2TnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTeAU_Q38ChnYHge-hiWilxxbd39eiBFQ2I_czJYOwGwok2ODxOSlyzjho3M3N06EfEfAIN0XEjGBGkYKW0y3umq4UFVu7GiZQdIwanwxyBXu6lxLPCHGQaCTnDMmAKCqtRyHoxb-lTUwogXKvaLNg3UBOQSzlUtw6brtdX-69cJgJExuWdQhRFED3cIGXVk5VlmlOGQsZE-pLRWjoZpxP9OHY-b9NxD_L7jfI3pOtOfsivEWkolgMcKwmAmQ6NNy834dmfOtxNLpR08PNLZncor5tJ_n79f_lm9E1642D-I8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_1jzQMJRjSq2-Oll9TVLzdPeJXRAA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DxRNLgRNfY5kgvF8FBV69wur63DtvYY-24z7yZHwnGTPavdfcVNseNcjbGBF6D3yz3oZphq2lM4twyUu8J56fMthxEd11c1zxeZvjl10qK8XSQxYX8tZqwbl7fv5268kstlBPDBBg-Fz0OEzrcSm56-zxxCPT1DQ2JxKLtwMgdPJSvlCM%26cry%3D1%26dbm_d%3DAKAmf-AoBSqlMd-pgHvgweMHczP6KPJcnZ-hOzNtE4p0AYfccJ3VqhbmdWkVDH_RQmlGky3m4mV8JqxH4pMnXd_kI6_M4v-nPRvQCO3dwa1phX25-4KDt7NizZpNT_dMmEnhKLGadif1cXwFkVI0qrDc8xyWB-bDLCerBDX9bgww5hayBsevcWvayUaR6YZf5Cjb2dliN6jXMABHYEo_Bweqy05ckrVIYD4Lzp2ovS39CTWLnSSFBSW2-pNOi_apQ-izCNX2RhUEMpJe6ec3B-qTJnyRzrtDmh78SFLK-93Nk3Cq1oW84PiJRS1xA_tiKZN36Iqq-b7PKcsJSnq1fyHDGUAZZqw28f4KfHvF9QDDTSjQbJ9bGMwaqHsmJbOWdRbtWC6fxSuN1wE7tm2CHsngRcIl5gSc_BD5emexB96JNZJ_QjA54X1I51iHjmQ7osWR6exWm-yfTv7-edRGjvvo-ZoJ1esStv9QAyLk530dgLogs9nOyrTP-jrez6xspooLPNpgfhN1ltNr_A0APK_5N-cwSxcmX3h9h-Ax9LG1mV-2uHYupCWG8V6OmPu2xLf76zaxmxcWzz0poo_d9TRBHLSocx_IDg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3974010007366&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: 8fa7584c843150365a7ce4f9659d872c086174349e1aef97f30a7c8bdf3a96ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 58658400010370004444994012287030
Connection: close
Content-Length: 1348
Expires: Fri, 07 Apr 2023 03:02:29 +0200

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8d2422fb23&subid=&uid=54ca0bf6e9ec849c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCmqotHkvZM3rH9ih7_UPxa6GiAWm5b2gab2TnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTeAU_Q38ChnYHge-hiWilxxbd39eiBFQ2I_czJYOwGwok2ODxOSlyzjho3M3N06EfEfAIN0XEjGBGkYKW0y3umq4UFVu7GiZQdIwanwxyBXu6lxLPCHGQaCTnDMmAKCqtRyHoxb-lTUwogXKvaLNg3UBOQSzlUtw6brtdX-69cJgJExuWdQhRFED3cIGXVk5VlmlOGQsZE-pLRWjoZpxP9OHY-b9NxD_L7jfI3pOtOfsivEWkolgMcKwmAmQ6NNy834dmfOtxNLpR08PNLZncor5tJ_n79f_lm9E1642D-I8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_1jzQMJRjSq2-Oll9TVLzdPeJXRAA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DxRNLgRNfY5kgvF8FBV69wur63DtvYY-24z7yZHwnGTPavdfcVNseNcjbGBF6D3yz3oZphq2lM4twyUu8J56fMthxEd11c1zxeZvjl10qK8XSQxYX8tZqwbl7fv5268kstlBPDBBg-Fz0OEzrcSm56-zxxCPT1DQ2JxKLtwMgdPJSvlCM%26cry%3D1%26dbm_d%3DAKAmf-AoBSqlMd-pgHvgweMHczP6KPJcnZ-hOzNtE4p0AYfccJ3VqhbmdWkVDH_RQmlGky3m4mV8JqxH4pMnXd_kI6_M4v-nPRvQCO3dwa1phX25-4KDt7NizZpNT_dMmEnhKLGadif1cXwFkVI0qrDc8xyWB-bDLCerBDX9bgww5hayBsevcWvayUaR6YZf5Cjb2dliN6jXMABHYEo_Bweqy05ckrVIYD4Lzp2ovS39CTWLnSSFBSW2-pNOi_apQ-izCNX2RhUEMpJe6ec3B-qTJnyRzrtDmh78SFLK-93Nk3Cq1oW84PiJRS1xA_tiKZN36Iqq-b7PKcsJSnq1fyHDGUAZZqw28f4KfHvF9QDDTSjQbJ9bGMwaqHsmJbOWdRbtWC6fxSuN1wE7tm2CHsngRcIl5gSc_BD5emexB96JNZJ_QjA54X1I51iHjmQ7osWR6exWm-yfTv7-edRGjvvo-ZoJ1esStv9QAyLk530dgLogs9nOyrTP-jrez6xspooLPNpgfhN1ltNr_A0APK_5N-cwSxcmX3h9h-Ax9LG1mV-2uHYupCWG8V6OmPu2xLf76zaxmxcWzz0poo_d9TRBHLSocx_IDg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3974010007366&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 07 Apr 2023 03:02:29 +0200

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BD20 0
20 B 57ms
57ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BNRVPtXkvZLeiAtuT3gO7joz4CgAAAAA4AeAEAg&bg=!i4iliNzNAAYIJb0jKCU7ADkAdvg8WtSgOAMQMYxlJBmt98K5xKOYkdv8EeDekBvfWmahUhb6C4XsESed6r113a5CD6DNZgF7UN8CAAAAYlIAAAADaAEHmQLb61yeTtGx80o3mCYuC-zVk56irnbYLCeRh-WqCLejYzd1J8lPNW3SnlukBr3gsvOMfevtNSaYiRvofMYcdjx2_C96foW65t71-pFnB9JFjQJwC_DJLkDaaPuSnYZF6Vkl7Jv9Ac4BV8Rc9V4qYb1ZMoMbUAHXFExaMZQnIg_rrKeHsK3VYWzqS3l5MGDidq-sdIQ9J2CFLqXsAMmo4JIyVXo_FZdDWLAX4wpZ25z7cU_0KStJoX5MxS3V_e8d1dZKv4eRfbcGoQloeCQAPCGtqsPP8rnh66okXL7Fz3Xh1gjwUHDa5uadM0QLdNj4LkiXVfv2XeJWawTpcJw5Xma6VhITrogoZOk0HfK5MMWihgVpMl1cjvgl2kWLhKRKaSyG5So4JdvZnRquHXKKEAT57TrdsWeDfRbAmHcBnq-yxhReyZTNhlfaksYtOx3V-kw4uV3QAYn307zYH1QT_5Yejy1y5Ws-ZAzzvKByvQl7kRg95H2PKjH2DrDfey3rflz7VFx66GbkiqEGpAUUnOWJ_2IwoP_yUqLu8IcLUy302nwIV-EPng5vvGzTIMSq7M49hK-XdZCvhReKLbL3Y1RxbwkdPoVP2xhBe5aL85bG44zaHF2b2zwzkU5QYseBqPqFAJBp_NikBn6TvGuurnqtdwxEBLcsVq93L8-5xs1Xjfbyq0ZZQqJ2rJPwMIqhTSNoS41KuI2LpPYKaUhDJj-x4QoyJFgHHsL7K_-T6xEyK0JoWCBKYGbSSeD5Uk3sOBLUvV94oyOtJzjzW86PnXo2Bn66_cjDhcyuNUHe3sENTsJHqp5-UrSP0laKpTHlwH2u8Dl7F-EewlAI7gu5gmI5z6ZA6QrMqVF65g4ck43NGlwHE2rLyT8ozoyV2JJbFfKHrIzukh8L2EkD_J_9KOwRev62GTwEGfYJq3TjUyabawe6tR8mXi3xVZsqK_LP28nQM_9LaGySjICjxYA

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js Show response
pagead2.googlesyndication.com/bg/ Frame E399 36 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

786addb7e1ae880b2d60304114f4651dedfaaaee2e9209d8e8fe9e2a314168db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 10:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55441
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14213
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 13:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 05 Apr 2024 10:38:28 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 4FBE 0
91 B 69ms
28ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Fri, 07 Apr 2023 02:02:29 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 62F2 0
20 B 58ms
58ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BEbFmtXkvZOepBuik3gOaiIbgCwAAAAA4AeAEAg&bg=!8_Cl8KTNAAYIJb0jKCU7ADkAdvg8Wm_NAQKIZRclR13IR-EUjMCjNgUxA5DZfsjDPekrvFc5aYCl4UEFDg86EEgCl30cbfIC5VcCAAAAj1IAAAABaAEHmQLjKA5zIKeMktmR8MsUlRssW9WCac35LWmOmFxrMomBWl9rb2COQ2I5_GAXUwlo9rXeUnh1u0M5SVQeIU8HlmQ4DG9hxd89_avVGGXqtZqMsLPeHzU2HPxLJOJZ6ZiqAZW0Jg-z-MhERSe_LjPEo_Nvsks0F-hmSQvx7i-T0sNmWR-6_SDiOpSfzRw5vubylb35Hk02_MPT9mPokhLNRBTwXG-YcPEdQU-WAWU9k3WS3UdNgg-Z-AAhb22XbPEBGver150XkdALtT1Y3UQaFkZJlwl3z6zvKy12Op2c4m6hs58-DwH0fz8_34_zrPc_XtntTJLuEaE41Sm9p4-JEawZCRYoZySy2dHnGAJWDYpIYY2bSXIf924qh3gCKDKUlswkg3EOmDxqGt9KumE_b2sUeW1vq5zze_Yp15uQOeDyQPJo2z3zwwk9bDUeXokdN7Yqge_G8A4P56PQkVq6ksBhilEhqwncSfC0U-t6-CWsJsFC2-_tbs0URUAW5j4qscBtZ4X6OBCmKA_Iu6LPMsL6CJ3xBIBelTCBRe92xiBLgTATpFQlV8OYbUEXR5tCdElwn_L1azEyL1cdhAuvqROsxHhjyuytfv17HhglVOw05wGj3gXqWdtOAojavryX49OSKD640utMNgHOMIaRkBAthoY6YVij6Sh56clFFiE0nlPqhtQlvpJkxUdWIjevjlcbHrXY53y3G-H1tmZMAvzXf5lOrpMFT9-IJtmGkjuUhSgahDqWNNkHAGkvjOdxyoBJe-hbfRHARFY0KsKkxPR76twCB2857COSXp3ci6WBuJwapxsZ2BZS9YZKOnFqTs24wIBbjRchvauxFsjxTQNJ4yX0jNJ1bctU-K42iYKtSVSMyqAXvRTU_lsfKYUfxY7eSd1CvQkgDYSJSqDbhymOwXCXlb49kd48K-fx5C8SMg28_3UoboAJTeqXu96eV_FTzqoD7gDVu-NdzEzCOuBPySW7Gw

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13FC 0
20 B 57ms
57ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BKMQVtXkvZOTEB5Kk3wOnkoDIBwAAAAA4AeAEAg&bg=!mpmlmc3NAAYIJb0jKCU7ADkAdvg8WjvRmwpSSr9oKs511qsndyBkbU9VGzjGOkIfn7c_5FOXmbLXkxUWOLDsIgRNLBIn0SuyPpwCAAAAgFIAAAACaAEHmQLk3WCQ-fwzO56Yg36v_Zy19u_LmL1k3L0fpoAzcYZoohGb-bXbFN2I58-hNVNuWZ1Q0bUwpFMqmjNeecPrFJi28H3Z9bBnfA2X86nZ80PDH9oNYqTT9JT5UOA1Usf4m-AI2zUYIiySI5N-tP3oZOa2vtEnMZFl_FgG_MyRh0PustVQ3y145W2dYnFY5k4NxT9ClywfFQbUO4YX8xyo4gUYAjXusPnnv8UuG5HDqhLt37nYN8d6GMbxCwvwUVUkf0h6DJrbc9RcGmrvZT1DP6bdgTr5wtrhd2OqUQy7rU-7OaMLb_FY2T5JKUCrAkTlMf-STpu-qHyRQv6uXB_o5yvJv62YsBjDTzzUSUYGR4c6A3lDykCHim3kdVH2YXYeux53FClfnM3T52LpLf8prs9FsnHrpAC8o7JiX1HLjuhVO0zzHyHen-zufHKdfKdTQA0962cxaGfookgZVvu-06o_Rz2e3e7RykOd9Vv6Cy0UadVSaHVE8nHVjlSfMrb710u2B6_O9G3MxEC6Ci-B2ByAU2HE85J8K7TlmLj_llrVjFaaZjiQPcnFobE1rhaU9Y4pQXcgFSBCIgEjJK5le1_a0AYfVQqNI0Gfu3pS4EOOz9ocTrFIqEAOAH43WUVd9rXbfdX9esOdZp_-rLx_ZRbXRMWmw5ALS49uElseNyYN47ZW9-UyxvZhjRoQDeZYsl7E9GMW_l1t0tVOH-jBpAlYld76hOCYBkLeu3PVR0xQSfDGQO1Gf739Xs-kve5Xl43WGSR4Faj617XGI2mK_5hrXLQKsLjuAkoNZYv_YJk17cd43Tu7nZ7rrpWUVenPqtAovjSH7oNpBZnjBl0ODn5gQxUVcnuReFCYIZR08Nwy12o-70tg6Vh1BW7gKqrzEwj3l0LuLQApAQcBad2zS4lu0JF8fbpDrW9kRgLMHVYSUDxiWa7QPUqtzUlI9uG_uFcJ0Mnn7stsWYPSKLj0SUiqqShaMXE

