windows-setup-remediations-x64-kb4023057.updatestar.com Open in urlscan Pro
2a01:488:67:1000:523:fd96:0:1 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Submission Tags: falconsandbox
Submission: On April 17 via api (April 17th 2021, 7:27:05 pm UTC) from US

Summary HTTP 199 Redirects Links 75 Behaviour Indicators

Summary

This website contacted 38 IPs in 5 countries across 25 domains to perform 199 HTTP transactions. The main IP is 2a01:488:67:1000:523:fd96:0:1, located in Germany and belongs to GODADDY, DE. The main domain is windows-setup-remediations-x64-kb4023057.updatestar.com.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G2 on May 25th 2020. Valid for: 2 years.

This is the only time windows-setup-remediations-x64-kb4023057.updatestar.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
14	2a01:488:67:1... 2a01:488:67:1000:523:fd96:0:1	20773 (GODADDY) (GODADDY)
5	2a01:488:67:1... 2a01:488:67:1000:5bfa:5108:0:1	20773 (GODADDY) (GODADDY)
34	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
4	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
7 35	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0d::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
31	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
2 5	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2006	15169 (GOOGLE) (GOOGLE)
6	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
6 8	104.108.145.8 104.108.145.8	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	37.252.173.62 37.252.173.62	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 2	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:1f18:612... 2600:1f18:612b:4232:380b:6483:6fb1:583d	14618 (AMAZON-AES) (AMAZON-AES)
2 3	185.94.180.126 185.94.180.126	35220 (SPOTX-AMS) (SPOTX-AMS)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	64.233.167.154 64.233.167.154	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:6c::8	15169 (GOOGLE) (GOOGLE)
4	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
3	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
4 4	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
8 8	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4 4	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:1c45:c4d6:f2b8:9306	16509 (AMAZON-02) (AMAZON-02)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2 2	79.137.69.91 79.137.69.91	16276 (OVH) (OVH)
199	38

14 2a01:488:67:1000:523:fd96:0:1 (Germany)

ASN20773 (GODADDY, DE)

windows-setup-remediations-x64-kb4023057.updatestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
w2.updatestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a01:488:67:1000:5bfa:5108:0:1 (Germany)

ASN20773 (GODADDY, DE)

www.updatestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

35 142.250.185.130 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0d::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.108.145.8 (Berlin, Germany) 6 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-145-8.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.173.62 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.159.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.242.245 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4232:380b:6483:6fb1:583d (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.94.180.126 (United States) 2 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.167.154 (United States)

ASN15169 (GOOGLE, US)
PTR: wl-in-f154.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

gcdn.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:6c::8 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

r3---sn-4g5ednsz.c.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.227.252.103 (Kansas City, United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.64.190.78 (United Kingdom) 8 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.139 (Frankfurt am Main, Germany) 4 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:1c45:c4d6:f2b8:9306 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 79.137.69.91 (France) 2 redirects

ASN16276 (OVH, FR)
PTR: gcm11.host.hit.gemius.pl

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
65	googlesyndication.com pagead2.googlesyndication.com f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com tpc.googlesyndication.com	380 KB
59	doubleclick.net 7 redirects googleads.g.doubleclick.net securepubads.g.doubleclick.net stats.g.doubleclick.net googleads4.g.doubleclick.net cm.g.doubleclick.net bid.g.doubleclick.net	253 KB
19	updatestar.com windows-setup-remediations-x64-kb4023057.updatestar.com www.updatestar.com w2.updatestar.com	87 KB
12	gstatic.com www.gstatic.com fonts.gstatic.com csi.gstatic.com	134 KB
8	pubmatic.com 8 redirects image6.pubmatic.com	7 KB
8	casalemedia.com 6 redirects dsum-sec.casalemedia.com ssum-sec.casalemedia.com	8 KB
8	google.com 2 redirects adservice.google.com www.google.com	819 B
7	openx.net 6 redirects us-u.openx.net rtb.openx.net	2 KB
6	2mdn.net 1 redirects s0.2mdn.net gcdn.2mdn.net r3---sn-4g5ednsz.c.2mdn.net	157 KB
6	googletagservices.com www.googletagservices.com	192 KB
6	googleapis.com ajax.googleapis.com fonts.googleapis.com imasdk.googleapis.com	160 KB
5	ampproject.org cdn.ampproject.org	108 KB
4	rubiconproject.com 4 redirects pixel.rubiconproject.com	2 KB
4	quantserve.com cms.quantserve.com	2 KB
3	rlcdn.com 2 redirects id.rlcdn.com	1 KB
3	mookie1.com odr.mookie1.com	536 B
3	spotxchange.com 2 redirects sync.search.spotxchange.com	2 KB
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	google.de adservice.google.de www.google.de	1 KB
3	google-analytics.com www.google-analytics.com	19 KB
2	gemius.pl 2 redirects googlecm.hit.gemius.pl	469 B
2	teads.tv 1 redirects sync.teads.tv	408 B
1	innovid.com ag.innovid.com	297 B
1	tremorhub.com partners.tremorhub.com	183 B
1	googleadservices.com partner.googleadservices.com	640 B
199	25