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
adv.office-partner.de/ Frame 9851 930 B
931 B 124ms
19ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbzv7tHkvZMzrH9ih7_UPxa6GiAWm5b2gaZWTnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTbAU_QBCl9qNbaLYwMZRpBvv58ZCaqBs2MJZ9lCZeUHDphiUBOgKegh_AMAoSQG5O8M6Hdz3aEXefQCbiAJ_zAa9Ax_GruH0vuUx8jLjdlRAzfavHfKQpwHoj3E4tdcYGT9ryln2bDY6jlbEHVf5kVxIvyUvgxzY4LFMGs0JleKHz4LctAgd3QKBPwH5nCt58SdKEZ4MyRI9QHtr4rLpEoIbQI6Z7-6bAuRXlPvduRxmpwUHf1h2PfKLKvXvfhp7fpG_FkwART9IDjX-YZwE2QXPwCpD9jA_hp8v1_0cAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3PJXkXxRPfX-sAICG2cXkaFC98Og%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DKfGuOEtm4TFY58-yJPig6DtB2ZXBvOFGO3n6sVyLWmV2LXQRLpnwjdJMI5IihnsbRBkdjtipc0WVa6jIAJIJXOphrdjHff3SC8B3fVBU29qELTWSKQILvH8JpnfwD7lCiqyAS6diz4qp5tKkD57ylqEehlhIKUnHpMECMNEhxObG9_Hs%26cry%3D1%26dbm_d%3DAKAmf-AymG3_uizAn7GiBCQWVHr6wma8RsK7KlHnaFtGB7lkFDTVU2gl3YKAghSjC1jgnck74_3IH-c1NvPpwjQPCdJCiU1nE4H55nUWWiqc78eT6sV5IsPG5k2-Y7rMO8F4W5W3b_vkK5dAP6xID3bJjPBxzF3b1PH7mNuepQSTZ37_3l61kAlDnsfomUYu4flTNlzYJWeacz_aI7Ti-FMKr4M5wRV0EmbuqKdNiiIkiFFUZ0C_do8ftnoQgBZolbkg8yy_Vd5cYcpT4iQTGUwR4_Iq-bwKzWIe0vL4nywuyZ2TBwyHveMnf5b_T2g74r2vXPpV4c3hcp9u7zHqso4f9XIIwRPndLtGNNzMHhSt_zGNxnbzzSqXHZFAapPyPV8PjhrtS1gBAy1uwePYdFFIRkjUydeS5_WvkupGCwSUdQEHS2Ki20HaSytXZTKHgsrWegFwf0JZ99ToqCu3nhympyG5HGdFki7yvYtHI6u_aMQAPRvYzfRUM5ON7MM_cTOBsT6WNoA7RnpmeAeLllYA2CZiuPFbbRJK-D5gBCtrMGk6cxFRZzL69BOemd2U43wQAbqwS6B71VvaTOFtALrG8mqmOaXirA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1294385852350&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Fri, 07 Apr 2023 02:02:29 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Fri, 14 Apr 2023 02:02:29 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 2D5B
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=60320400009337604444990012287013&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=60320400009337604444990012287013&actionid=981741&produktid=&dt_url=

0
606 B

129ms
46ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=60320400009337604444990012287013&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbzv7tHkvZMzrH9ih7_UPxa6GiAWm5b2gaZWTnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTbAU_QBCl9qNbaLYwMZRpBvv58ZCaqBs2MJZ9lCZeUHDphiUBOgKegh_AMAoSQG5O8M6Hdz3aEXefQCbiAJ_zAa9Ax_GruH0vuUx8jLjdlRAzfavHfKQpwHoj3E4tdcYGT9ryln2bDY6jlbEHVf5kVxIvyUvgxzY4LFMGs0JleKHz4LctAgd3QKBPwH5nCt58SdKEZ4MyRI9QHtr4rLpEoIbQI6Z7-6bAuRXlPvduRxmpwUHf1h2PfKLKvXvfhp7fpG_FkwART9IDjX-YZwE2QXPwCpD9jA_hp8v1_0cAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3PJXkXxRPfX-sAICG2cXkaFC98Og%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DKfGuOEtm4TFY58-yJPig6DtB2ZXBvOFGO3n6sVyLWmV2LXQRLpnwjdJMI5IihnsbRBkdjtipc0WVa6jIAJIJXOphrdjHff3SC8B3fVBU29qELTWSKQILvH8JpnfwD7lCiqyAS6diz4qp5tKkD57ylqEehlhIKUnHpMECMNEhxObG9_Hs%26cry%3D1%26dbm_d%3DAKAmf-AymG3_uizAn7GiBCQWVHr6wma8RsK7KlHnaFtGB7lkFDTVU2gl3YKAghSjC1jgnck74_3IH-c1NvPpwjQPCdJCiU1nE4H55nUWWiqc78eT6sV5IsPG5k2-Y7rMO8F4W5W3b_vkK5dAP6xID3bJjPBxzF3b1PH7mNuepQSTZ37_3l61kAlDnsfomUYu4flTNlzYJWeacz_aI7Ti-FMKr4M5wRV0EmbuqKdNiiIkiFFUZ0C_do8ftnoQgBZolbkg8yy_Vd5cYcpT4iQTGUwR4_Iq-bwKzWIe0vL4nywuyZ2TBwyHveMnf5b_T2g74r2vXPpV4c3hcp9u7zHqso4f9XIIwRPndLtGNNzMHhSt_zGNxnbzzSqXHZFAapPyPV8PjhrtS1gBAy1uwePYdFFIRkjUydeS5_WvkupGCwSUdQEHS2Ki20HaSytXZTKHgsrWegFwf0JZ99ToqCu3nhympyG5HGdFki7yvYtHI6u_aMQAPRvYzfRUM5ON7MM_cTOBsT6WNoA7RnpmeAeLllYA2CZiuPFbbRJK-D5gBCtrMGk6cxFRZzL69BOemd2U43wQAbqwS6B71VvaTOFtALrG8mqmOaXirA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1294385852350&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 07 Apr 2023 04:02:29 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Fri, 07 Apr 2023 02:02:29 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=60320400009337604444990012287013&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: D972D785:A9C0_91EFC182:01BB_642F79B5_1A4DA6E9:C02D

GET
H2

200

/ Show response
htlp.emp.de/ Frame 432E
Redirect Chain

https://www.awin1.com/cshow.php?s=2481820&v=14172&q=372914&r=296283&pref1=60320400009337604444990012287013&pv=1
https://htlp.emp.de/

3 KB
3 KB

141ms
22ms

Document
text/html

2600:9000:225e:2000:c:6264:8240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://htlp.emp.de/
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbzv7tHkvZMzrH9ih7_UPxa6GiAWm5b2gaZWTnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTbAU_QBCl9qNbaLYwMZRpBvv58ZCaqBs2MJZ9lCZeUHDphiUBOgKegh_AMAoSQG5O8M6Hdz3aEXefQCbiAJ_zAa9Ax_GruH0vuUx8jLjdlRAzfavHfKQpwHoj3E4tdcYGT9ryln2bDY6jlbEHVf5kVxIvyUvgxzY4LFMGs0JleKHz4LctAgd3QKBPwH5nCt58SdKEZ4MyRI9QHtr4rLpEoIbQI6Z7-6bAuRXlPvduRxmpwUHf1h2PfKLKvXvfhp7fpG_FkwART9IDjX-YZwE2QXPwCpD9jA_hp8v1_0cAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3PJXkXxRPfX-sAICG2cXkaFC98Og%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DKfGuOEtm4TFY58-yJPig6DtB2ZXBvOFGO3n6sVyLWmV2LXQRLpnwjdJMI5IihnsbRBkdjtipc0WVa6jIAJIJXOphrdjHff3SC8B3fVBU29qELTWSKQILvH8JpnfwD7lCiqyAS6diz4qp5tKkD57ylqEehlhIKUnHpMECMNEhxObG9_Hs%26cry%3D1%26dbm_d%3DAKAmf-AymG3_uizAn7GiBCQWVHr6wma8RsK7KlHnaFtGB7lkFDTVU2gl3YKAghSjC1jgnck74_3IH-c1NvPpwjQPCdJCiU1nE4H55nUWWiqc78eT6sV5IsPG5k2-Y7rMO8F4W5W3b_vkK5dAP6xID3bJjPBxzF3b1PH7mNuepQSTZ37_3l61kAlDnsfomUYu4flTNlzYJWeacz_aI7Ti-FMKr4M5wRV0EmbuqKdNiiIkiFFUZ0C_do8ftnoQgBZolbkg8yy_Vd5cYcpT4iQTGUwR4_Iq-bwKzWIe0vL4nywuyZ2TBwyHveMnf5b_T2g74r2vXPpV4c3hcp9u7zHqso4f9XIIwRPndLtGNNzMHhSt_zGNxnbzzSqXHZFAapPyPV8PjhrtS1gBAy1uwePYdFFIRkjUydeS5_WvkupGCwSUdQEHS2Ki20HaSytXZTKHgsrWegFwf0JZ99ToqCu3nhympyG5HGdFki7yvYtHI6u_aMQAPRvYzfRUM5ON7MM_cTOBsT6WNoA7RnpmeAeLllYA2CZiuPFbbRJK-D5gBCtrMGk6cxFRZzL69BOemd2U43wQAbqwS6B71VvaTOFtALrG8mqmOaXirA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1294385852350&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2000:c:6264:8240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6bb77d20dd85b4bfae78affeef6ee91869bffa0ef53ed9c8ab9c2a526d0180c5

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 5
cache-control: max-age=10
content-length: 2647
content-type: text/html
date: Fri, 07 Apr 2023 02:02:25 GMT
etag: "81767a046d18dbeec7092a1dbdc70325"
last-modified: Wed, 08 Jul 2020 09:51:56 GMT
server: AmazonS3
via: 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
x-amz-cf-id: UiBgxFYB5xqgsNivefS0S-LxMp2wcOtVGE5ctWGae1KnL2knQu2ybg==
x-amz-cf-pop: FRA60-P4
x-amz-version-id: Za5k1aCF3b8ugAP1.Dh5UJVd_ViDWDOf
x-cache: Hit from cloudfront

Redirect headers

Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0
Date: Fri, 07 Apr 2023 02:02:29 GMT
Location: https://htlp.emp.de/
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Strict-Transport-Security: max-age=86400

GET
H2 200 link.html Show response
track.webgains.com/ Frame 6318 2 KB
2 KB 191ms
78ms Script
text/html 35.176.154.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=60320400009337604444990012287013&nw=1
Requested by: Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.154.189 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-154-189.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 8cf9f1e2d121c1b0f89b06e880c2995905b0c78685f95fa480f13be4d7a714de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
last-modified: Fri, 07 Apr 2023 02:02:29 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 07 Apr 2023 02:03:29 GMT

GET
H2

200

activityi;dc_pre=CPGsi9fWlv4CFcqNsgod9DQICQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221 Show response
8019191.fls.doubleclick.net/ Frame 100C
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CPGsi9fWlv4CFcqNsgod9DQICQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221?

391 B
327 B

110ms
110ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CPGsi9fWlv4CFcqNsgod9DQICQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221?

Requested by

Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a2-19-44-80.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

154978ed7d58836f5049ef4bc114117dc277edabcd9c3bea69f868c3f487d0f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 07 Apr 2023 02:02:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CPGsi9fWlv4CFcqNsgod9DQICQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900013.redintelligence.net/ Frame 4B95 7 KB
3 KB 83ms
31ms Document
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=d1be01ecba&subid=&uid=2e0cfe3b3c637ca0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbzv7tHkvZMzrH9ih7_UPxa6GiAWm5b2gaZWTnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTbAU_QBCl9qNbaLYwMZRpBvv58ZCaqBs2MJZ9lCZeUHDphiUBOgKegh_AMAoSQG5O8M6Hdz3aEXefQCbiAJ_zAa9Ax_GruH0vuUx8jLjdlRAzfavHfKQpwHoj3E4tdcYGT9ryln2bDY6jlbEHVf5kVxIvyUvgxzY4LFMGs0JleKHz4LctAgd3QKBPwH5nCt58SdKEZ4MyRI9QHtr4rLpEoIbQI6Z7-6bAuRXlPvduRxmpwUHf1h2PfKLKvXvfhp7fpG_FkwART9IDjX-YZwE2QXPwCpD9jA_hp8v1_0cAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3PJXkXxRPfX-sAICG2cXkaFC98Og%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DKfGuOEtm4TFY58-yJPig6DtB2ZXBvOFGO3n6sVyLWmV2LXQRLpnwjdJMI5IihnsbRBkdjtipc0WVa6jIAJIJXOphrdjHff3SC8B3fVBU29qELTWSKQILvH8JpnfwD7lCiqyAS6diz4qp5tKkD57ylqEehlhIKUnHpMECMNEhxObG9_Hs%26cry%3D1%26dbm_d%3DAKAmf-AymG3_uizAn7GiBCQWVHr6wma8RsK7KlHnaFtGB7lkFDTVU2gl3YKAghSjC1jgnck74_3IH-c1NvPpwjQPCdJCiU1nE4H55nUWWiqc78eT6sV5IsPG5k2-Y7rMO8F4W5W3b_vkK5dAP6xID3bJjPBxzF3b1PH7mNuepQSTZ37_3l61kAlDnsfomUYu4flTNlzYJWeacz_aI7Ti-FMKr4M5wRV0EmbuqKdNiiIkiFFUZ0C_do8ftnoQgBZolbkg8yy_Vd5cYcpT4iQTGUwR4_Iq-bwKzWIe0vL4nywuyZ2TBwyHveMnf5b_T2g74r2vXPpV4c3hcp9u7zHqso4f9XIIwRPndLtGNNzMHhSt_zGNxnbzzSqXHZFAapPyPV8PjhrtS1gBAy1uwePYdFFIRkjUydeS5_WvkupGCwSUdQEHS2Ki20HaSytXZTKHgsrWegFwf0JZ99ToqCu3nhympyG5HGdFki7yvYtHI6u_aMQAPRvYzfRUM5ON7MM_cTOBsT6WNoA7RnpmeAeLllYA2CZiuPFbbRJK-D5gBCtrMGk6cxFRZzL69BOemd2U43wQAbqwS6B71VvaTOFtALrG8mqmOaXirA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1294385852350&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 5bc46ef69fc239622b30a56dcaa6f84474ba9e83a6dff779a9435189a1b8e0ba

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2224
Content-Type: text/html; charset=utf-8
Date: Fri, 07 Apr 2023 02:02:29 GMT
Expires: Fri, 07 Apr 2023 03:02:29 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 6318
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=60320400009337604444990012287013
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=60320400009337604444990012287013
https://ad-server.eu/wm/pb/native.png

68 B
312 B

291ms
46ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:04:51 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:A9C0_91EFC182:01BB_642F79B5_1A4DA6EC:C02D
X-IPLB-Instance: 40028
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 6318 43 B
702 B 236ms
187ms Image
image/gif 2.19.44.80
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2874697&v=22610&q=408799&r=296283&pref1=60320400009337604444990012287013&pv=1

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2.19.44.80 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 92E4 1 KB
643 B 21ms
20ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
etag: 48472445140208031
expires: Fri, 07 Apr 2023 09:37:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6318 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c890637f861ba2ed49fdd507202f8c6c559205e0f3be1b25009c43e5d49355e9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E399 0
20 B 58ms
57ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BbLAPtXkvZI7QCMrZ3wO8wZmoCwAAAAA4AeAEAg&bg=!LyylLHjNAAYIJb0jKCU7ADkAdvg8WtvjmiWyNxwQkm-JroNWmjCRNz6JEEAIJ8-DXS_IGvrMmbWEVAm2-oM7wY6OdNWI-2JRKpICAAAAcVIAAAADaAEHCgB2jc-Kkfx55LBmjoQ5XfxLOv3zcgmJ9rNS6VSJCBX2q7srT6bEt_jB8yzB86O61UjtRwcpF0wdQOMY1kK_ycOFbwJK2slfJlm-i2DfW0tPw1S7-6p43CUMGtfN0OfxPiZZJEw3nub5-C6g0kcTtDqfNVwRUB_HAJkC5OA8aAvpB3zzpymksdWZKCihKWqR3MdhqXIdV5KThBcqvl-kg5mMDJWhiZaSMDUkAz_2RIv_MBqncR5SFVqWRqv5hWrl5wKJyOQptlWz63VAyN1ns2r-c9kKG0intv_JxnIBPa4Ftm2_iGqRSPPTouOXWLivfJcpBMU3xqHLeCJybqF4XRg2GV7zLasDMPanrBU-ZswXa57S4kIC8CqcNID36J4P3xHr8bA2HIeR2XklHsSF6zbhKAiELe9Vws6WaA9cnZxV-MIn8Z1ZgxsoGo63Bqgs6bn6XQx_VtKaFBOfLiOGl4MCSGx6_VO9L9_J-CasL4kIIZlBFfDfxG0M2CkidLRPD-8ZDg3o9rIg1sxP_Q31IHWlYnediJbODytCkjDx2YhD55ZRng8X_wZxhjtdri6QmAfT-u2UAV08g0xMg0hhpy92y8FzKiDjQB3PsJiOX5PgtKHo5_y8NjHNntAl6GaXGqSAgxwwfWQvKx-i4-94RlGZlRNC71J4rLwnHXM27U472s0mM78dx4jpuAg4Xq7AGMI8aOMcVzDCiID4nRsHNYH-XD-7OMC59A2QwFUuCaf-QVLduNAc2PLUVvd4IaJa3fsbzdMaoLqNhB75ybEBTC41MAxvcMzk6P_EH9vQ9Y-Aa_hwUepbWgD7qKTNFW-_eMeCTBm4yKxEsK7AJxIP0swceA5ymOZp219CIecbAJOZgn8PL05vL0XZmdkY_lADMLlErdunXZrD-o9TDY-2vpbAq4dGiTSVAj5qhIh9vf6UAG8-AvHcEKhlVD5jfmsUCY6BdotWZC9EOiIfGNkfJnJPv7MClbuesM4-ylusP_fwTwqBnNfDloCdNCF1cM3ZIeKenz15XbMZHE3K7fuN5oB9oy2DH0KRl5IH7yAIUZ79Jo-W7Hgq5eAdsSeYkJ49NWGNFhQaUoarQajwJXsnQM15vTxhloGnuu2zvuBm7Tx6GYhVL9ao4n3HZQk1EY3u

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 92E4
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvIpBP7UClZfZsgU5UxBP1dd0AJiV0d30hQRFJ5twaIKNKewWh_SdT02wZ_LKC9m8eWRVc35J5VfmPj9iOM9mchOUS31H1HG&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvIpBP7UClZfZsgU5UxBP1dd0AJiV0d30hQRFJ5twaIKNKewWh_SdT02wZ_LKC9m8eWRVc35J5VfmPj9iOM9mchOUS31H1H...

43 B
431 B

191ms
178ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvIpBP7UClZfZsgU5UxBP1dd0AJiV0d30hQRFJ5twaIKNKewWh_SdT02wZ_LKC9m8eWRVc35J5VfmPj9iOM9mchOUS31H1HG&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAer7DvIpBP7UClZfZsgU5UxBP1dd0AJiV0d30hQRFJ5twaIKNKewWh_SdT02wZ_LKC9m8eWRVc35J5VfmPj9iOM9mchOUS31H1HG%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7b3eb0509c2469a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 337
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvIpBP7UClZfZsgU5UxBP1dd0AJiV0d30hQRFJ5twaIKNKewWh_SdT02wZ_LKC9m8eWRVc35J5VfmPj9iOM9mchOUS31H1HG&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAer7DvIpBP7UClZfZsgU5UxBP1dd0AJiV0d30hQRFJ5twaIKNKewWh_SdT02wZ_LKC9m8eWRVc35J5VfmPj9iOM9mchOUS31H1HG%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7b3eb04efb1269a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 92E4 70 B
264 B 50ms
46ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAIYOISvnAut0KKCzgPDeU4&google_cver=1&google_push=Aer7DvLtYAGslhy_Do1y5wgPproEQj3eieZrguyBuEo2U8kNmCf5jf-V4dfzyxS2HsOPyXobvMYU6mng-39q2Z2Ilf6jy_RmACE
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 adx
pr-bh.ybp.yahoo.com/sync/ Frame 92E4 0
531 B 159ms
47ms Image
text/plain 2a05:d018:d29:3602:f48d:cf88:c413:b006
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECqa4wIy-SLO2NkSsguxCJc&google_cver=1&google_push=Aer7DvKo6lyFgj4cK6VGLQnSminQXzBiubUjUH31QorAD--odyIfmemj84-iNWktz5mcqQPRbNeEkM-uaq2uw1B-UmRtzZW0CHiX

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:f48d:cf88:c413:b006 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 92E4
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEFV6fazvo6dGBzltfBFnajE&google_cver=1&google_push=Aer7DvIcXS9XiLQIX42HbJe4ZlrZ6_6VbhBSqUtmB4tVEyOkehF51izm1nB6JyFrl5m7xLkNpT1cW2xz...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEFV6fazvo6dGBzltfBFnajE&google_cver=1&google_push=Aer7DvIcXS9XiLQIX42HbJe4ZlrZ6_6VbhBSqUtmB4tVEyOkehF51izm1nB6JyFrl5m7xLkNpT1...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvIcXS9XiLQIX42HbJe4ZlrZ6_6VbhBSqUtmB4tVEyOkehF51izm1nB6JyFrl5m7xLkNpT1cW2xz...

170 B
188 B

34ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvIcXS9XiLQIX42HbJe4ZlrZ6_6VbhBSqUtmB4tVEyOkehF51izm1nB6JyFrl5m7xLkNpT1cW2xzLQczw6DOiHYCa10I-xa9

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvIcXS9XiLQIX42HbJe4ZlrZ6_6VbhBSqUtmB4tVEyOkehF51izm1nB6JyFrl5m7xLkNpT1cW2xzLQczw6DOiHYCa10I-xa9
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 92E4 43 B
351 B 83ms
30ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPJ6JUB7-BDEL3gqpc2sP0A&google_cver=1&google_push=Aer7DvLSflws0zRQyDvWmY4q4-1XV5g31PKrD9OlcUZDdrkm59jS0DYcWwluG6rEj1fzwWqPhcRyTx3CJVJOfeVYj8T7gh472qSn
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ivjlcrhj2gfn4h2ij3o7lf08jqctf1v6

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 92E4
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEN-szb7COlhxlKDvcnGR-jE&google_cver=1&google_push=Aer7DvLFoUqd_rSUajMJY2DmFakWqUWNyhRdTymfeIoZcDLgoU9ianLcFnfy12fDYIOIPlRyzEwRefVjte8oh7n...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Iw4l0y45Uelq8QgUnYvgFdly14U&google_push=Aer7DvLFoUqd_rSUajMJY2DmFakWqUWNyhRdTymfeIoZcDLgoU9ianLcFnfy12fDYIOIPlRyzEwRefVjte8oh7...

170 B
188 B

32ms
31ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Iw4l0y45Uelq8QgUnYvgFdly14U&google_push=Aer7DvLFoUqd_rSUajMJY2DmFakWqUWNyhRdTymfeIoZcDLgoU9ianLcFnfy12fDYIOIPlRyzEwRefVjte8oh7nQCZP-jdxzwbCG

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Iw4l0y45Uelq8QgUnYvgFdly14U&google_push=Aer7DvLFoUqd_rSUajMJY2DmFakWqUWNyhRdTymfeIoZcDLgoU9ianLcFnfy12fDYIOIPlRyzEwRefVjte8oh7nQCZP-jdxzwbCG
Date: Fri, 07 Apr 2023 02:02:29 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 92E4
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU7iddKRkxjjxIIGJLTmyU&google_cver=1&google_push=Aer7DvJlFLYLNW_Bd8_0rRQ_iffH4eNqTO9i1_NthizTirYbjyVO4j--cfwCJxdWg2ayHvpOJ8i...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHREctMjYtQUIxOA==&google_push=Aer7DvJlFLYLNW_Bd8_0rRQ_iffH4eNqTO9i1_NthizTirYbjyVO4j--cfwCJxdWg2ayHvpOJ8iqn-hHLCcjvYASAmgDEp04Qbi3

170 B
188 B

43ms
37ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHREctMjYtQUIxOA==&google_push=Aer7DvJlFLYLNW_Bd8_0rRQ_iffH4eNqTO9i1_NthizTirYbjyVO4j--cfwCJxdWg2ayHvpOJ8iqn-hHLCcjvYASAmgDEp04Qbi3

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHREctMjYtQUIxOA==&google_push=Aer7DvJlFLYLNW_Bd8_0rRQ_iffH4eNqTO9i1_NthizTirYbjyVO4j--cfwCJxdWg2ayHvpOJ8iqn-hHLCcjvYASAmgDEp04Qbi3
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f5982f4f9cc79eb2b489dda8b92e3144
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 92E4 0
12 B 30ms
28ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LCw0CzUcmBK6cX64m_jlsJktVv1a8jyXmEdt85ecGRbaQK5FTupUNLkQBngkf0MTMnC1F2

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 / Show response
adv.office-partner.de/ Frame 11BA 930 B
930 B 56ms
20ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqD-TtHkvZM7rH9ih7_UPxa6GiAWm5b2gaa2VnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgThAU_Q-V-Gmh-0fz912amR4z5TlcLqELdr-2HNPQHoF2FcPKqHGTkssUlboX5Ar-cu0Z-9EM5cuXqLq3tw5YjarvqFChGRN26PIWjYp9t8swHQnEGf-hZK75iVr7sRzyP_SsRKxFckcYqdoo4YiWENHAIdtcfGaL4L_AfAQkhFSOIZjmG2hTpH7yyAGHro4fbPkHXK22K0GZ-wVEM65AcaLIqNYngLXN2Hl91dxuhWYBdTs3GkEzt7KIaF04V8g02UH5p2G3T6g7vdi6Rn7SkG97xMdVQzAtXUzIZ3POGJgUWDg8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_2ppgnaPMXFN9W7uwrkFpS9gcqYQA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AzXjn2Xxjl86V6lSvoOz98dknSn1w5cxKRMD9-2PXIu3MzeSKWtUEO30smJqQcB5vr0MHxPPAMDkM1zmcZYPFjscfT4E2XxlUHqe5fL_CwLovOtNX5ks2XXo6w9X51BG2ueIE-h6c-cbQdx8W0j1KrjGivaj7jM9e-PcjW_-zvlxDUY5c%26cry%3D1%26dbm_d%3DAKAmf-ACJajHll1mUrDvA15-suNEYFMdoFuO5JmpJho0kBys4P17Ncwwmgp8lygeCGit109ehDEy4OdaM05gdLUcbccYLamPSY3coJdIqilRgfEhnFKOh05gB8QQD9AYzJM7fFjv9dsiU5BLJ81xnyiDvASQLWP1gJvdBDmmEa-tCl1stUHeIluC1btSrgKF-lbZWUWMzR-8AXvYRPpQ6W3VjI_MrdOrM5rnS4Q7N__ZjbD9xjKXHmoAgFqtz9vsz6KZMrcU92FM-UG0XvvclTWKFCEJaoBziKO1cvKLIe8J29ZXcScLrKfAJiul5OeFn_i-GSKZdQZnnYd8c1w1B6NUa3kkf2Vjix9_8JfRoSYmGkXfsCZHWZYqu8Mq7GkOzyIpTpSn6IJBoiaPIFKrCNNNpMSWdJNvrYPtWZPE85qrgjdb6NK5WuZKg4RLWGDE5gJg6FwTcqVua4GtwN-u2dykCRzqflZbSKtp1asK2Y-vGCiUiaagYMZft-2u6pC1l1MTd4JptIt8CO0C3pHzGX1zbtBFSUTi8JR-4EUzi47B6QjnwWINYvfDkfdilQyEUyj6tMiqYjGZVuxc5FcTrL9yflG8kILz0Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4398711972981&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Fri, 07 Apr 2023 02:02:29 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Fri, 14 Apr 2023 02:02:29 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 337C
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=68076200009422004444554012287021&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68076200009422004444554012287021&actionid=981741&produktid=&dt_url=

0
177 B

92ms
48ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68076200009422004444554012287021&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqD-TtHkvZM7rH9ih7_UPxa6GiAWm5b2gaa2VnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgThAU_Q-V-Gmh-0fz912amR4z5TlcLqELdr-2HNPQHoF2FcPKqHGTkssUlboX5Ar-cu0Z-9EM5cuXqLq3tw5YjarvqFChGRN26PIWjYp9t8swHQnEGf-hZK75iVr7sRzyP_SsRKxFckcYqdoo4YiWENHAIdtcfGaL4L_AfAQkhFSOIZjmG2hTpH7yyAGHro4fbPkHXK22K0GZ-wVEM65AcaLIqNYngLXN2Hl91dxuhWYBdTs3GkEzt7KIaF04V8g02UH5p2G3T6g7vdi6Rn7SkG97xMdVQzAtXUzIZ3POGJgUWDg8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_2ppgnaPMXFN9W7uwrkFpS9gcqYQA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AzXjn2Xxjl86V6lSvoOz98dknSn1w5cxKRMD9-2PXIu3MzeSKWtUEO30smJqQcB5vr0MHxPPAMDkM1zmcZYPFjscfT4E2XxlUHqe5fL_CwLovOtNX5ks2XXo6w9X51BG2ueIE-h6c-cbQdx8W0j1KrjGivaj7jM9e-PcjW_-zvlxDUY5c%26cry%3D1%26dbm_d%3DAKAmf-ACJajHll1mUrDvA15-suNEYFMdoFuO5JmpJho0kBys4P17Ncwwmgp8lygeCGit109ehDEy4OdaM05gdLUcbccYLamPSY3coJdIqilRgfEhnFKOh05gB8QQD9AYzJM7fFjv9dsiU5BLJ81xnyiDvASQLWP1gJvdBDmmEa-tCl1stUHeIluC1btSrgKF-lbZWUWMzR-8AXvYRPpQ6W3VjI_MrdOrM5rnS4Q7N__ZjbD9xjKXHmoAgFqtz9vsz6KZMrcU92FM-UG0XvvclTWKFCEJaoBziKO1cvKLIe8J29ZXcScLrKfAJiul5OeFn_i-GSKZdQZnnYd8c1w1B6NUa3kkf2Vjix9_8JfRoSYmGkXfsCZHWZYqu8Mq7GkOzyIpTpSn6IJBoiaPIFKrCNNNpMSWdJNvrYPtWZPE85qrgjdb6NK5WuZKg4RLWGDE5gJg6FwTcqVua4GtwN-u2dykCRzqflZbSKtp1asK2Y-vGCiUiaagYMZft-2u6pC1l1MTd4JptIt8CO0C3pHzGX1zbtBFSUTi8JR-4EUzi47B6QjnwWINYvfDkfdilQyEUyj6tMiqYjGZVuxc5FcTrL9yflG8kILz0Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4398711972981&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 07 Apr 2023 04:02:29 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Fri, 07 Apr 2023 02:02:29 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68076200009422004444554012287021&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:A9CC_91EFC182:01BB_642F79B5_1A4A4FD7:2FD2B