	Domain	Requested by
34	cm.g.doubleclick.net	7 redirects googleads.g.doubleclick.net f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
34	pagead2.googlesyndication.com	windows-setup-remediations-x64-kb4023057.updatestar.com pagead2.googlesyndication.com googleads.g.doubleclick.net www.gstatic.com tpc.googlesyndication.com www.googletagservices.com f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
26	tpc.googlesyndication.com	securepubads.g.doubleclick.net googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com windows-setup-remediations-x64-kb4023057.updatestar.com f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com imasdk.googleapis.com
13	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com windows-setup-remediations-x64-kb4023057.updatestar.com
12	w2.updatestar.com	windows-setup-remediations-x64-kb4023057.updatestar.com
8	image6.pubmatic.com	8 redirects
6	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
6	fonts.gstatic.com	fonts.googleapis.com
6	www.google.com	2 redirects windows-setup-remediations-x64-kb4023057.updatestar.com f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
6	www.googletagservices.com	windows-setup-remediations-x64-kb4023057.updatestar.com pagead2.googlesyndication.com googleads.g.doubleclick.net f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
5	www.updatestar.com	windows-setup-remediations-x64-kb4023057.updatestar.com www.updatestar.com
4	ssum-sec.casalemedia.com	4 redirects
4	pixel.rubiconproject.com	4 redirects
4	rtb.openx.net	4 redirects
4	cms.quantserve.com	f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	www.gstatic.com	googleads.g.doubleclick.net
4	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net windows-setup-remediations-x64-kb4023057.updatestar.com f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
3	id.rlcdn.com	2 redirects f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
3	odr.mookie1.com	f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
3	sync.search.spotxchange.com	2 redirects googleads.g.doubleclick.net
3	us-u.openx.net	2 redirects googleads.g.doubleclick.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	s0.2mdn.net	googleads.g.doubleclick.net
3	fonts.googleapis.com	googleads.g.doubleclick.net securepubads.g.doubleclick.net f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
3	www.google-analytics.com	windows-setup-remediations-x64-kb4023057.updatestar.com www.google-analytics.com
2	googlecm.hit.gemius.pl	2 redirects
2	r3---sn-4g5ednsz.c.2mdn.net	f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
2	csi.gstatic.com	imasdk.googleapis.com
2	sync.teads.tv	1 redirects googleads.g.doubleclick.net
2	imasdk.googleapis.com	f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
2	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	windows-setup-remediations-x64-kb4023057.updatestar.com	windows-setup-remediations-x64-kb4023057.updatestar.com
1	ag.innovid.com	f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
1	gcdn.2mdn.net	1 redirects
1	bid.g.doubleclick.net	imasdk.googleapis.com
1	partners.tremorhub.com	googleads.g.doubleclick.net
1	www.google.de	windows-setup-remediations-x64-kb4023057.updatestar.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	ajax.googleapis.com	windows-setup-remediations-x64-kb4023057.updatestar.com
199	44

This site contains links to these domains. Also see Links.

Domain
www.updatestar.com
news.updatestar.com
client.updatestar.com
kate-s-video-converter-free.updatestar.com
webcam-simulator-xp-edition.updatestar.com
kate-s-video-cutter-free.updatestar.com
webcam-video-capture.updatestar.com
fake-webcam.updatestar.com
updatestar.updatestar.com
chrome.updatestar.com
microsoft-visual-c-2010-redistributable.updatestar.com
microsoft-visual-c-2008-redistributable.updatestar.com
microsoft-visual-c-2015-redistributable-package.updatestar.com
microsoft-edge.updatestar.com
feed.updatestar.com
www.twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
*.updatestar.com AlphaSSL CA - SHA256 - G2	`2020-05-25` - `2022-06-28`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.googleadservices.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
teads.tv R3	`2021-02-18` - `2021-05-19`	3 months	crt.sh
*.tremorhub.com Amazon	`2020-07-25` - `2021-08-25`	a year	crt.sh
*.search.spotxchange.com GeoTrust RSA CA 2018	`2021-04-08` - `2022-05-09`	a year	crt.sh
*.c.docs.google.com GTS CA 1O1	`2021-04-06` - `2021-06-15`	2 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh

This page contains 25 frames:

Primary Page: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Frame ID: 65CE5548BD3C4DACB3AD7C0B5BE45F98
Requests: 42 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210414/r20190131/zrt_lookup.html
Frame ID: E417896FAD7B37B10E046B96E72ECC3C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&adk=1812271804&adf=3025194257&lmt=1618687602&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607066&bpp=13&bdt=135&idt=156&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6376118320302&frm=20&pv=2&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&dtd=177
Frame ID: 2692C5126784B6491FDA483D9749E6AD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&h=280&slotname=7484580198&adk=3746994897&adf=4224226154&pi=t.ma~as.7484580198&w=587&fwrn=4&fwrnh=100&lmt=1618687602&rafmt=1&psa=0&format=587x280&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607128&bpp=5&bdt=197&idt=131&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6376118320302&frm=20&pv=1&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=392&ady=805&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cEGpiHs0PF&p=https%3A//windows-setup-remediations-x64-kb4023057.updatestar.com&dtd=139
Frame ID: C70A23E8ED37B2E06B60A420C05DD2DF
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 35BD2E552B286BEC72665E33114EC725
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js
Frame ID: 40E9A039A119C549ED0513C219D5A6D1
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: EBB0610DFF59641825B1332ABD1BE5B2
Requests: 2 HTTP requests in this frame

Frame: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 24CAB5C9B111A63641FF91BF9DE540B0
Requests: 14 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs
Frame ID: 298FB2098784C9ECE6BA3EA0E7156F80
Requests: 16 HTTP requests in this frame

Frame: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: BE983C98286844665677E6DC2750B290
Requests: 1 HTTP requests in this frame

Frame: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 608DBA5E59153072F4F939E57A2D30B4
Requests: 1 HTTP requests in this frame

Frame: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 5A8011AE91BE268748BC6A4319DBF4A9
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYsqqHkgEwAQ&v=APEucNVwpYvLSaA4DtMBpnyYlDxn2-uBm8JRFUGAcw6ghg2S-zVE-TUbBMfQU45GmLFqCN6-2odiPVOnorsakIqkCLgo6izAx3Ex-ZPWmvBibt2BuQ_3FomQEy3r5vo0JXBWlWZ3zNfY1UUxF5xCwh8VJOzFU-J2HTNZeKlkr2VF4xAJ9AePBKRSaWfpxO9_FjzTTZSzXj2_IcuwV2DzTalEpI8zutY6vA
Frame ID: 9CE5EDD1AE4B7EF4B42D123F6524962D
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNWUraB85muKRfKIfmqAlWbU2mVBlUqGP8U5NsOyvS-tbRHY8c-nwALek51--YWZOimZEA82AXWARAmEceQ9IRVPMBzlPYijt30HsBD6MA2iB-mi1c5zsB2WZMjdP_KXvZZLylekEY7I-DzcVMD_M5h1LUwwLT9BVjYQqPmoK-XCq_bhBGAxrdeBGlICUuiaEyBXXTGjGr2cDeH6NR20k0-tdRq9mw
Frame ID: 421C53F1D4452F9BA1392B0C7C1B1BD0
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DpQKg8m7MrcxZoFPmvX2pC66zDYW7uQyosi8dbU_1eGiMZb7yV9m4n49f4l4sE8zcajpuwVpWrBjIGCuHe-XKLjuEMiSLHn5obZGoUZUqg5jZaGiMdzX7wKS_BjXYmNgJjejaIPWz3z-YnkNjJRj4WmiiulQ&dbm_d=AKAmf-CuaoKpiOUsUq-vUYdeHeGjcmuv8q9PDdgZmJo9KC5jMQ51X8XD6tor6rMozjPPxPzxJuNYj4Mhit1GKVD02xHEY0IqipPIT0IRsHXHd9Bv8uleTTb0b0NiwI9Xmt17iOX7A3Qo1A-KL-Hd8OFlqC2RTelO0ta67CVUntNI1Sw-tBvRKj6Icdq1fm2sOU3z0CyxdEB2mXq4d1LZhRywxd7YV-oIJ8o_nm_ajwTVVrwCK8gKmt4AwPv3BC1G0_PNM2k1kTHwIJpKG7xgU9Yfo4pEpyCkevszyQvG9-dTPOEyWK6VqJLSIoKQEi22WR712Worne0RzSboOOArpyKoDqPTmXzvbwTWxgOI8tA7m4mJ9HH2AhFapazINxu53D-Vn4zKv5d70IA8fj6ZGvPbU68S7NvRU0RWIR7fVLShAfjjcTBOrEhCAF8ty7C-2mGBYGEgBnaPYAoVMAj9Bs0sNCyKM7PELMhzILgfkOkCgH-107Dj7XKKqiQKDoNY8Ipsa4bkStAKHCpi56rffuLZhJJZOSd5bNOd3Lr9TUwkxPxhneGMqVKl_2Yh2ntrI_qm07tfq_J07LyJ_Q6Sv7RCaOINyaJ5Y35qx-SWvJ73ikT_6wPdEcW6mdkxcfLrRDLDApwQCySZm7DCFWHxJBNVQHrPs7Cv-NhjfNUI6FGoVThC3a3FKt4Hsy3Ajsa2MHJhv57nuhre-MjwEZoWWoNunEmfCEoNTuP9-afmOIm5ShqpSFqNB0TRBb1wsEw2-3L_26M5aez9Ivg0ni5noy4XKQ2EgFYG064nlodlB52hPtfU7U3pOw-11yuurpyXz5cMc9EowKNfv04tJtQSTMmuxY6cJ9B1XWhOw5X63DxCitRE-MUUTUGkF-r7HAeglPsLFpg2HOFsjZOmd-2V1AiWqwDGfXEJXYifEMXzOrt3T8gVCmTV_BnJ8LN_FSnFKXwq-UaezJjiEGTYE64nafOA_G9rgqYbQb2A0rVXnqyS5QaioUtySZFQvP1qYCTjXhQRlNd6a_BklcrP85fY_CWId64oEhU67dhDvoStYiIiAOdP1DKIUDd8U6LKeH2iIISZEWXnY3lnh-NWG5pOzFrVYCTyOeLGeYyKpKDgYsfD7yySHAbGMkA18DriEVqMV8Y-Pr1WZrv7hc0fe4fXMFTSaW_g25q1R9535FLqfg_VgUkokBKObWY8UtaHlbQbcyBeHxtrYbaLpWejZVpUz2W7CXCLZRo6J07-hKgwQpsllZnP7-DILFb_YJNxsJa_7BLhFtll355TUNORwIgCOrVuIaKGyFH6OM4nh_ucBoOZ5GMYA-P6h3Z-in_4weoRe_azmHoOfMmJMIdq6X-yq9DBktgcUowcUGpxYjX9sQOfSd0rKpk_ho7v58WcMNy9xRZYOk_Ebor4u1xLI4f0SOyt05Ot4RXsWpkO6aYwOt013IwzZ-u7_5MGkPvb1xFK_q1A-EpUeA_n0qzDMuCiQikSzI9DjzRuomAcJniOl975qdzCyBdg5cpsUSthUnL8DqxqC4xo1ReUvVmvxF5ATfwamiKX33SmKR_J76y-uxmk71h6pkM_POuDrUJl2G33WNBWN0GoQnpNzg5McHjedZ0RlaPz5Ujg5JnP4i1d1sUlDxSM41j8Py4nSCJiQhUnDXK_-HKdx9T1ItprvTJqFKJH77yJ-5oPiN4MXxq4fOq6CcpC0BjJmtyj2UsiUkgAnRk_p0JHKsHax1NzexeW19S2BZebKhFUU5GWEnOOwk8IyLE5I5cNq1GHWnFJCSii0YHMajb4kUQaNnX2dseEd2hmc3tgArzfC1X7ul6l4rme08ipvwNacRKzwvrLuZ-gjeM9ee8WWR036LvzA5bCs96D3Agv1O3KlD16R33LWbBSptYuxQr2W2Ap8CckfGmzt4VmQlpriyhC4oYz8-3NeXy2fnJqaYkaJqFr4gEvY0AmGiftLCYd39wQgs5A52acUt7w1DqIBBsDLEiS-TfHQ_T9YEcWw1qIdfNj7_PFVQKr1kdSpUV7Pu8ho7mB2wcmV-xvvR5zz9LvnGSY1Cz0exw7En-kiufQyELz4zCvROvV_oMAymkyGpncqUTfLbCBmy34MwB389QNwtF3UhrzL7Is0yUBUBiPPucxKTumbzmJT2fq8xIzzO50i0DYvJLYi_QqFHblg3BtAXRauK6oBIoJUM4A9MNMkEJWTr9Y3FP6cxTeO1myM2eMhU2gD28-GqtIwxGj74EVaeyMDyOb6JK4SSs7q87Zm3sK4Swc_0j_ltJ8ni-WMB8u7rLFUJX0nwANeJE2gSWzjd_Zxu11XoTOAxUokQrq8pLdyuw62l6Jn6K8wgpVSXj06NiwSwUTKnrrbfNci0N7ofKgLrwWGgKAMWRJQzGfMujLy5FleBZhp-JSUVKoLLxxSYThWNIKeDh3FwYTTri2-xpJH3RzdpSrfpmxiVK7S4Xc1yxsdRHzvYUizpmc2a1LJld6l70_5RJYCrIAlfm2siy9KjaVVWaYQLuBFtaUZUxdBfSM-6au0HHxHc43TtATlXJQfxUyLFNFOD4SuporDzf_qUkx7GBU2Eax5VsDfwVTbNV0K7GtsIzWbqTf8woVRhraunMfAETuFAc9rfX8uCg18Enk35fh9UEjBFjWO5qS9bKjG6-DM7m6Wbryyq_3y1IYWqzja81YgwKPJEcNojvfPBJHR5PbFzOLrHR3nZJP3lJp9eXcI16P5ZX9WC3zR-JIdKNymjicRirtL-mCiejfa0TGXI8auYNXeZAHSZwBKxfOggQ0khnFFYu12DPCaHbzgjCc7loTEEE05birDgueRLmYkw2gjKu3myvPKpLXK3kt7CtWK3NZ4D6CaCXERTc4L0AETGPYSWt680mQkMWP_B0BLmG_PxQ5kHQwmCuWv9hl7bpN35yVdQ2BZLSSaV7SGtcREd-sSgeX25r9KF5rc5iCMvSpHTRDOp_vNrLoonfMtvxsYnsgl73y-xaldkcDxV0xuU1JQ__G69QW87eauLXATNozbWGn2tIP_DTam5PYWMXqYn5mhw609o2SZeug0iz9XLnVvXdv5UBg6ocmHYVSwNEQK_Nmj8-u3EkrIel7yQDBU2ELtrMoTpf1bqeJ0ZpqwE_vSZLnusJ3uDeMuqbTSe1S473IeukY4jVgK3mAdx6qC7I136faaY5ePXy6YC7MD20qtxp7vUrq&cid=CAASEuRoNroesVOy3ZIPHODcKM-J8g&rfl=2%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240
Frame ID: D5A1DF1C2177B80D8E9E3280E924892D
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNX2dMM2SUTRANk7N3TTlDIoIEruw_CdyK7pLvloyo4tJJrVuJKBFtKv1TqBQf4zbaJxPccedw50CMBXsYFfYgCqvsSxQV8gONcFdwz7_MN5kkUHybHkRyh1FEy46_cVuRPEwW5yflDTqri_ieLPIg8v5tPFEA7vRf9C8BvvN8nc4L8vXNGEMkVeH17n9w1MPNoxRjqecqMFk55FS54TaU_IY38RXg