GET
H2

200

/ Show response
htlp.emp.de/ Frame 0A9F
Redirect Chain

https://www.awin1.com/cshow.php?s=2481790&v=14172&q=372911&r=296283&pref1=68076200009422004444554012287021&pv=1
https://htlp.emp.de/

3 KB
3 KB

98ms
23ms

Document
text/html

2600:9000:225e:2000:c:6264:8240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://htlp.emp.de/
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqD-TtHkvZM7rH9ih7_UPxa6GiAWm5b2gaa2VnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgThAU_Q-V-Gmh-0fz912amR4z5TlcLqELdr-2HNPQHoF2FcPKqHGTkssUlboX5Ar-cu0Z-9EM5cuXqLq3tw5YjarvqFChGRN26PIWjYp9t8swHQnEGf-hZK75iVr7sRzyP_SsRKxFckcYqdoo4YiWENHAIdtcfGaL4L_AfAQkhFSOIZjmG2hTpH7yyAGHro4fbPkHXK22K0GZ-wVEM65AcaLIqNYngLXN2Hl91dxuhWYBdTs3GkEzt7KIaF04V8g02UH5p2G3T6g7vdi6Rn7SkG97xMdVQzAtXUzIZ3POGJgUWDg8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_2ppgnaPMXFN9W7uwrkFpS9gcqYQA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AzXjn2Xxjl86V6lSvoOz98dknSn1w5cxKRMD9-2PXIu3MzeSKWtUEO30smJqQcB5vr0MHxPPAMDkM1zmcZYPFjscfT4E2XxlUHqe5fL_CwLovOtNX5ks2XXo6w9X51BG2ueIE-h6c-cbQdx8W0j1KrjGivaj7jM9e-PcjW_-zvlxDUY5c%26cry%3D1%26dbm_d%3DAKAmf-ACJajHll1mUrDvA15-suNEYFMdoFuO5JmpJho0kBys4P17Ncwwmgp8lygeCGit109ehDEy4OdaM05gdLUcbccYLamPSY3coJdIqilRgfEhnFKOh05gB8QQD9AYzJM7fFjv9dsiU5BLJ81xnyiDvASQLWP1gJvdBDmmEa-tCl1stUHeIluC1btSrgKF-lbZWUWMzR-8AXvYRPpQ6W3VjI_MrdOrM5rnS4Q7N__ZjbD9xjKXHmoAgFqtz9vsz6KZMrcU92FM-UG0XvvclTWKFCEJaoBziKO1cvKLIe8J29ZXcScLrKfAJiul5OeFn_i-GSKZdQZnnYd8c1w1B6NUa3kkf2Vjix9_8JfRoSYmGkXfsCZHWZYqu8Mq7GkOzyIpTpSn6IJBoiaPIFKrCNNNpMSWdJNvrYPtWZPE85qrgjdb6NK5WuZKg4RLWGDE5gJg6FwTcqVua4GtwN-u2dykCRzqflZbSKtp1asK2Y-vGCiUiaagYMZft-2u6pC1l1MTd4JptIt8CO0C3pHzGX1zbtBFSUTi8JR-4EUzi47B6QjnwWINYvfDkfdilQyEUyj6tMiqYjGZVuxc5FcTrL9yflG8kILz0Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4398711972981&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2000:c:6264:8240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6bb77d20dd85b4bfae78affeef6ee91869bffa0ef53ed9c8ab9c2a526d0180c5

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 5
cache-control: max-age=10
content-length: 2647
content-type: text/html
date: Fri, 07 Apr 2023 02:02:25 GMT
etag: "81767a046d18dbeec7092a1dbdc70325"
last-modified: Wed, 08 Jul 2020 09:51:56 GMT
server: AmazonS3
via: 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
x-amz-cf-id: P_8FH5u2b1FJFo93L8MqGiHLKHSg9if6Ci9tbaQo45-HWPzrCNVo_A==
x-amz-cf-pop: FRA60-P4
x-amz-version-id: Za5k1aCF3b8ugAP1.Dh5UJVd_ViDWDOf
x-cache: Hit from cloudfront

Redirect headers

Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0
Date: Fri, 07 Apr 2023 02:02:29 GMT
Location: https://htlp.emp.de/
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Strict-Transport-Security: max-age=86400

GET
H2 200 link.html Show response
track.webgains.com/ Frame 7091 2 KB
2 KB 140ms
94ms Script
text/html 35.176.154.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=68076200009422004444554012287021&nw=1
Requested by: Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.154.189 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-154-189.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: eb0243f143f675c1830d232b37cf7d5abdc937d9b3c08ecad22c14f76a6374b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
last-modified: Fri, 07 Apr 2023 02:02:29 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 07 Apr 2023 02:03:29 GMT

GET
H2

200

activityi;dc_pre=CIy9jdfWlv4CFZOMsgodvPEK6Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918 Show response
8019191.fls.doubleclick.net/ Frame 3222
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CIy9jdfWlv4CFZOMsgodvPEK6Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918?

391 B
288 B

102ms
101ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CIy9jdfWlv4CFZOMsgodvPEK6Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918?

Requested by

Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8e6c9525fdaad7d6f29bad1e1261ca8ce7cb28cbb63b81ce127d008f811ac0e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 219
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 07 Apr 2023 02:02:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CIy9jdfWlv4CFZOMsgodvPEK6Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900021.redintelligence.net/ Frame 87BC 7 KB
2 KB 77ms
28ms Document
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=482db6c3aa&subid=&uid=97968bc23eb40d61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqD-TtHkvZM7rH9ih7_UPxa6GiAWm5b2gaa2VnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgThAU_Q-V-Gmh-0fz912amR4z5TlcLqELdr-2HNPQHoF2FcPKqHGTkssUlboX5Ar-cu0Z-9EM5cuXqLq3tw5YjarvqFChGRN26PIWjYp9t8swHQnEGf-hZK75iVr7sRzyP_SsRKxFckcYqdoo4YiWENHAIdtcfGaL4L_AfAQkhFSOIZjmG2hTpH7yyAGHro4fbPkHXK22K0GZ-wVEM65AcaLIqNYngLXN2Hl91dxuhWYBdTs3GkEzt7KIaF04V8g02UH5p2G3T6g7vdi6Rn7SkG97xMdVQzAtXUzIZ3POGJgUWDg8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_2ppgnaPMXFN9W7uwrkFpS9gcqYQA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AzXjn2Xxjl86V6lSvoOz98dknSn1w5cxKRMD9-2PXIu3MzeSKWtUEO30smJqQcB5vr0MHxPPAMDkM1zmcZYPFjscfT4E2XxlUHqe5fL_CwLovOtNX5ks2XXo6w9X51BG2ueIE-h6c-cbQdx8W0j1KrjGivaj7jM9e-PcjW_-zvlxDUY5c%26cry%3D1%26dbm_d%3DAKAmf-ACJajHll1mUrDvA15-suNEYFMdoFuO5JmpJho0kBys4P17Ncwwmgp8lygeCGit109ehDEy4OdaM05gdLUcbccYLamPSY3coJdIqilRgfEhnFKOh05gB8QQD9AYzJM7fFjv9dsiU5BLJ81xnyiDvASQLWP1gJvdBDmmEa-tCl1stUHeIluC1btSrgKF-lbZWUWMzR-8AXvYRPpQ6W3VjI_MrdOrM5rnS4Q7N__ZjbD9xjKXHmoAgFqtz9vsz6KZMrcU92FM-UG0XvvclTWKFCEJaoBziKO1cvKLIe8J29ZXcScLrKfAJiul5OeFn_i-GSKZdQZnnYd8c1w1B6NUa3kkf2Vjix9_8JfRoSYmGkXfsCZHWZYqu8Mq7GkOzyIpTpSn6IJBoiaPIFKrCNNNpMSWdJNvrYPtWZPE85qrgjdb6NK5WuZKg4RLWGDE5gJg6FwTcqVua4GtwN-u2dykCRzqflZbSKtp1asK2Y-vGCiUiaagYMZft-2u6pC1l1MTd4JptIt8CO0C3pHzGX1zbtBFSUTi8JR-4EUzi47B6QjnwWINYvfDkfdilQyEUyj6tMiqYjGZVuxc5FcTrL9yflG8kILz0Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4398711972981&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 20cd417f6fe880ea3b7b587569adef8b3d0d4d76fc1a1da194cdf83e5bf0c773

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2072
Content-Type: text/html; charset=utf-8
Date: Fri, 07 Apr 2023 02:02:29 GMT
Expires: Fri, 07 Apr 2023 03:02:29 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 7091
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=68076200009422004444554012287021
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=68076200009422004444554012287021
https://ad-server.eu/wm/pb/native.png

68 B
312 B

231ms
43ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:04:51 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:A9CC_91EFC182:01BB_642F79B5_1A4A4FDC:2FD2B
X-IPLB-Instance: 40027
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A557 1 KB
643 B 20ms
19ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
etag: 48472445140208031
expires: Fri, 07 Apr 2023 09:37:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7091 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 549b849f9c5eecd3ee548c493aed94f497c1ac979a0235322c367b2af18e2d2b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame 4B95 4 KB
743 B 30ms
29ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

26571ae4861f75f6b179d6c4870f00765f88119fcfef3f8c7ee642f11275ea52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 00:45:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4B95 57 KB
57 KB 146ms
95ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 88cd129e2e38e8ae8e1f6c6f5726b58356bc8ca95a90a2442f7c4c6370672af8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 57892
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4B95 66 KB
66 KB 178ms
129ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 39e3920a13177b3ff89a5b8329af9535ad8b0941464047c9a06513d07a547648

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4B95 63 KB
63 KB 193ms
140ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/38440/creativesup/72409_Teaser_Reachgroup_1200x627_4.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 456fe34e9ed36420cffae3075a85b0a9afa44c6873400c83a6d1da9828190d2d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 64305
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4B95 63 KB
63 KB 168ms
115ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/59171/creativesup/vega-1200x627.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 703505693837721682f8444e593e18086a4be15b95ee440098a55a26a9155825

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 64164
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 / Show response
adv.office-partner.de/ Frame B0A1 930 B
930 B 19ms
19ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsar9tHkvZM_rH9ih7_UPxa6GiAWm5b2gaYWVnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTdAU_QhSleM7BjU0PzTVwDgU-A4kTQ381V9PpX3uuXcBtQ7Gev1knl_1c6b3Rvyj3XJ6S4y0eLjGLRa7UKZU3UFbfVmJkwXM7TRAXmkQPmwJLzDsb3McfMQftKGBTDe9ZN8CYbJPOJdqZcuInLgrjgr22JA_p7t1slPYin8IpHQdItNIHXaXM6dDan06XWVrWmK0K-h6s9D_35CAHd1HbHDps1ml88C-ClarW_LGdu1Znqd1uKcdZBUTXtSrtYntCU9wnhfbY_6mf2kpZ2aUYQbUDnh2YlpJ1bHtlukTZpwATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBPMnNkS0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3OKTWX7LiUytysTzVY47YYUzwl4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CTdq-SdslnqQz2WUFx7hwg2ev6tev_Fn_zkkkX7blfRmKGhA1fJJTp1ngy7HNeXOFdvKAxvOVZqNBZ2CprdNqZ4b8__38l9AUqL3W5d_43pq6WyJZ8hrxq9a5B3hF7PGBPvpoe9kVm5Q-zWjUG7AFcPVvjknXCXrBZrZAfBHzvz3HDPYw%26cry%3D1%26dbm_d%3DAKAmf-B2dRtFtJNdjh3KXFcYhBjd7rz09ih4iv8QFhP1137J3KuQaFe5N0ILso5l4wJSgs8QBsjGabZuoFuaJzGASNApDZuPI0eET1Y1tfoZ6okE0GZSGCI3-ZklLjlviGIbGZeJES4DtUMXof9qvHvDOp7TKSSFILevffZKx_kMZ0SXo8xFrT9_eeDTVjpjow1kLylu7zsSDk8PggXqn0cE_ms9Jx2ntT-AMrh1FfDypeSq9n-hYBnINxSSsPQzDyEwM_0IcK4jlAvbjGIoFti0BBWXwB_SC7ONn77UEsvDJtPAwW0w3dTYfskx-hMNhDr_hSUKzKJRVaKtsSojNcfNDtZhoUvTTzfpGlmIoV5XH0rueuVAqyJfPCM3wuI7MfA3Qv01l0rnPgvsBMzO0HGuST3FCPuz4smEWcxxnMt64iOx6PaaHZy1r-9-Ib_Capsqgu_rhBa20L2Kd1fpWUEaDKq7mxwOgzfvMdPbRw-y46YFcnKjnufl3BmkqW11ivwDhzp6TgN2VuyKQG3r6i62eJ3r8Co4ObJiITbb84MlWcGmEDZUM-MrdJTt2ZUAwAXn5s_l2VPcJdtMUMke3S4TtMpR4dVnlA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8178197468759&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Fri, 07 Apr 2023 02:02:29 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Fri, 14 Apr 2023 02:02:29 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 0AA7
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=11705700010568104444550012287005&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=11705700010568104444550012287005&actionid=981741&produktid=&dt_url=

0
179 B

71ms
49ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=11705700010568104444550012287005&actionid=981741&produktid=&dt_url=

Requested by

Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsar9tHkvZM_rH9ih7_UPxa6GiAWm5b2gaYWVnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTdAU_QhSleM7BjU0PzTVwDgU-A4kTQ381V9PpX3uuXcBtQ7Gev1knl_1c6b3Rvyj3XJ6S4y0eLjGLRa7UKZU3UFbfVmJkwXM7TRAXmkQPmwJLzDsb3McfMQftKGBTDe9ZN8CYbJPOJdqZcuInLgrjgr22JA_p7t1slPYin8IpHQdItNIHXaXM6dDan06XWVrWmK0K-h6s9D_35CAHd1HbHDps1ml88C-ClarW_LGdu1Znqd1uKcdZBUTXtSrtYntCU9wnhfbY_6mf2kpZ2aUYQbUDnh2YlpJ1bHtlukTZpwATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBPMnNkS0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3OKTWX7LiUytysTzVY47YYUzwl4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CTdq-SdslnqQz2WUFx7hwg2ev6tev_Fn_zkkkX7blfRmKGhA1fJJTp1ngy7HNeXOFdvKAxvOVZqNBZ2CprdNqZ4b8__38l9AUqL3W5d_43pq6WyJZ8hrxq9a5B3hF7PGBPvpoe9kVm5Q-zWjUG7AFcPVvjknXCXrBZrZAfBHzvz3HDPYw%26cry%3D1%26dbm_d%3DAKAmf-B2dRtFtJNdjh3KXFcYhBjd7rz09ih4iv8QFhP1137J3KuQaFe5N0ILso5l4wJSgs8QBsjGabZuoFuaJzGASNApDZuPI0eET1Y1tfoZ6okE0GZSGCI3-ZklLjlviGIbGZeJES4DtUMXof9qvHvDOp7TKSSFILevffZKx_kMZ0SXo8xFrT9_eeDTVjpjow1kLylu7zsSDk8PggXqn0cE_ms9Jx2ntT-AMrh1FfDypeSq9n-hYBnINxSSsPQzDyEwM_0IcK4jlAvbjGIoFti0BBWXwB_SC7ONn77UEsvDJtPAwW0w3dTYfskx-hMNhDr_hSUKzKJRVaKtsSojNcfNDtZhoUvTTzfpGlmIoV5XH0rueuVAqyJfPCM3wuI7MfA3Qv01l0rnPgvsBMzO0HGuST3FCPuz4smEWcxxnMt64iOx6PaaHZy1r-9-Ib_Capsqgu_rhBa20L2Kd1fpWUEaDKq7mxwOgzfvMdPbRw-y46YFcnKjnufl3BmkqW11ivwDhzp6TgN2VuyKQG3r6i62eJ3r8Co4ObJiITbb84MlWcGmEDZUM-MrdJTt2ZUAwAXn5s_l2VPcJdtMUMke3S4TtMpR4dVnlA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8178197468759&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 07 Apr 2023 04:02:29 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Fri, 07 Apr 2023 02:02:29 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=11705700010568104444550012287005&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: D972D785:A9E2_91EFC182:01BB_642F79B5_1A4DA6EB:C02D