Frame ID: 658E5735AED7127B944FC419BC1886EB
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CmQN0tuzWieaGuJcuKCwB2a2Da1B9ldy-70OC23ESXmNY2JxEuNU92y5vR_m1wsv-_dJfDxuOlVc8LeU5BmwS2dUQ9Nn1pDECG8ZhLprbLQNKFtRrLD4Y_s4YFpV8LJC9zRSDHM8R2Qy3Xow8zD3kiSGEXIQ&dbm_d=AKAmf-Coy8DRaVotPu1itOXZ1AZppxzBlNrEuMS6yKYuna4VUQd6XD3mWccKDZU5EcA2JuHULwb4jfWmjiiav6t9QutDyN9LowP5Qcmp0YSy8LeEbVeWpEC7Fmv9IQInAkM11xtIpuz6a6lvAq3g5_txlvvqvH32sgHt7uVQfQiN5hjocm1KyucpZgauvFdaFQTd6GdFmbFe8k-5FHTydMRg4qmKt9kTYhqS8ewiMJilVUH2Ko2PhMqnqiEDEhN0bE14JbY_b2ZuI1KwEWkYu07fkahP7Z3ZC8p8k26lhym-0LvpZvLo2yf8A8JYXsHaGG0NkhltNqzCM9PVqkE2bNE_H-wNk7RDv-fWoU_jRVASEo_qMzn-3N0ktulRTzrCb8DF__NLmvvIAqUSWrDk_jHcbbh-nfw6_Mocg7yJWUL4LIiEZR1Ljtjooc3ZESeBzKsGZq6Mx6kKr5tzxwLcMSFxPMG0QDrMuRRiZu8Lm6dGrCVssXISDz5x48uA1QR1GmWTZzU6glXf4neBMejLOVXFdjRITCUOO4iTcHTKwnRDlI_IT1IpeOIRqoXmrfZsC_Ct38MH_zbsOMfUp3hQ5323i14VXI_AbxwP3Gk6uhVrSKirV12DWhDUWU8YbDH1rqOhaBp7Y1tjWUClBHvpO1pdm7FZLiuvX0azuYedE0Tbxs68UU4j-YW4-o_UX8VP1O13Wjpu_jGdnsLfXXyipTRa_j3uAC3vF-9_mR-G_DeOHQA7qzA_L9XjrYEPx0qiyjpsvb26q8CHbkpO_LXj3-agcReQhtjajDJLuCfLlSt9vbX1IcuVyQ8xeFgDFGe8I1BjabB93kpESa6SFFk0xzSAKrx9RNJfc1nl3O0iUF-eynRjFoNLFXGkSASxxIbBgo7bLvKfij82ofqAqEOtHvM2SkNYPAknjhhhU5E2V7hlueKcr-ZZuNVygTM1cr8FphlQ3RKIQ0EccvnyOUGOHE19II9D76-yfP5nmxeGdM1YLtgYFws62f1fwwc4_7NtGN7g_hvYQuSip4tNjW2Zi99R7xd-1qJYUTF-wugGs3uDhutDgjfaEfScLKcbgMiRy-tHomfoY8NZm_W36bTuF6l6Sp0MH3oQsLAkpdRFpDt7sgtqK4PblAzOhJ1pgot6hUCukMAaGXWquCHf_rSf3MSD6xgFF06k6cb3pdXhZOLudkB1AlfsbBMYHiHRWXJBRGqMVBBHSyEMRD2Fk1tzPFxf_2xorrUFg4_bJL_Thmc_QYiGQFZVhpcp5qbTYvAYh00V4r-6hqz6JLfmRBGN5meXqliZCye_IHiO982aqDtrme0TiNL-Mi4NIe9-sBfznHs9OHnCi0eeD4AEfNsUurp9tqtTKIfAtoxr7a1aMPMkK66DJN1IIVHnllhG4eAaNK16viKgIUa5ICwCxkeSc-a25XDvZazHUNmi2Y3J5z3lrHWzLWE7HDaJJwV7l6MpM68xkeVMxcn8iNVBBAQk0v_3fkej0gxwrlhE4KH_IDX9s2Vk2H22dFB6v_D1f4JPgLOoOptDGC8DmkrgLuYMsKZh-dBWtMLPHvqSxeadPqp9tC09Okuy574cwSAfXcuGhZak-oFZK-KgqPZHZMk1qOEpU39z7khemCOsYBYa_5T56eIqJHQGqQbI_82GCK9iyP46GqzycihABVdvFsTph2pCeaREWutzzUrgKX8bjDLcEhwhC_ou9vtUEuZ7OFDiz3IXNvcpJhiS6hw8BVdlHoiNiPFPJBJb2kk2ggKXk_pNC6riEIpioOoYHcXUK0c1i6j1kbYrze8ph7zPDGO1t4-jFc2OeOrEzcMdchf32x6TS270UL_EfrZpu8BQlxOoyr0_gy8z17Z3MRrTLSuwX9dL-R2N-yQGi6pXZkUTeeYoO0spOMrq721krOhhQ54eEZPdSZc0Z376FhSNpOZaMFOEETDi5tSSa4c7CGEefsFGvunkLzGoFFauFHfAoU77_4gsihnq4eKVrpHG2Ee8l8zzAnQZqtLXbVJv10HmLugLEq7qKDTSge2Ot2uNMkbfGMcPA50Ey5N5m0uy1r7DqioRclwupwEPNBY0IdcCeOcJ5XkzWHxKly9Q5L2uMkJw-pcGPYgOfCIQ0vEGlTUbRUkL9VmoCBWUnbWSTyjC6HGM50-J3RIAspNHAQUsjxzyVub3W08hFs-wovCkV4Wim8obKlY6_wlsm6MhB4uD9_6XQxxtf3eHiZqei96DctUFUPDX47CP6c0o74QKNElKcXukWvOmRXd6kx4OtJXt9kPFA-OTk5Z3uT2jngp-Xfrjn0WCxZcdXizQNPRe4mfcRKjamh7ri2vpsdiDnfSc3gwzSlwePAIsoAOhSz-ZHHzOqspZpGuNHxYzGCXxUcFE3DjSXnBz1yxcwGDErqG25aRkQMLvyAm7DUkV9zMooRtx-IhX0tcHemgPkIbWam5DuGA_CGk0KH3SsKPVAOzApG8GIFs9-jCLSdcsdJFLEBcJeB1rUKB8fhUIgHmbcxQuU2JSyShXi2Frnc1TgoYQlwvU_91aqpun68XBIG8ThJbryFfo7p5L_nKWfcksfL6trc0m5LIt4IkAn5lbhA6wzLXCtRPeMoMSLGDwBjAgy2-h2jNsRgQr6CdH1m60erZ0cawdaiEUJY7xqX7IsyH2PIjmvzfF_XV57zVnt-F4-INKDVVqML-OLmTBLLmXGkoQdkKSwMUWm0NBf8K_qGpOE8BFvWLqK3Byt2MD1pks_A3q873L1flTUYMFNnN-bPCOj3dtRt8ph4cuyzjA5hIWFIW6ETI9Bv5mfHpgrB8tMtVISBvAqHOxPA-f6vMSpTeBeO4bBlSTqf-ugYTY7qo4MYf4vx2WAQz1y3BBJxbTqjRjpVoSZ4YlBGsSk0OPh2RyHC_415lqL-_SXwXy-DO0NvEE-0OliBSyHzbrXXci_X-CFfQxsjTOZX1ymh_QpfltF-7u1N40qmQjrE3O0N10l2Gq9G40QtHYHevYi5oAkQxPqt66tl6uHagjvixf0swJyuiRQLzcTXxOuoHWUQSY1kbUN-I-TY7cNeS4K4KDPdfaFcs1ioIs0HU9PE7OJWzHj4CeqeDNH8Fnu3Ykmv9-lPgYH5KcQxWhHKejqa9y4pmTINRWQIpUPEAcBn75CSRXk8HDwj2eO5HRjKMZOLC-Qj41gQI17XQ4e5gdqZ-rM34a-jrJqpno55CJ&cid=CAASEuRoqC6Z1iOCGPaKU2a4D29_6Q&rfl=2%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240
Frame ID: 49450BD75A48BCE5D91D1EE0098E93BC
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 71BDD8CE5BA5BE3C412295B4ED48CADE
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 36611B592644E8C13BA60DE7848E3B8D
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: FD9165A1A69F721D15E9EA05D7A69050
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: ED12C965F3DAE238302584B515E07851
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9D2CE9B9328AA3AB50FF6E81A6FF5BD4
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 3982D94BA8086607D37CDA1523AEF289
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 49A127CF0001204D7BA8A2AE1BC10550
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Frame ID: 49D384673786BF703549A0EBCBF59B95
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

199
Requests

100 %
HTTPS

64 %
IPv6

25
Domains

44
Subdomains

38
IPs

5
Countries

1497 kB
Transfer

4059 kB
Size

5
Cookies

75 Outgoing links

These are links going to different origins than the main page.

URL: https://www.updatestar.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/popular
Title: programs

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/latest
Title: versions

Search URL Search Domain Scan URL

URL: https://news.updatestar.com/
Title: Software News

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/updates
Title: Updates

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/graphics-applications
Title: Graphics Applications

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/publisher/windows-setup-remediations-x64-kb4023057-864104
Title: Windows Setup Remediations (x64) (KB4023057)

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/updatestar/features/
Title: UpdateStar

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/review
Title: Write a review

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/
Title: UpdateStar

Search URL Search Domain Scan URL

URL: https://kate-s-video-converter-free.updatestar.com/
Title: Kate's Video Converter (free) 5.676

Search URL Search Domain Scan URL

URL: https://webcam-simulator-xp-edition.updatestar.com/
Title: Webcam Simulator XP Edition 7.993

Search URL Search Domain Scan URL

URL: https://kate-s-video-cutter-free.updatestar.com/
Title: Kate's Video Cutter (free) 6.379

Search URL Search Domain Scan URL

URL: https://webcam-video-capture.updatestar.com/
Title: Webcam Video Capture 7.993

Search URL Search Domain Scan URL

URL: https://fake-webcam.updatestar.com/
Title: Fake Webcam 7.3.718

Search URL Search Domain Scan URL

URL: https://news.updatestar.com/post/security-updates-for-chromium-based-brave-vivaldi-and-edge
Title: Security updates for Chromium-based Brave, Vivaldi and Edge

Search URL Search Domain Scan URL

URL: https://news.updatestar.com/post/adobe-closes-critical-photoshop-vulnerabilites-with-april-updates
Title: Adobe closes critical Photoshop vulnerabilities with April updates