GET
H2

200

/ Show response
htlp.emp.de/ Frame F0C5
Redirect Chain

https://www.awin1.com/cshow.php?s=2481790&v=14172&q=372911&r=296283&pref1=11705700010568104444550012287005&pv=1
https://htlp.emp.de/

3 KB
3 KB

69ms
24ms

Document
text/html

2600:9000:225e:2000:c:6264:8240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://htlp.emp.de/
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsar9tHkvZM_rH9ih7_UPxa6GiAWm5b2gaYWVnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTdAU_QhSleM7BjU0PzTVwDgU-A4kTQ381V9PpX3uuXcBtQ7Gev1knl_1c6b3Rvyj3XJ6S4y0eLjGLRa7UKZU3UFbfVmJkwXM7TRAXmkQPmwJLzDsb3McfMQftKGBTDe9ZN8CYbJPOJdqZcuInLgrjgr22JA_p7t1slPYin8IpHQdItNIHXaXM6dDan06XWVrWmK0K-h6s9D_35CAHd1HbHDps1ml88C-ClarW_LGdu1Znqd1uKcdZBUTXtSrtYntCU9wnhfbY_6mf2kpZ2aUYQbUDnh2YlpJ1bHtlukTZpwATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBPMnNkS0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3OKTWX7LiUytysTzVY47YYUzwl4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CTdq-SdslnqQz2WUFx7hwg2ev6tev_Fn_zkkkX7blfRmKGhA1fJJTp1ngy7HNeXOFdvKAxvOVZqNBZ2CprdNqZ4b8__38l9AUqL3W5d_43pq6WyJZ8hrxq9a5B3hF7PGBPvpoe9kVm5Q-zWjUG7AFcPVvjknXCXrBZrZAfBHzvz3HDPYw%26cry%3D1%26dbm_d%3DAKAmf-B2dRtFtJNdjh3KXFcYhBjd7rz09ih4iv8QFhP1137J3KuQaFe5N0ILso5l4wJSgs8QBsjGabZuoFuaJzGASNApDZuPI0eET1Y1tfoZ6okE0GZSGCI3-ZklLjlviGIbGZeJES4DtUMXof9qvHvDOp7TKSSFILevffZKx_kMZ0SXo8xFrT9_eeDTVjpjow1kLylu7zsSDk8PggXqn0cE_ms9Jx2ntT-AMrh1FfDypeSq9n-hYBnINxSSsPQzDyEwM_0IcK4jlAvbjGIoFti0BBWXwB_SC7ONn77UEsvDJtPAwW0w3dTYfskx-hMNhDr_hSUKzKJRVaKtsSojNcfNDtZhoUvTTzfpGlmIoV5XH0rueuVAqyJfPCM3wuI7MfA3Qv01l0rnPgvsBMzO0HGuST3FCPuz4smEWcxxnMt64iOx6PaaHZy1r-9-Ib_Capsqgu_rhBa20L2Kd1fpWUEaDKq7mxwOgzfvMdPbRw-y46YFcnKjnufl3BmkqW11ivwDhzp6TgN2VuyKQG3r6i62eJ3r8Co4ObJiITbb84MlWcGmEDZUM-MrdJTt2ZUAwAXn5s_l2VPcJdtMUMke3S4TtMpR4dVnlA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8178197468759&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2000:c:6264:8240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6bb77d20dd85b4bfae78affeef6ee91869bffa0ef53ed9c8ab9c2a526d0180c5

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 5
cache-control: max-age=10
content-length: 2647
content-type: text/html
date: Fri, 07 Apr 2023 02:02:25 GMT
etag: "81767a046d18dbeec7092a1dbdc70325"
last-modified: Wed, 08 Jul 2020 09:51:56 GMT
server: AmazonS3
via: 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
x-amz-cf-id: Y-CD48V4RXiTKumVy54ebGv1TtyqBsk88b1Qkb4479N2fsa-WO8ViQ==
x-amz-cf-pop: FRA60-P4
x-amz-version-id: Za5k1aCF3b8ugAP1.Dh5UJVd_ViDWDOf
x-cache: Hit from cloudfront

Redirect headers

Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0
Date: Fri, 07 Apr 2023 02:02:29 GMT
Location: https://htlp.emp.de/
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Strict-Transport-Security: max-age=86400

GET
H2 200 link.html Show response
track.webgains.com/ Frame E15F 2 KB
2 KB 88ms
83ms Script
text/html 35.176.154.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=11705700010568104444550012287005&nw=1
Requested by: Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.154.189 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-154-189.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: b6d2dcfd562556be84253e6cdf1f163e7d24899a53630d0bc5451471954aafdb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
last-modified: Fri, 07 Apr 2023 02:02:29 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 07 Apr 2023 02:03:29 GMT

GET
H3

200

activityi;dc_pre=CM71jdfWlv4CFUnFsgodh_0I1A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423 Show response
8019191.fls.doubleclick.net/ Frame 115D
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CM71jdfWlv4CFUnFsgodh_0I1A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423?

391 B
241 B

75ms
74ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CM71jdfWlv4CFUnFsgodh_0I1A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423?

Requested by

Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c00a421a49979beb1679f060da835d97cbb6d4a226057c75722797a108528f09

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 07 Apr 2023 02:02:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CM71jdfWlv4CFUnFsgodh_0I1A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90005.redintelligence.net/ Frame 0E4B 7 KB
2 KB 79ms
29ms Document
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=cdb33fa40b&subid=&uid=6d81e38bebb55f90&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsar9tHkvZM_rH9ih7_UPxa6GiAWm5b2gaYWVnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTdAU_QhSleM7BjU0PzTVwDgU-A4kTQ381V9PpX3uuXcBtQ7Gev1knl_1c6b3Rvyj3XJ6S4y0eLjGLRa7UKZU3UFbfVmJkwXM7TRAXmkQPmwJLzDsb3McfMQftKGBTDe9ZN8CYbJPOJdqZcuInLgrjgr22JA_p7t1slPYin8IpHQdItNIHXaXM6dDan06XWVrWmK0K-h6s9D_35CAHd1HbHDps1ml88C-ClarW_LGdu1Znqd1uKcdZBUTXtSrtYntCU9wnhfbY_6mf2kpZ2aUYQbUDnh2YlpJ1bHtlukTZpwATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBPMnNkS0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_3OKTWX7LiUytysTzVY47YYUzwl4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CTdq-SdslnqQz2WUFx7hwg2ev6tev_Fn_zkkkX7blfRmKGhA1fJJTp1ngy7HNeXOFdvKAxvOVZqNBZ2CprdNqZ4b8__38l9AUqL3W5d_43pq6WyJZ8hrxq9a5B3hF7PGBPvpoe9kVm5Q-zWjUG7AFcPVvjknXCXrBZrZAfBHzvz3HDPYw%26cry%3D1%26dbm_d%3DAKAmf-B2dRtFtJNdjh3KXFcYhBjd7rz09ih4iv8QFhP1137J3KuQaFe5N0ILso5l4wJSgs8QBsjGabZuoFuaJzGASNApDZuPI0eET1Y1tfoZ6okE0GZSGCI3-ZklLjlviGIbGZeJES4DtUMXof9qvHvDOp7TKSSFILevffZKx_kMZ0SXo8xFrT9_eeDTVjpjow1kLylu7zsSDk8PggXqn0cE_ms9Jx2ntT-AMrh1FfDypeSq9n-hYBnINxSSsPQzDyEwM_0IcK4jlAvbjGIoFti0BBWXwB_SC7ONn77UEsvDJtPAwW0w3dTYfskx-hMNhDr_hSUKzKJRVaKtsSojNcfNDtZhoUvTTzfpGlmIoV5XH0rueuVAqyJfPCM3wuI7MfA3Qv01l0rnPgvsBMzO0HGuST3FCPuz4smEWcxxnMt64iOx6PaaHZy1r-9-Ib_Capsqgu_rhBa20L2Kd1fpWUEaDKq7mxwOgzfvMdPbRw-y46YFcnKjnufl3BmkqW11ivwDhzp6TgN2VuyKQG3r6i62eJ3r8Co4ObJiITbb84MlWcGmEDZUM-MrdJTt2ZUAwAXn5s_l2VPcJdtMUMke3S4TtMpR4dVnlA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8178197468759&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 97bc38140b768680cb19a6f26f6d737cb49e71d74ec255131fa9a6df993e55ce

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2085
Content-Type: text/html; charset=utf-8
Date: Fri, 07 Apr 2023 02:02:29 GMT
Expires: Fri, 07 Apr 2023 03:02:29 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame E15F
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11705700010568104444550012287005
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11705700010568104444550012287005
https://ad-server.eu/wm/pb/native.png

68 B
312 B

229ms
45ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:04:51 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:A9E2_91EFC182:01BB_642F79B5_1A4DA6EE:C02D
X-IPLB-Instance: 40028
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F05F 1 KB
643 B 20ms
19ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
etag: 48472445140208031
expires: Fri, 07 Apr 2023 09:37:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E15F 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b14e3ae53353a0017d0e789d17ed3317f8f9939622091b77f4c6092e738caa2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 87BC 4 KB
647 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

26571ae4861f75f6b179d6c4870f00765f88119fcfef3f8c7ee642f11275ea52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 00:39:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 87BC 12 KB
12 KB 78ms
27ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: c2005905b60fdde61a1b654cfaff56f6dea19554eaa9be6e7560e2ebb6c5e59b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12073
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 87BC 11 KB
11 KB 140ms
80ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: cda591e4f1d4b2ba6b19396c03cbfd43c6151d437fc46faea9de24079cb9990b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 11558
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 87BC 11 KB
12 KB 270ms
158ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/38440/creativesup/72409_Teaser_Reachgroup_1200x627_1.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: eddf4045421a28f49b168251536900cc4732b3badcdf2e63b4f672c1bc7a74da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 11716
Vary: Accept-Encoding
Content-Type: image/png

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame A557
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvLAU-QhHzIuS5AFNbSN3jlKoQcFiIuJC5J3SxGvyY1i5MNKo2JeK-bdAvkqpGJmMChmdKTR_yhoYugf4NxMotizrF2_XFUT&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvLAU-QhHzIuS5AFNbSN3jlKoQcFiIuJC5J3SxGvyY1i5MNKo2JeK-bdAvkqpGJmMChmdKTR_yhoYugf4NxMotizrF2_XFU...

43 B
383 B

178ms
177ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvLAU-QhHzIuS5AFNbSN3jlKoQcFiIuJC5J3SxGvyY1i5MNKo2JeK-bdAvkqpGJmMChmdKTR_yhoYugf4NxMotizrF2_XFUT&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAer7DvLAU-QhHzIuS5AFNbSN3jlKoQcFiIuJC5J3SxGvyY1i5MNKo2JeK-bdAvkqpGJmMChmdKTR_yhoYugf4NxMotizrF2_XFUT%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7b3eb050fc5a69a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 354
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvLAU-QhHzIuS5AFNbSN3jlKoQcFiIuJC5J3SxGvyY1i5MNKo2JeK-bdAvkqpGJmMChmdKTR_yhoYugf4NxMotizrF2_XFUT&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAer7DvLAU-QhHzIuS5AFNbSN3jlKoQcFiIuJC5J3SxGvyY1i5MNKo2JeK-bdAvkqpGJmMChmdKTR_yhoYugf4NxMotizrF2_XFUT%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7b3eb04f7b6969a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame A557 70 B
264 B 58ms
53ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAIYOISvnAut0KKCzgPDeU4&google_cver=1&google_push=Aer7DvKF8W_pt61J6LdRPlbBFXqc6MUCPv0h6AR28IaxGVnYX8t7iU7cOsptw57-ra8BQqzaiXbLoLmh5fTsjpwge37eOYzX3yCr
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A557
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEFV6fazvo6dGBzltfBFnajE&google_cver=1&google_push=Aer7DvKX1q8Ab8YjOod2TLM8ikhpfPWQt7Fm1i39SuWApi8iHMbVki2t79LWOKYpUxbebwY5Jjo_Glbo...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTY5OTE1OTEwOTI2Nzg3NzA2MA&google_push=Aer7DvKX1q8Ab8YjOod2TLM8ikhpfPWQt7Fm1i39SuWApi8iHMbVki2t79LWOKYpUxbebwY5Jjo_Gl...

170 B
188 B

40ms
38ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTY5OTE1OTEwOTI2Nzg3NzA2MA&google_push=Aer7DvKX1q8Ab8YjOod2TLM8ikhpfPWQt7Fm1i39SuWApi8iHMbVki2t79LWOKYpUxbebwY5Jjo_GlboR7WLob1eCJi-6j2mJnX9oQ

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTY5OTE1OTEwOTI2Nzg3NzA2MA&google_push=Aer7DvKX1q8Ab8YjOod2TLM8ikhpfPWQt7Fm1i39SuWApi8iHMbVki2t79LWOKYpUxbebwY5Jjo_GlboR7WLob1eCJi-6j2mJnX9oQ
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dds
rtb.openx.net/sync/ Frame A557 43 B
135 B 36ms
31ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPJ6JUB7-BDEL3gqpc2sP0A&google_cver=1&google_push=Aer7DvLxZmt-6A-BQwNEmKtUkngutwDGXrzyNQeN6A_HsZwhOO_AQQDCR9BVKqJeGJDHX0abGQzMQ8RbN_NDVUWshKBg5BCd8-iGxg
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:28 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: i57jm0nu0jrn71ofcll33ki82ok8gvcc

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A557
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEN-szb7COlhxlKDvcnGR-jE&google_cver=1&google_push=Aer7DvJxHmI60OrNxnNZIr7X0JYTM_d1ZfnmuAwX9FYz4kgH5wxfEAZD66QAMjXraFXJGlb_Ffl_U-E2SUuuxD4...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Iw4l0y45Uelq8QgUnYvgFdly14U&google_push=Aer7DvJxHmI60OrNxnNZIr7X0JYTM_d1ZfnmuAwX9FYz4kgH5wxfEAZD66QAMjXraFXJGlb_Ffl_U-E2SUuuxD...