Search URL Search Domain Scan URL

URL: https://news.updatestar.com/post/new-chrome-89-0-4389-128-fixes-two-0-day-gaps
Title: New Chrome 89.0.4389.128 fixes two zero day vulnerabilities

Search URL Search Domain Scan URL

URL: https://news.updatestar.com/post/how-to-get-back-performance-for-your-computer
Title: How to get back performance for your computer

Search URL Search Domain Scan URL

URL: https://news.updatestar.com/post/uninstall-programs-with-the-best-uninstallers-of-2021
Title: Uninstall programs with the best uninstallers of 2021

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/download%20kb4023057
Title: download kb4023057

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/windows%20kb4023057
Title: windows kb4023057

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/windows%20setup%20remediations%20x64
Title: windows setup remediations x64

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/descarga%20tienda
Title: descarga tienda

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/windows%20setup%20remediations%20kb
Title: windows setup remediations kb

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/windows%20setup%20remediation%20cos%27%C3%A8
Title: windows setup remediation cos'è

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/kb%204023057
Title: kb 4023057

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/windows%20setup%20remediations%20x86%20kb4023057
Title: windows setup remediations x86 kb4023057

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/what%20is%20windows%20setup%20remediations
Title: what is windows setup remediations

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/topic/windows%20setup%20remediations%20x%2064
Title: windows setup remediations x 64

Search URL Search Domain Scan URL

URL: https://updatestar.updatestar.com/
Title: UpdateStar Premium Edition

Search URL Search Domain Scan URL

URL: https://chrome.updatestar.com/
Title: Google Chrome

Search URL Search Domain Scan URL

URL: https://microsoft-visual-c-2010-redistributable.updatestar.com/
Title: Microsoft Visual C++ 2010 Redistributable

Search URL Search Domain Scan URL

URL: https://microsoft-visual-c-2008-redistributable.updatestar.com/
Title: Microsoft Visual C++ 2008 Redistributable

Search URL Search Domain Scan URL

URL: https://microsoft-visual-c-2015-redistributable-package.updatestar.com/
Title: Microsoft Visual C++ 2015 Redistributable Package

Search URL Search Domain Scan URL

URL: https://microsoft-edge.updatestar.com/
Title: Microsoft Edge

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/updatestar/download
Title:

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/newsletter-current
Title: Current Newsletter

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/audio-multimedia
Title: Audio & Multimedia

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/business
Title: Business

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/communications
Title: Communications

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/desktop
Title: Desktop

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/development
Title: Development

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/education
Title: Education

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/games-entertainment
Title: Games & Entertainment

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/home-hobby
Title: Home & Hobby

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/internet
Title: Internet

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/security
Title: Security

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/servers
Title: Servers

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/system-utilities
Title: System Utilities

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/web-development
Title: Web Development

Search URL Search Domain Scan URL

URL: https://www.updatestar.com/category/miscellaneous
Title: Miscellaneous

Search URL Search Domain Scan URL

URL: http://feed.updatestar.com/usfeed
Title: Latest updates

Search URL Search Domain Scan URL

URL: https://www.twitter.com/updatestar
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/updatestar
Title: Facebook

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/drivers/overview/
Title: Drivers

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/productkeyfinder/overview/
Title: Product Key Finder

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/passwordfinder/overview/
Title: Password Finder

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/onlinebackup/overview/
Title: Online Backup

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/localbackup/overview/
Title: Local Backup

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/videoconverter/overview/
Title: Video Converter

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/sigparser/overview/
Title: SigParser

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/appcleaner/overview/
Title: AppCleaner

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/help
Title: FAQ

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/contact
Title: Contact

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/partner
Title: Partner

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/about
Title: What is UpdateStar?

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/press
Title: Press

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/team
Title: Team

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/investors
Title: Investors

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/reseller
Title: Find a reseller

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/localization
Title: Localization

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/freelicenseprograms/
Title: Free Licenses

Search URL Search Domain Scan URL

URL: https://client.updatestar.com/en/pad
Title: Submit a Product

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 57

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 96

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 124

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1

Request Chain 125

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YHs2eUhM6iSynMkhMIHn2wAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1

Request Chain 126

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHzpg7hhOCVKJwqP3Yco4Cc&google_cver=1

Request Chain 127

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE1NjU1NDY1MzI5MTQ1MDg4Ng%3D%3D

Request Chain 128

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOZFwgZjyxOzBpWQG2yfi-I&google_cver=1

Request Chain 129

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWVlNjllOTYtZjRhYi0yZjk1LWMwZGMtNDE5ODg1NmEzM2Iw

Request Chain 130

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEFNEd2FpRvJx8uWzJrgI6zM&google_cver=1

Request Chain 131

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZDI3MDg0ZGQtNTRiZS00MzgyLThjNjktNDZjMjA4OTkxZWIx

Request Chain 135

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm HTTP 302
https://partners.tremorhub.com/sync?UIGL=CAESEM1iFuzhNlQ_6Bw1hIVHBU4&google_cver=1

Request Chain 136

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGF-zLnZsg79UukkmnFATA0&google_cver=1

Request Chain 137

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_id=db2399f6-9fb2-11eb-82af-14e583302b06 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZGIyMzk5YzMtOWZiMi0xMWViLTgyYWYtMTRlNTgzMzAyYjA2

Request Chain 156

https://gcdn.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signature/7FA048E4B27D09EA86C3583ED57566F4BE673E93.98402114D77B305D3A5A5CE11E46BFD038465F1F/key/ck2/file/file.mp4 HTTP 302
https://r3---sn-4g5ednsz.c.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/179B7F201601EA38D58BDD718154F4398D878F58.48DECBBC8B61B2F75739A1AA72D44BC0C0420830/key/cms1/cms_redirect/yes/mh/mg/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednsz/ms/onc/mt/1618686982/mv/m/mvi/3/pl/47/file/file.mp4

Request Chain 159

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitUK4sd5oXeAWg-lukzXzqedxpJ3CpFganupsUEo6ZNNWefG8hyYRrHfjzILce7nvAfd_c5_6wM83k7GJfCFJ4cV2Lm51lA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUK4sd5oXeAWg-lukzXzqedxpJ3CpFganupsUEo6ZNNWefG8hyYRrHfjzILce7nvAfd_c5_6wM83k7GJfCFJ4cV2Lm51lA&google_hm=bd_HYJRayB8zSFeWnJHHag==

Request Chain 160

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitUIRQU9qqVHBiQFNZbdqnW82xBxU0_ztu0urzw6m4KTm3LlqORp_eSZ-shg-c8dxjBScKQB6iHAzhfotz4Fa3pKJW1RLcw HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitUIRQU9qqVHBiQFNZbdqnW82xBxU0_ztu0urzw6m4KTm3LlqORp_eSZ-shg-c8dxjBScKQB6iHAzhfotz4Fa3pKJW1RLcw&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NqDoO5UmQKqLbUwA59I89g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUIRQU9qqVHBiQFNZbdqnW82xBxU0_ztu0urzw6m4KTm3LlqORp_eSZ-shg-c8dxjBScKQB6iHAzhfotz4Fa3pKJW1RLcw

Request Chain 161

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitULClsjIljFmLt79jfmbN3QDaMUeySPjRpLgoXoydgJ8Aq-tGSb9epBxK6FV5EWXqj19CYzEu_voYdP_Eupb4dA31vt8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlEtMUstQ0pJUA==&google_push=AQvitULClsjIljFmLt79jfmbN3QDaMUeySPjRpLgoXoydgJ8Aq-tGSb9epBxK6FV5EWXqj19CYzEu_voYdP_Eupb4dA31vt8

Request Chain 162

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUJWA6ybwi9B4n0F5EvFxWnBs-TWnx0ZZORB2nGMm6iXGwEME-pI5l_fkNV7Q6vIQD72htQH2iiyccYAgCBs-9OYe5pLYA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUJWA6ybwi9B4n0F5EvFxWnBs-TWnx0ZZORB2nGMm6iXGwEME-pI5l_fkNV7Q6vIQD72htQH2iiyccYAgCBs-9OYe5pLYA

Request Chain 166

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAQvitULv5-W7jZuVfWFBQ4J8ann38-b8f3xLahqkmMjZPBIGCIz5fKf-B2zrJkzIplr_fPzaV2wmsGRN_GMO_32JY0ItjBmzmfFv&google_gid=CAESEL6JlNzH9avfpGNuIt_PS3U&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPns7IMGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BUXZpdFVMdjUtVzdqWnVWZldGQlE0Sjhhbm4zOC1iOGYzeExhaHFrbU1qWlBCSUdDSXo1ZktmLUIyenJKa3pJcGxyX2ZQemFWMndtc0dSTl9HTU9fMzJKWTBJdGpCbXptZkZ2

Request Chain 167

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitUIblm3x5WBrv0IiG1UAIofb9ee1KqpCqhlRsOj9r3VKj85b1MDDeA_Sx1r8qRWFV1m3cx-yQqlx_pUoiGcHHm9tCFjItVkIaA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUIblm3x5WBrv0IiG1UAIofb9ee1KqpCqhlRsOj9r3VKj85b1MDDeA_Sx1r8qRWFV1m3cx-yQqlx_pUoiGcHHm9tCFjItVkIaA&google_hm=bd_HYJRayB8zSFeWnJHHag==

Request Chain 168

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitULB7b11EflBF3n6OAFbZ28aYfpAR7cKf0YJC_4PHWJU1OHFP3hR62LTr7_NcJ4nxNTDQk2qfRG2p22wWI7YvYE1-T_8EjqVWQ HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitULB7b11EflBF3n6OAFbZ28aYfpAR7cKf0YJC_4PHWJU1OHFP3hR62LTr7_NcJ4nxNTDQk2qfRG2p22wWI7YvYE1-T_8EjqVWQ&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=EtgpOObYRWKx_4m8vq32Pw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULB7b11EflBF3n6OAFbZ28aYfpAR7cKf0YJC_4PHWJU1OHFP3hR62LTr7_NcJ4nxNTDQk2qfRG2p22wWI7YvYE1-T_8EjqVWQ

Request Chain 169

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitUKFbYKIS4yUsH1z9QQWiIVQAZ6r-IqPiVeOxHAvzMyQBDS1fJNELgsCi7ml2DulFVcB-NiBspuuEIpBPb1wMPaKm0ZDETV1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlItMUstR1k0Vg==&google_push=AQvitUKFbYKIS4yUsH1z9QQWiIVQAZ6r-IqPiVeOxHAvzMyQBDS1fJNELgsCi7ml2DulFVcB-NiBspuuEIpBPb1wMPaKm0ZDETV1

Request Chain 170

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUK4POuJkku4hTmFkQDNpwx8ihRAiAEl36_KqXoO-BE5QO2b7pbFero1luGnA6uAhwDN0Y-dJtfDt2eDcepgozGx9uY6KEGpuQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_cver=1&google_push=AQvitUK4POuJkku4hTmFkQDNpwx8ihRAiAEl36_KqXoO-BE5QO2b7pbFero1luGnA6uAhwDN0Y-dJtfDt2eDcepgozGx9uY6KEGpuQ&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8

Request Chain 171

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEGBx7yNBVoViJqBQmFxDd6Y&google_cver=1&google_push=AQvitUIcLcGVG3C6wjW2vMGKN-ai-VEnomSDX2pYPb84vpSzm5AllKvS2_ZjLm09kx2CmmMZMf5YatAK3Yt0LTGMp1HRJKaY7lZOAw HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUIcLcGVG3C6wjW2vMGKN-ai-VEnomSDX2pYPb84vpSzm5AllKvS2_ZjLm09kx2CmmMZMf5YatAK3Yt0LTGMp1HRJKaY7lZOAw&google_hm=

Request Chain 174

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAQvitULi4BSpphPdM3L5Ob-Hh0G0B36BuVdjxE-C1aEd7_bMOWf22izQMWDx0weGjQv9Gnp9cjBSY7YDjaDzg8scFgygnjleq_bDPg&google_gid=CAESEL6JlNzH9avfpGNuIt_PS3U&google_cver=1 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=&google_push

Request Chain 176

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitULpcZR40grfiN7KNxHny_d3BL6R4klDFIwj32V6p7XZ0vgPNJlBpTRITF04yLe31nVUZ4qewzYEIgmRcOtfruWLkEuX0awoUw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULpcZR40grfiN7KNxHny_d3BL6R4klDFIwj32V6p7XZ0vgPNJlBpTRITF04yLe31nVUZ4qewzYEIgmRcOtfruWLkEuX0awoUw&google_hm=bd_HYJRayB8zSFeWnJHHag==