170 B
188 B

32ms
31ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Iw4l0y45Uelq8QgUnYvgFdly14U&google_push=Aer7DvJxHmI60OrNxnNZIr7X0JYTM_d1ZfnmuAwX9FYz4kgH5wxfEAZD66QAMjXraFXJGlb_Ffl_U-E2SUuuxD4Le4NzzBPKM4rN1w

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Iw4l0y45Uelq8QgUnYvgFdly14U&google_push=Aer7DvJxHmI60OrNxnNZIr7X0JYTM_d1ZfnmuAwX9FYz4kgH5wxfEAZD66QAMjXraFXJGlb_Ffl_U-E2SUuuxD4Le4NzzBPKM4rN1w
Date: Fri, 07 Apr 2023 02:02:30 GMT
Connection: keep-alive
Content-Length: 244
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A557
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU7iddKRkxjjxIIGJLTmyU&google_cver=1&google_push=Aer7DvJMCUEMDPpKH8yah7fEyPjRelYB5bnOJ1BymMd9VUVAtvYihzETLKRzCryGyrWf_wAPXJL...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHRlAtMUwtQUxXNA==&google_push=Aer7DvJMCUEMDPpKH8yah7fEyPjRelYB5bnOJ1BymMd9VUVAtvYihzETLKRzCryGyrWf_wAPXJLOe2TNH0ygVZz7HniQ-4mDfzhstg

170 B
188 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHRlAtMUwtQUxXNA==&google_push=Aer7DvJMCUEMDPpKH8yah7fEyPjRelYB5bnOJ1BymMd9VUVAtvYihzETLKRzCryGyrWf_wAPXJLOe2TNH0ygVZz7HniQ-4mDfzhstg

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHRlAtMUwtQUxXNA==&google_push=Aer7DvJMCUEMDPpKH8yah7fEyPjRelYB5bnOJ1BymMd9VUVAtvYihzETLKRzCryGyrWf_wAPXJLOe2TNH0ygVZz7HniQ-4mDfzhstg
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f5982f4f9cc79eb2b489dda8b92e3144
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A557
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKCYQaIknVxxA2yOocZRu_8hrF7MCXdy...

170 B
188 B

34ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKCYQaIknVxxA2yOocZRu_8hrF7MCXdyb6x2ThxAZoJtjx9K6bHaU554NUs_oDNoqkoH4_vV650h3EphmzB1eVX7ZTUCPAQsA

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKCYQaIknVxxA2yOocZRu_8hrF7MCXdyb6x2ThxAZoJtjx9K6bHaU554NUs_oDNoqkoH4_vV650h3EphmzB1eVX7ZTUCPAQsA
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A557 0
12 B 34ms
30ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KqItXw-bdN9HtbuE3U8gzd0uknC1fU3vv43LMIEi456_-Y0XeNFXr2-Bi9dYcz7W-iU2pE

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 9851 106 KB
41 KB 37ms
35ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

586b49eb7382c2053f169e64d93def14dc7344ee39e2829475f029cd2fa021be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41504
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 01:18:01 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 11BA 111 KB
42 KB 59ms
57ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8af860e5734d337c3ba85c38397c6028e21176eca2d2d4b4da3672de2aae55a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43324
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 01:18:01 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame B0A1 106 KB
41 KB 68ms
67ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b697d35c5e311053bab9671a4995c0d03e9dfc88b00b83981a43502ef27cd474

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41519
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 01:18:01 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H/1.1 200
OK viewability Show response
hal900013.redintelligence.net/ Frame 4B95 0
150 B 97ms
34ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/viewability?s=60320400009337604444990012287013&a=786d0345&vb=m
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 / Show response
adv.office-partner.de/ Frame DB9F 930 B
930 B 20ms
19ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8d2422fb23&subid=&uid=54ca0bf6e9ec849c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCmqotHkvZM3rH9ih7_UPxa6GiAWm5b2gab2TnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTeAU_Q38ChnYHge-hiWilxxbd39eiBFQ2I_czJYOwGwok2ODxOSlyzjho3M3N06EfEfAIN0XEjGBGkYKW0y3umq4UFVu7GiZQdIwanwxyBXu6lxLPCHGQaCTnDMmAKCqtRyHoxb-lTUwogXKvaLNg3UBOQSzlUtw6brtdX-69cJgJExuWdQhRFED3cIGXVk5VlmlOGQsZE-pLRWjoZpxP9OHY-b9NxD_L7jfI3pOtOfsivEWkolgMcKwmAmQ6NNy834dmfOtxNLpR08PNLZncor5tJ_n79f_lm9E1642D-I8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_1jzQMJRjSq2-Oll9TVLzdPeJXRAA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DxRNLgRNfY5kgvF8FBV69wur63DtvYY-24z7yZHwnGTPavdfcVNseNcjbGBF6D3yz3oZphq2lM4twyUu8J56fMthxEd11c1zxeZvjl10qK8XSQxYX8tZqwbl7fv5268kstlBPDBBg-Fz0OEzrcSm56-zxxCPT1DQ2JxKLtwMgdPJSvlCM%26cry%3D1%26dbm_d%3DAKAmf-AoBSqlMd-pgHvgweMHczP6KPJcnZ-hOzNtE4p0AYfccJ3VqhbmdWkVDH_RQmlGky3m4mV8JqxH4pMnXd_kI6_M4v-nPRvQCO3dwa1phX25-4KDt7NizZpNT_dMmEnhKLGadif1cXwFkVI0qrDc8xyWB-bDLCerBDX9bgww5hayBsevcWvayUaR6YZf5Cjb2dliN6jXMABHYEo_Bweqy05ckrVIYD4Lzp2ovS39CTWLnSSFBSW2-pNOi_apQ-izCNX2RhUEMpJe6ec3B-qTJnyRzrtDmh78SFLK-93Nk3Cq1oW84PiJRS1xA_tiKZN36Iqq-b7PKcsJSnq1fyHDGUAZZqw28f4KfHvF9QDDTSjQbJ9bGMwaqHsmJbOWdRbtWC6fxSuN1wE7tm2CHsngRcIl5gSc_BD5emexB96JNZJ_QjA54X1I51iHjmQ7osWR6exWm-yfTv7-edRGjvvo-ZoJ1esStv9QAyLk530dgLogs9nOyrTP-jrez6xspooLPNpgfhN1ltNr_A0APK_5N-cwSxcmX3h9h-Ax9LG1mV-2uHYupCWG8V6OmPu2xLf76zaxmxcWzz0poo_d9TRBHLSocx_IDg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3974010007366&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Fri, 07 Apr 2023 02:02:29 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Fri, 14 Apr 2023 02:02:29 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 444E
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=58658400010370004444994012287030&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=58658400010370004444994012287030&actionid=981741&produktid=&dt_url=

0
178 B

44ms
39ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=58658400010370004444994012287030&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8d2422fb23&subid=&uid=54ca0bf6e9ec849c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCmqotHkvZM3rH9ih7_UPxa6GiAWm5b2gab2TnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTeAU_Q38ChnYHge-hiWilxxbd39eiBFQ2I_czJYOwGwok2ODxOSlyzjho3M3N06EfEfAIN0XEjGBGkYKW0y3umq4UFVu7GiZQdIwanwxyBXu6lxLPCHGQaCTnDMmAKCqtRyHoxb-lTUwogXKvaLNg3UBOQSzlUtw6brtdX-69cJgJExuWdQhRFED3cIGXVk5VlmlOGQsZE-pLRWjoZpxP9OHY-b9NxD_L7jfI3pOtOfsivEWkolgMcKwmAmQ6NNy834dmfOtxNLpR08PNLZncor5tJ_n79f_lm9E1642D-I8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_1jzQMJRjSq2-Oll9TVLzdPeJXRAA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DxRNLgRNfY5kgvF8FBV69wur63DtvYY-24z7yZHwnGTPavdfcVNseNcjbGBF6D3yz3oZphq2lM4twyUu8J56fMthxEd11c1zxeZvjl10qK8XSQxYX8tZqwbl7fv5268kstlBPDBBg-Fz0OEzrcSm56-zxxCPT1DQ2JxKLtwMgdPJSvlCM%26cry%3D1%26dbm_d%3DAKAmf-AoBSqlMd-pgHvgweMHczP6KPJcnZ-hOzNtE4p0AYfccJ3VqhbmdWkVDH_RQmlGky3m4mV8JqxH4pMnXd_kI6_M4v-nPRvQCO3dwa1phX25-4KDt7NizZpNT_dMmEnhKLGadif1cXwFkVI0qrDc8xyWB-bDLCerBDX9bgww5hayBsevcWvayUaR6YZf5Cjb2dliN6jXMABHYEo_Bweqy05ckrVIYD4Lzp2ovS39CTWLnSSFBSW2-pNOi_apQ-izCNX2RhUEMpJe6ec3B-qTJnyRzrtDmh78SFLK-93Nk3Cq1oW84PiJRS1xA_tiKZN36Iqq-b7PKcsJSnq1fyHDGUAZZqw28f4KfHvF9QDDTSjQbJ9bGMwaqHsmJbOWdRbtWC6fxSuN1wE7tm2CHsngRcIl5gSc_BD5emexB96JNZJ_QjA54X1I51iHjmQ7osWR6exWm-yfTv7-edRGjvvo-ZoJ1esStv9QAyLk530dgLogs9nOyrTP-jrez6xspooLPNpgfhN1ltNr_A0APK_5N-cwSxcmX3h9h-Ax9LG1mV-2uHYupCWG8V6OmPu2xLf76zaxmxcWzz0poo_d9TRBHLSocx_IDg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3974010007366&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 07 Apr 2023 04:02:29 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Fri, 07 Apr 2023 02:02:29 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=58658400010370004444994012287030&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:A9FA_91EFC182:01BB_642F79B5_1A47621C:2FD2D

GET
H2 200 link.html Show response
track.webgains.com/ Frame 5F0E 2 KB
2 KB 91ms
90ms Script
text/html 35.176.154.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=58658400010370004444994012287030&nw=1
Requested by: Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.154.189 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-154-189.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 0492dc58ab114a6cc40c228dbb88346818e68d714feba5031a14131899cb6205

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
last-modified: Fri, 07 Apr 2023 02:02:29 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 07 Apr 2023 02:03:29 GMT

GET
H3

200

activityi;dc_pre=CMj3m9fWlv4CFV2LsgodmpUOqA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362 Show response
8019191.fls.doubleclick.net/ Frame F81F
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CMj3m9fWlv4CFV2LsgodmpUOqA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362?

391 B
239 B

65ms
65ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CMj3m9fWlv4CFV2LsgodmpUOqA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362?

Requested by

Host: beste-spruche.exchangereviwes.com
URL: http://beste-spruche.exchangereviwes.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-13-224-189-55.fra2.r.cloudfront.net

Software

cafe /

Resource Hash

1533384bb50573e6ef1e62131b1c9f6965f9636a08fb7aee7dbbe7a9f4b158b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 216
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 07 Apr 2023 02:02:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Apr 2023 02:02:29 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CMj3m9fWlv4CFV2LsgodmpUOqA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900030.redintelligence.net/ Frame 46E1 7 KB
2 KB 93ms
34ms Document
text/html 136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/request_content.php?s=58658400010370004444994012287030&a=669d98d0
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8d2422fb23&subid=&uid=54ca0bf6e9ec849c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCmqotHkvZM3rH9ih7_UPxa6GiAWm5b2gab2TnKfJD_AuEAEghveGJmCV-vCBjAfIAQmpApO9qMyYUbI-qAMBqgTeAU_Q38ChnYHge-hiWilxxbd39eiBFQ2I_czJYOwGwok2ODxOSlyzjho3M3N06EfEfAIN0XEjGBGkYKW0y3umq4UFVu7GiZQdIwanwxyBXu6lxLPCHGQaCTnDMmAKCqtRyHoxb-lTUwogXKvaLNg3UBOQSzlUtw6brtdX-69cJgJExuWdQhRFED3cIGXVk5VlmlOGQsZE-pLRWjoZpxP9OHY-b9NxD_L7jfI3pOtOfsivEWkolgMcKwmAmQ6NNy834dmfOtxNLpR08PNLZncor5tJ_n79f_lm9E1642D-I8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATzJzZEtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB%26sig%3DAOD64_1jzQMJRjSq2-Oll9TVLzdPeJXRAA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DxRNLgRNfY5kgvF8FBV69wur63DtvYY-24z7yZHwnGTPavdfcVNseNcjbGBF6D3yz3oZphq2lM4twyUu8J56fMthxEd11c1zxeZvjl10qK8XSQxYX8tZqwbl7fv5268kstlBPDBBg-Fz0OEzrcSm56-zxxCPT1DQ2JxKLtwMgdPJSvlCM%26cry%3D1%26dbm_d%3DAKAmf-AoBSqlMd-pgHvgweMHczP6KPJcnZ-hOzNtE4p0AYfccJ3VqhbmdWkVDH_RQmlGky3m4mV8JqxH4pMnXd_kI6_M4v-nPRvQCO3dwa1phX25-4KDt7NizZpNT_dMmEnhKLGadif1cXwFkVI0qrDc8xyWB-bDLCerBDX9bgww5hayBsevcWvayUaR6YZf5Cjb2dliN6jXMABHYEo_Bweqy05ckrVIYD4Lzp2ovS39CTWLnSSFBSW2-pNOi_apQ-izCNX2RhUEMpJe6ec3B-qTJnyRzrtDmh78SFLK-93Nk3Cq1oW84PiJRS1xA_tiKZN36Iqq-b7PKcsJSnq1fyHDGUAZZqw28f4KfHvF9QDDTSjQbJ9bGMwaqHsmJbOWdRbtWC6fxSuN1wE7tm2CHsngRcIl5gSc_BD5emexB96JNZJ_QjA54X1I51iHjmQ7osWR6exWm-yfTv7-edRGjvvo-ZoJ1esStv9QAyLk530dgLogs9nOyrTP-jrez6xspooLPNpgfhN1ltNr_A0APK_5N-cwSxcmX3h9h-Ax9LG1mV-2uHYupCWG8V6OmPu2xLf76zaxmxcWzz0poo_d9TRBHLSocx_IDg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3974010007366&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: a266ec1e28a767a1259e1afd3016c814eb4babbc033ac08c4ba406cf9edc7d35

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2106
Content-Type: text/html; charset=utf-8
Date: Fri, 07 Apr 2023 02:02:29 GMT
Expires: Fri, 07 Apr 2023 03:02:29 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 5F0E
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=58658400010370004444994012287030
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=58658400010370004444994012287030
https://ad-server.eu/wm/pb/native.png

68 B
312 B

220ms
46ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:04:51 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:A9F6_91EFC182:01BB_642F79B5_1A4BFFB5:C02A
X-IPLB-Instance: 40028
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1

200
OK

inv.gif
img.tradedoubler.com/images/ Frame 5F0E
Redirect Chain

https://impfr.tradedoubler.com/imp?type(inv)g(24495172)a(1565155)epi(58658400010370004444994012287030)095303469
https://img.tradedoubler.com/images/inv.gif

43 B
644 B

135ms
22ms

Image
image/gif

13.224.189.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.tradedoubler.com/images/inv.gif

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

13.224.189.55 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Fri, 31 Mar 2023 04:31:11 GMT
Via: 1.1 f046bfa1468bb4385e357c8c9128cf50.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA2-C1
Age: 595878
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Fri, 19 Nov 2004 15:35:04 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: image/gif
Accept-Ranges: bytes
X-Amz-Cf-Id: _wdwXSxc_ImIHIkj-tEMBDMQMN7IGvHVsuoQC2EOejxHic_YQPZc8A==

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
referrer-policy: origin
server: TXServerHttp
p3p: policyref="http://tracker.tradedoubler.com/w3c/p3p.xml",CP="NOI DSP COR NID CUR OUR NOR"
location: https://img.tradedoubler.com/images/inv.gif
access-control-allow-origin: *
content-type: text/html; charset=ISO-8859-1
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248

GET
H3 200 css
fonts.googleapis.com/ Frame 0E4B 1 KB
416 B 41ms
40ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

11f7aab214169f28971cedc0a242ab0613a00a552496f2f0956ab0ae2853b993

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 00:50:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0E4B 16 KB
16 KB 171ms
30ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 3c20115855c2b31a5f77a2e67da59832f3971de07fef8b81a9a5a44ee79681fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0E4B 16 KB
16 KB 167ms
29ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 6b56d0efe474264cd7c11120b3aa2d90f81483d902ab4fd621487eb33d11a439

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16231
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0E4B 16 KB
16 KB 332ms
189ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/38440/creativesup/72409_Teaser_Reachgroup_1200x627_1.jpg
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: a68663fbf39d07913fa88f09b8eba8b4331895cfb9f45f1688766e9d7c211e82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16217
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 4B95 13 KB
13 KB 22ms
21ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900013.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:32:58 GMT
x-content-type-options: nosniff
age: 228571
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:32:58 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 4B95 13 KB
13 KB 23ms
22ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900013.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:31:05 GMT
x-content-type-options: nosniff
age: 228684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:31:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4C02 1 KB
643 B 37ms
20ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Apr 2023 09:37:27 GMT
etag: 48472445140208031
expires: Fri, 07 Apr 2023 09:37:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame F05F
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvJRUTq4OpAiWXO_RQkws1oogErJ9-VHTKe8_tI40huusfnKaiC9ItYXUzE25MkYW-uZ4F9xct5Z_7E6ltfyfc0T8ie1BuT9c...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvJRUTq4OpAiWXO_RQkws1oogErJ9-VHTKe8_tI40huusfnKaiC9ItYXUzE25MkYW-uZ4F9xct5Z_7E6ltfyfc0T8ie1BuT...

43 B
537 B

174ms
173ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvJRUTq4OpAiWXO_RQkws1oogErJ9-VHTKe8_tI40huusfnKaiC9ItYXUzE25MkYW-uZ4F9xct5Z_7E6ltfyfc0T8ie1BuT9cQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAer7DvJRUTq4OpAiWXO_RQkws1oogErJ9-VHTKe8_tI40huusfnKaiC9ItYXUzE25MkYW-uZ4F9xct5Z_7E6ltfyfc0T8ie1BuT9cQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7b3eb0513c8c69a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 331
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvJRUTq4OpAiWXO_RQkws1oogErJ9-VHTKe8_tI40huusfnKaiC9ItYXUzE25MkYW-uZ4F9xct5Z_7E6ltfyfc0T8ie1BuT9cQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAer7DvJRUTq4OpAiWXO_RQkws1oogErJ9-VHTKe8_tI40huusfnKaiC9ItYXUzE25MkYW-uZ4F9xct5Z_7E6ltfyfc0T8ie1BuT9cQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7b3eb04febbd69a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame F05F 70 B
264 B 59ms
50ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAIYOISvnAut0KKCzgPDeU4&google_cver=1&google_push=Aer7DvIHV5hFdfsZsmTpQBRGHVLN37Dz8XGSyb1_-GqBEZvRBlvSe2-JRQ00lpkKy_s3t8LuX3c6WZZxc3Rtns7H_ZcWK20M2eZhCQ
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 adx
pr-bh.ybp.yahoo.com/sync/ Frame F05F 0
530 B 58ms
50ms Image
text/plain 2a05:d018:d29:3602:f48d:cf88:c413:b006
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECqa4wIy-SLO2NkSsguxCJc&google_cver=1&google_push=Aer7DvLiQuXpjPu61WgYy0SIQCLtsI9a_bO7s5v-ypwj8Ff3CItVFyXNsUOgYj9RHFBnSTu2j855nMQuWvOagcx_7lv8-1Ui_bLA

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:f48d:cf88:c413:b006 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F05F
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEFV6fazvo6dGBzltfBFnajE&google_cver=1&google_push=Aer7DvJ4OZ_UewZefBDO-gLt8aBL0QGqamVZWtQQm1NT9o5nGFod7pK5TEhW8kJLG9wW4Q0kzh6ITs5n...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvJ4OZ_UewZefBDO-gLt8aBL0QGqamVZWtQQm1NT9o5nGFod7pK5TEhW8kJLG9wW4Q0kzh6ITs5n...

170 B
188 B

36ms
34ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvJ4OZ_UewZefBDO-gLt8aBL0QGqamVZWtQQm1NT9o5nGFod7pK5TEhW8kJLG9wW4Q0kzh6ITs5n9HbSBNzDlrzL3XQP9ZZVJg

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvJ4OZ_UewZefBDO-gLt8aBL0QGqamVZWtQQm1NT9o5nGFod7pK5TEhW8kJLG9wW4Q0kzh6ITs5n9HbSBNzDlrzL3XQP9ZZVJg
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 200 dds
rtb.openx.net/sync/ Frame F05F 43 B
64 B 44ms
36ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPJ6JUB7-BDEL3gqpc2sP0A&google_cver=1&google_push=Aer7DvLQrjBYZektg_QE0SmTlH46Bj9aseNJUux_Ff9aPi38ZbRmXNqj8snRr_6XbaDkTsWM4lcujCscmg4VrbbXLAqAPSF2RuzWJg
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: tlhrdiladu69fbh2u9lo1gt7candancq

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F05F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU7iddKRkxjjxIIGJLTmyU&google_cver=1&google_push=Aer7DvIbe8f0k0lqLobR8DOQ3iWLLjEaXna2SsT-S4qdbgpFs5Uks9PlZ2_gqg6w4ioBpgeJaYK...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHRlAtVC1LQjM1&google_push=Aer7DvIbe8f0k0lqLobR8DOQ3iWLLjEaXna2SsT-S4qdbgpFs5Uks9PlZ2_gqg6w4ioBpgeJaYKAFPQjeu7Tp70s9PWK7gzjBlvwbQ

170 B
188 B

35ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHRlAtVC1LQjM1&google_push=Aer7DvIbe8f0k0lqLobR8DOQ3iWLLjEaXna2SsT-S4qdbgpFs5Uks9PlZ2_gqg6w4ioBpgeJaYKAFPQjeu7Tp70s9PWK7gzjBlvwbQ

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHRlAtVC1LQjM1&google_push=Aer7DvIbe8f0k0lqLobR8DOQ3iWLLjEaXna2SsT-S4qdbgpFs5Uks9PlZ2_gqg6w4ioBpgeJaYKAFPQjeu7Tp70s9PWK7gzjBlvwbQ
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F05F
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKWm2EPOBKqZEbYcKIRRGnmA6sm9ewps...

170 B
188 B

35ms
34ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKWm2EPOBKqZEbYcKIRRGnmA6sm9ewpsbrF01Ac7_cTjRBi17iSzaqeinj2gpQZ7BMNUl1C4bde-RrRXZRDFbcwlNhZvcTwfg

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKWm2EPOBKqZEbYcKIRRGnmA6sm9ewpsbrF01Ac7_cTjRBi17iSzaqeinj2gpQZ7BMNUl1C4bde-RrRXZRDFbcwlNhZvcTwfg
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F05F 0
12 B 42ms
35ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JjbYRMqIp7scZ10KbfwtcStm3ewdyLoOq8-FvGKQl1KE0N0C5T1C8MlnLB5r7Fn_bTcQ_M

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 5F0E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eaa5630dc423bc60995968dd62546e14b9159f02b9fed589317fb886ebe6173d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 dc_pre=CPGsi9fWlv4CFcqNsgod9DQICQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221
adservice.google.com/ddm/fls/z/ Frame 100C 42 B
63 B 59ms
59ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPGsi9fWlv4CFcqNsgod9DQICQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CPGsi9fWlv4CFcqNsgod9DQICQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7574669629931.221?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900021.redintelligence.net/ Frame 87BC 0
150 B 77ms
26ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/viewability?s=68076200009422004444554012287021&a=043b7a0c&vb=m
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6318 85 KB
31 KB 131ms
23ms Script
text/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=60320400009337604444990012287013&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 09:11:08 GMT
content-encoding: gzip
via: 1.1 7efdfc8e9ebc26758933b0151e22707e.cloudfront.net (CloudFront)
last-modified: Wed, 15 Mar 2023 17:26:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 60682
etag: W/"876c293e6c37046ecb0c11ce2e276942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: 3PJ7Ld9wYWIg6Z-LKUxZYkeU6amYWtK6uZyo2updlj6YxoBk1RKLJw==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 6318 3 KB
3 KB 91ms
20ms Image
image/png 99.86.4.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1680833249&Signature=hTegkgna5W5Ccaowo6GjDQDJKx2Bv4wX9ujDfk7GSpdbAJq2gZHKVtxEsOFk7hfALFENsT7YXxwToS7r4yYwX-rRCGoCnk5UVJRYomqAXeWqwrGMKDyZ3tgJAwukuA5Vz2oSjIDMV3R9PtXElhoZNa5KA7y9pF7Q1I7fOBXtDMeNHMGGKA47Q43YVEYuWlQslnTJGSO9QU5oQiBbcrA5IBbtGSG0pWORr0h2WbOGn9-lVAWktH1oKlAzc8p8QQ31veMpkxciPsVSDH-1bHhaQPl2FFXyN~qXn6LiOs0cNCcJfDX4AzQRzJQmQt~hpIJB9f0HxbKcoxETYCbwhD-dkw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-36.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 06 Apr 2023 03:12:28 GMT
via: 1.1 35c75b7f0ca8c787d67c8ebd22bc7fc2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 82202
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: owd7tjcocOY1halwKcxfi6IWfuabcOw4v0ABgmvsMwKBMmTz5lo11w==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame E15F 85 KB
31 KB 150ms
42ms Script
text/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=11705700010568104444550012287005&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 09:11:08 GMT
content-encoding: gzip
via: 1.1 7efdfc8e9ebc26758933b0151e22707e.cloudfront.net (CloudFront)
last-modified: Wed, 15 Mar 2023 17:26:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 60682
etag: W/"876c293e6c37046ecb0c11ce2e276942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: DOHxATs1y0pM8ffCvAj5Yilx9TFGm5s5echOlz7YXWLubHOMGTiXRw==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame E15F 3 KB
3 KB 90ms
21ms Image
image/png 99.86.4.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1680833249&Signature=hTegkgna5W5Ccaowo6GjDQDJKx2Bv4wX9ujDfk7GSpdbAJq2gZHKVtxEsOFk7hfALFENsT7YXxwToS7r4yYwX-rRCGoCnk5UVJRYomqAXeWqwrGMKDyZ3tgJAwukuA5Vz2oSjIDMV3R9PtXElhoZNa5KA7y9pF7Q1I7fOBXtDMeNHMGGKA47Q43YVEYuWlQslnTJGSO9QU5oQiBbcrA5IBbtGSG0pWORr0h2WbOGn9-lVAWktH1oKlAzc8p8QQ31veMpkxciPsVSDH-1bHhaQPl2FFXyN~qXn6LiOs0cNCcJfDX4AzQRzJQmQt~hpIJB9f0HxbKcoxETYCbwhD-dkw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=11705700010568104444550012287005&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-36.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 06 Apr 2023 03:12:28 GMT
via: 1.1 35c75b7f0ca8c787d67c8ebd22bc7fc2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 82202
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: U9Uxon6wHoxZRUSMmLynZV6_oX8ISV8C29YCQyFnHu9__CtM7YTP4g==

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame DB9F 106 KB
41 KB 32ms
29ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b697d35c5e311053bab9671a4995c0d03e9dfc88b00b83981a43502ef27cd474

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41519
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 01:18:01 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H3 200 dc_pre=CM71jdfWlv4CFUnFsgodh_0I1A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423
adservice.google.com/ddm/fls/z/ Frame 115D 42 B
63 B 58ms
58ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CM71jdfWlv4CFUnFsgodh_0I1A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CM71jdfWlv4CFUnFsgodh_0I1A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1514346578897.423?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pre=CIy9jdfWlv4CFZOMsgodvPEK6Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918
adservice.google.com/ddm/fls/z/ Frame 3222 42 B
63 B 62ms
57ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CIy9jdfWlv4CFZOMsgodvPEK6Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CIy9jdfWlv4CFZOMsgodvPEK6Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=763036061796.1918?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 7091 85 KB
31 KB 95ms
44ms Script
text/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=68076200009422004444554012287021&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 09:11:08 GMT
content-encoding: gzip
via: 1.1 7efdfc8e9ebc26758933b0151e22707e.cloudfront.net (CloudFront)
last-modified: Wed, 15 Mar 2023 17:26:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 60682
etag: W/"876c293e6c37046ecb0c11ce2e276942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: 0j9_hx5Cmi9kx-2mtf6Zct_-_DWeMpvWljCS1y38eKiB0ANyNk3XrQ==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 7091 3 KB
3 KB 35ms
21ms Image
image/png 99.86.4.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1680833249&Signature=LTvNuntrzts1LrLqLiOjwVUe0nMEJlCtKa5UB~F8CeHp4Hk0PfX578kgncA0GRJoXPR-47P86VnX-YDKUKNRrxsIJP76CNss~SAs1M0C9Sciq9slGKXhLLTweE7F9XSeNBUtRArhcB~bVxwxEd4l~LRMCoSB~tGCEoaFNaoGJyxrqmCSQJ9dU-K-mUMf0m~ERR6W6GuFg7P7hdrRS0Aq2qf6WTyKBPQKvhd9nhhLANwx90oyN1XSUTSkcKf~1cpkA8FORNPPssPASGs8PxElz7X4tCFhr7eo-RPpjjwxWIeBoRjwLA9c32IN8YaWsWLMZgALldk9Hr-FnadQriCAYQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-36.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 07 Apr 2023 01:41:39 GMT
via: 1.1 35c75b7f0ca8c787d67c8ebd22bc7fc2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 1251
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: zgC9to0czg75rvARABftAHYl5pIipi4u4MZvTuBvpuHihkD8NGtysg==

GET
H/1.1 200
OK viewability Show response
hal90005.redintelligence.net/ Frame 0E4B 0
150 B 85ms
33ms Script
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/viewability?s=11705700010568104444550012287005&a=3d35d1fa&vb=m
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 css
fonts.googleapis.com/ Frame 46E1 4 KB
647 B 32ms
31ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=58658400010370004444994012287030&a=669d98d0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

26571ae4861f75f6b179d6c4870f00765f88119fcfef3f8c7ee642f11275ea52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 07 Apr 2023 02:02:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 07 Apr 2023 00:34:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 07 Apr 2023 02:02:29 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 46E1 18 KB
18 KB 80ms
30ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/23333/creativesup/1200x627_Matthias.jpg
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=58658400010370004444994012287030&a=669d98d0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 93e90fb3bca946ef293db98976cd8edd9579db5969689d1fbaa6a932a1b3e9e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 18610
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 46E1 16 KB
16 KB 79ms
27ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=58658400010370004444994012287030&a=669d98d0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 3c20115855c2b31a5f77a2e67da59832f3971de07fef8b81a9a5a44ee79681fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 46E1 16 KB
16 KB 83ms
25ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=58658400010370004444994012287030&a=669d98d0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 6b56d0efe474264cd7c11120b3aa2d90f81483d902ab4fd621487eb33d11a439