Request Chain 177

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitUJX68Xjgc7wioy-vzp941Pn2dJF56zA47uOLGC4YIUvkAatJ8zI6kjLff8sGzxpthY-nORFlimmlIHLHNZrpQlC4f4fMBfBzQ HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitUJX68Xjgc7wioy-vzp941Pn2dJF56zA47uOLGC4YIUvkAatJ8zI6kjLff8sGzxpthY-nORFlimmlIHLHNZrpQlC4f4fMBfBzQ&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5ejttaobQyCIuMGWMVBD0w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJX68Xjgc7wioy-vzp941Pn2dJF56zA47uOLGC4YIUvkAatJ8zI6kjLff8sGzxpthY-nORFlimmlIHLHNZrpQlC4f4fMBfBzQ

Request Chain 178

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitULEgSCn5qGoPNz4hsqn6SZmuEVHeNZkq66h90c5y2yOykVCrKVzqwca3c0tbiFXPkSrr9RgMx03lP86zg9n9ggmietbPz1UcQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OFYtVC04Slc2&google_push=AQvitULEgSCn5qGoPNz4hsqn6SZmuEVHeNZkq66h90c5y2yOykVCrKVzqwca3c0tbiFXPkSrr9RgMx03lP86zg9n9ggmietbPz1UcQ

Request Chain 179

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUKMT5XFySsrV-_MqwAewxa5qds1M4bsS697hi3l-nz6Wfeh91Mo5BjQ7Mcfq-o7HTgDvTG0etFFyIiyg9Ikduye_Ugz05KB HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_push=AQvitUKMT5XFySsrV-_MqwAewxa5qds1M4bsS697hi3l-nz6Wfeh91Mo5BjQ7Mcfq-o7HTgDvTG0etFFyIiyg9Ikduye_Ugz05KB&google_cver=1&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8

Request Chain 183

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitULkQBEn-g0pBIyVM2E_flqes1qVyO60y4jwnsqTWD-h-bB-b4Wawrt2KEjrUGWCIpEiAV02dynSYeOuLCc34b_L649QCrA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULkQBEn-g0pBIyVM2E_flqes1qVyO60y4jwnsqTWD-h-bB-b4Wawrt2KEjrUGWCIpEiAV02dynSYeOuLCc34b_L649QCrA&google_hm=bd_HYJRayB8zSFeWnJHHag==

Request Chain 184

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitULEkzhRBvD-Zs3RPGZtk14hlVh-WReDfk26qFwXITxmbBBbG-NIApTYu2MHVASKQUg_XcN0znE1fSd2JS9qd_nzuPuDSA HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBtlL_rXT7WkMpIcI2YJAys&google_cver=1&google_push=AQvitULEkzhRBvD-Zs3RPGZtk14hlVh-WReDfk26qFwXITxmbBBbG-NIApTYu2MHVASKQUg_XcN0znE1fSd2JS9qd_nzuPuDSA&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Gq136gYZSlqM4-D_-FQY4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULEkzhRBvD-Zs3RPGZtk14hlVh-WReDfk26qFwXITxmbBBbG-NIApTYu2MHVASKQUg_XcN0znE1fSd2JS9qd_nzuPuDSA

Request Chain 185

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitUI7vHlfsfIHbnIsNetcY7XpFDGo1hChDe9nHG0sOMohsCzZkNM8J9FTZmbUwRrMyorS1mQ792_OA9Kx3ZFCu4321Tqxp58 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OTEtNi1JTkk2&google_push=AQvitUI7vHlfsfIHbnIsNetcY7XpFDGo1hChDe9nHG0sOMohsCzZkNM8J9FTZmbUwRrMyorS1mQ792_OA9Kx3ZFCu4321Tqxp58

Request Chain 186

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUK4_mf2IWpi-RSd7iwb4DwHaR_o1fSPGr0136RNYZkaZdi_uzfrdNXm4BavrkxwMc9eHkylmypuX5DdzI1rRxsAnnpaFys HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_push=AQvitUK4_mf2IWpi-RSd7iwb4DwHaR_o1fSPGr0136RNYZkaZdi_uzfrdNXm4BavrkxwMc9eHkylmypuX5DdzI1rRxsAnnpaFys&google_cver=1

Request Chain 187

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEGBx7yNBVoViJqBQmFxDd6Y&google_cver=1&google_push=AQvitUJ2ZGTMOo5WMgtfw_pWFn122mVbGB2WGmlUXGf7fFbEV1hbQEzzQb6yvrTCR23wS51lvoCu8XMQtc7mQwePB2VRb09Xv6Wp HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUJ2ZGTMOo5WMgtfw_pWFn122mVbGB2WGmlUXGf7fFbEV1hbQEzzQb6yvrTCR23wS51lvoCu8XMQtc7mQwePB2VRb09Xv6Wp&google_hm=

199 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
windows-setup-remediations-x64-kb4023057.updatestar.com/ 72 KB
15 KB 99ms
34ms Document
text/html 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to

Full URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 5f52a2a4fd74335cf7c2e88aacea3f12fde14f83fbe3c8a666ebedfb795bd2f4

Request headers

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Cache-Control: public, max-age=1800
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: Sat, 17 Apr 2021 19:56:42 GMT
Last-Modified: Sat, 17 Apr 2021 19:26:42 GMT
Vary: Accept-Encoding
Date: Sat, 17 Apr 2021 19:26:42 GMT
Content-Length: 15197

GET
H/1.1 200
OK bundle.min.css
www.updatestar.com/css/ 137 KB
22 KB 63ms
18ms Stylesheet
text/css 2a01:488:67:1000:5bfa:5108:0:1
GODADDY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.updatestar.com/css/bundle.min.css?v=b116cd141edf70764e73fe73ed6ce56c
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:5bfa:5108:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 7b61158c957782546cc1ccfad539a099955dd6fb8991af678f5bb4f56ac834fc

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Feb 2021 12:03:06 GMT
ETag: "0f9b1d9245d71:0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Content-Length: 22250

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 134 KB
48 KB 40ms
21ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dad2ac3f093b8cdcca3bfce4fb4d0d7c2e72bd3247ea05ec5e383559d4c3a77f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48646
x-xss-protection: 0
server: cafe
etag: 9885252380620520250
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 17 