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16231
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 87BC 13 KB
13 KB 24ms
22ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900021.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:32:58 GMT
x-content-type-options: nosniff
age: 228571
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:32:58 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 87BC 13 KB
13 KB 26ms
24ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900021.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:31:05 GMT
x-content-type-options: nosniff
age: 228684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:31:05 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame 4C02 43 B
389 B 201ms
193ms Image
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEHxML9NzbHFrCLZ2eFMigOE&google_cver=1&google_push=Aer7DvIug_nA5H2DDfnkwrMsHwFkGiWCSNVtcYH7kkI-XVMZtE2_gNxYqJzO5gDGpsSeBWHfNC8G6hG-Lwrz90RxNZCVh-nm7TjexA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAer7DvIug_nA5H2DDfnkwrMsHwFkGiWCSNVtcYH7kkI-XVMZtE2_gNxYqJzO5gDGpsSeBWHfNC8G6hG-Lwrz90RxNZCVh-nm7TjexA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7b3eb050ec4b69a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 4C02 70 B
264 B 58ms
47ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAIYOISvnAut0KKCzgPDeU4&google_cver=1&google_push=Aer7DvLcEYEb8SdYfGByqmoAOnh_yH1hs-wpNDZVM8-ugrPZJZXpifenRN5joafI6CPSjcQ6vLqI31BCEzUSfe2pC5H5mIiF6Jtp
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 adx
pr-bh.ybp.yahoo.com/sync/ Frame 4C02 0
530 B 57ms
46ms Image
text/plain 2a05:d018:d29:3602:f48d:cf88:c413:b006
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECqa4wIy-SLO2NkSsguxCJc&google_cver=1&google_push=Aer7DvJiZ-P555zB1xs1mvW_qunYXSvleEU4ubLeqdl04WQFKPSd0Rjj-kDCXbc-5EtzXpZpGZ4Jl5Gjmgsd0X6WgG8NzI7QPP4Z6g

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:f48d:cf88:c413:b006 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4C02
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEFV6fazvo6dGBzltfBFnajE&google_cver=1&google_push=Aer7DvLF9fLwADJ0F7HMowC1cJJZT7Ui5YiWqlkx3Qg5vNNi857eBmurH0Ps_DVpNmZyj9hRXrAeCNbS...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvLF9fLwADJ0F7HMowC1cJJZT7Ui5YiWqlkx3Qg5vNNi857eBmurH0Ps_DVpNmZyj9hRXrAeCNbS...

170 B
188 B

32ms
31ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvLF9fLwADJ0F7HMowC1cJJZT7Ui5YiWqlkx3Qg5vNNi857eBmurH0Ps_DVpNmZyj9hRXrAeCNbS3KZo7SRwGiV2cds2uuM5

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODc3ODA4NDkzMzY1MjkxNDkz&google_push=Aer7DvLF9fLwADJ0F7HMowC1cJJZT7Ui5YiWqlkx3Qg5vNNi857eBmurH0Ps_DVpNmZyj9hRXrAeCNbS3KZo7SRwGiV2cds2uuM5
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 200 dds
rtb.openx.net/sync/ Frame 4C02 43 B
64 B 37ms
29ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPJ6JUB7-BDEL3gqpc2sP0A&google_cver=1&google_push=Aer7DvIj8wAq7Opc39ypSpa7g-9X9oSqXbS3lNGGts_WOmjk9WLy4dMQyPoGwg2T0IEw2sCxjJtVtiijS9ycqxNQfnLQ1wKjYng_Ig
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ei6e4vbl21qg6nrv28sbv3mg9r4qk84t

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4C02
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU7iddKRkxjjxIIGJLTmyU&google_cver=1&google_push=Aer7DvKGeE3JQm6yf__wTLTOlRnZQHVxnDbsxhgGlMsiRJI1HtwTSKUTsLT_TPp156UGwTCtG5X...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHSzctSi1JMjNH&google_push=Aer7DvKGeE3JQm6yf__wTLTOlRnZQHVxnDbsxhgGlMsiRJI1HtwTSKUTsLT_TPp156UGwTCtG5X-j8h3qu7mAAMJM9vNG8yq-tVB0A

170 B
188 B

35ms
35ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHSzctSi1JMjNH&google_push=Aer7DvKGeE3JQm6yf__wTLTOlRnZQHVxnDbsxhgGlMsiRJI1HtwTSKUTsLT_TPp156UGwTCtG5X-j8h3qu7mAAMJM9vNG8yq-tVB0A

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEc1V0pHSzctSi1JMjNH&google_push=Aer7DvKGeE3JQm6yf__wTLTOlRnZQHVxnDbsxhgGlMsiRJI1HtwTSKUTsLT_TPp156UGwTCtG5X-j8h3qu7mAAMJM9vNG8yq-tVB0A
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4C02
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKJQ5O16DS000ap1rpj_7Lcpzn9l6-fd...

170 B
188 B

32ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKJQ5O16DS000ap1rpj_7Lcpzn9l6-fdFxjW4NKgqh-QupVciU70RLNh54CP4iFqSPstsxdMIjhERUaZKhtGBtupBb4-CwxEw

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 07 Apr 2023 02:02:29 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEKuhc5_95rSXa7H3YCI-ZU&google_hm=ZC95teUGvWIRx61x4vLQ8AAADPkAAAIB&google_nid=index&google_push=Aer7DvKJQ5O16DS000ap1rpj_7Lcpzn9l6-fdFxjW4NKgqh-QupVciU70RLNh54CP4iFqSPstsxdMIjhERUaZKhtGBtupBb4-CwxEw
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4C02 0
12 B 38ms
30ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IIx1KVXNU2tVEHHEWVO1rOS6qN0qegT_WxeXFhKV8cHnUp3gWZDrtBsRSQrINSBZq8Opy4

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 5F0E 85 KB
31 KB 26ms
21ms Script
text/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=58658400010370004444994012287030&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 06 Apr 2023 09:11:08 GMT
content-encoding: gzip
via: 1.1 7efdfc8e9ebc26758933b0151e22707e.cloudfront.net (CloudFront)
last-modified: Wed, 15 Mar 2023 17:26:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 60682
etag: W/"876c293e6c37046ecb0c11ce2e276942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: cQssSlSrYjc1TLCi8-lS_W2xvYsPNfd5bpTqCONg0z5xkLqe14d2hg==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 5F0E 85 B
417 B 27ms
21ms Image
image/gif 99.86.4.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1680833249&Signature=cVVy4U1ZDBG10~2~sZwCVx9aQzDLV5j72W5x-f5BfSTT9e3jcMfsbVRCh3i5E49rgMpOOHYCnunKTToud1uBiZqVNTDbT~r5JVm~QE1dNik9yHvSrg1lTmCCDxhk~b-TKb1NpuTExx06WKb0jz3eWGRUogbT0cd5Ba1DFwhqP-il~2eDtsUpDlSM~Z8c3nE8RR9fJNRkU6q1ynRj56CNLzHQAd9QG8gmXLLyAcgZPo4Z4GA~Eki0WlUr7NnRwqswIwfuy51I~UTUJvHe9q7hdxuVcec7WFxrYZ8JkpY7gQIx6Pqtvg2fu74iJEKa3D1EAT-dKUMAR3XYRZIIXFCorA__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-36.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 00:59:52 GMT
x-amz-version-id: null
via: 1.1 35c75b7f0ca8c787d67c8ebd22bc7fc2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 3758
etag: "70af33d70b6810475aae19743c8c435b"
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: Y4Q2ExfWGHaSLAT3Qur1sINtNa1qqvZ79f-aLi-cbKXdhErFPGnEPg==

GET
H/1.1 200
OK viewability Show response
hal900030.redintelligence.net/ Frame 46E1 0
150 B 86ms
33ms Script
text/html 136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/viewability?s=58658400010370004444994012287030&a=d8f6abca&vb=m
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=58658400010370004444994012287030&a=669d98d0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/request_content.php?s=58658400010370004444994012287030&a=669d98d0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:30 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 46E1 13 KB
13 KB 23ms
23ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900030.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:32:58 GMT
x-content-type-options: nosniff
age: 228571
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:32:58 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 46E1 13 KB
13 KB 23ms
23ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900030.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:31:05 GMT
x-content-type-options: nosniff
age: 228684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:31:05 GMT

GET
H3 200 a
www.googletagmanager.com/ Frame 11BA 0
11 B 855ms
855ms Image
text/html 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=601118193&rv=3430&cid=GTM-TBMT2SF&l=GTM-TBMT2SF.L126.S1.Y40.E39.TC1.HTC1~gtm.init.S0.E21~gtm.js.S0.E22.TS5html.TE0~gtm.dom.S0.E18~gtm.load.S0.E14~gtm.init_consent.S1.E23&qi=0

Requested by

Host: 95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
URL: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:02:30 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 dc_pre=CMj3m9fWlv4CFV2LsgodmpUOqA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362
adservice.google.com/ddm/fls/z/ Frame F81F 42 B
63 B 58ms
58ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMj3m9fWlv4CFV2LsgodmpUOqA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CMj3m9fWlv4CFV2LsgodmpUOqA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7701951611644.362?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 1206 281 B
554 B 89ms
30ms Document
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/prebid7.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 07 Apr 2023 02:02:30 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6318 42 B
64 B 60ms
59ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst98GJTiNGCOH4fxV2geayh9ZCR4EtA26hWj85eMUSzGPDUQmy6A4SsFB2Q4YiUJHbBFcXCMuXxxEFswj_lpJN9RMEP173cGMHqHd-XWPSpXlBW8iqOJoqVz0nj&sai=AMfl-YRC0lod7Vznp3B3gTKudhkQe38PVMdPqSUciFDbMzn3kpMYmwwQECaQiKx1TL-A_fCGG11pxlrvmY_Jh4Yd-6rYNYCfpr2K_VySj4wQgoTFOt78QNxXzNbBc9od&sig=Cg0ArKJSzAudhfwTaeWTEAE&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&id=lidar2&mcvt=1339&p=150,315,400,1285&mtos=1339,1339,1339,1339,1339&tos=1339,0,0,0,0&v=20230405&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4026279106&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1680832948851&rpt=660&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal90005.redintelligence.net/ Frame 0E4B 0
150 B 86ms
32ms Script
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/viewability?s=11705700010568104444550012287005&a=3d35d1fa&vb=v
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/request_content.php?s=11705700010568104444550012287005&a=962265bc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:30 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7091 42 B
64 B 59ms
58ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst31H3Dao6bs9t6hHNa-C4XV-Lb-Cn_rnz7iyb6Gi86QnSC3eCU_--eluXnZzBSV4L9Rlvx8llKlxBd5EqG6reUe2tOa-SQfifay5HIxE8jX3OWSgMBaJaSo6lq&sai=AMfl-YTyhnt4h_u5OuTcpMCYncVcfXj1FjY9h2TZWiW0GbuvRVhudI8-kpdppa_EZpIXOWciklCqMiEay_2NKSxDILHVzuU7kOfhPY9dA3tvU-e-kyrSOVIn7yk58y32&sig=Cg0ArKJSzMUVQrRzLAFEEAE&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&id=lidar2&mcvt=1321&p=495,1250,745,1550&mtos=1321,1321,1321,1321,1321&tos=1321,0,0,0,0&v=20230405&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=454413658&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1680832948866&rpt=697&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E15F 42 B
64 B 58ms
58ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssDJ5g1oFIYHmzMbuxusEqzXTf81kBTukykkR7ha3AxrlGfhmhStY6EhUIv3H2J9K8bmrEPpTzRlZHC6MAS-bs9Rm87p8ZPhDCJ1_kl1vN82Uw-Dz4JWdyA8W8D&sai=AMfl-YSzFFzesiPa8EF-TTR4yc7nrdOngacqrRc-fTb9X49qtqVqGANTEECG1CMhzRZnzjKXX7yTwblwdVkVVfNUjOLI1kWfIq3eD7vuVPRRQfPz4yknga4eo4-Vsi6m&sig=Cg0ArKJSzBR2z6ubOK7wEAE&cid=CAQSPADUE5ymuA1Xk3wtW3NaLJ6cgO9oHYNzHe4xrj2tJQ1w8SHvbRLhwZQBX5F07tHQgT-IbY-FxPEGgIDQmRgB&id=lidar2&mcvt=1291&p=1110,436,1200,1164&mtos=1291,1291,1291,1291,1291&tos=1291,0,0,0,0&v=20230405&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2387932110&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1680832948869&rpt=752&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900021.redintelligence.net/ Frame 87BC 0
150 B 80ms
31ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/viewability?s=68076200009422004444554012287021&a=043b7a0c&vb=v
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/request_content.php?s=68076200009422004444554012287021&a=31513c7a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:31 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal900013.redintelligence.net/ Frame 4B95 0
150 B 83ms
31ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/viewability?s=60320400009337604444990012287013&a=786d0345&vb=v
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/request_content.php?s=60320400009337604444990012287013&a=6a340b8c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:31 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 1206 34 KB
10 KB 24ms
24ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 34e0e78f8f72c888993961083791466c29ece49379a956b3dfc4086c0c151392

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:02:31 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Apr 2023 19:10:19 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=61567
Connection: keep-alive
Content-Length: 10015
Expires: Fri, 07 Apr 2023 19:08:38 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6318 0
20 B 53ms
53ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4105113233159&version=m202301230201&ct=77&x=1&cor=11914685839672020000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7091 0
20 B 54ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7408604831152&version=m202301230201&ct=77&x=1&cor=18013588274607501000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E15F 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9421351648290&version=m202301230201&ct=77&x=1&cor=1326364446201457400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5F0E 0
20 B 53ms
53ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1967412048599&version=m202301230201&ct=77&x=1&cor=5822999043167644000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 02:02:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame E15F 16 B
232 B 71ms
70ms Fetch
application/json 18.169.152.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.169.152.3 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 07 Apr 2023 02:02:31 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 139ms
36ms Preflight 18.169.152.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.169.152.3 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-169-152-3.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Fri, 07 Apr 2023 02:02:31 GMT
server: nginx

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 1206 284 B
536 B 94ms
21ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 7091 16 B
232 B 65ms
65ms Fetch
application/json 18.169.152.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.169.152.3 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 07 Apr 2023 02:02:31 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 111ms
36ms Preflight 18.169.152.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.169.152.3 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-169-152-3.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Fri, 07 Apr 2023 02:02:31 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 5F0E 16 B
232 B 87ms
85ms Fetch
application/json 18.169.152.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.169.152.3 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 07 Apr 2023 02:02:31 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 99ms
35ms Preflight 18.169.152.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.169.152.3 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-169-152-3.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://95589c576af8a6857bb1bce4351bd512.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Fri, 07 Apr 2023 02:02:31 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 6318 16 B
232 B 89ms
88ms Fetch
application/json 18.169.152.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.169.152.3 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS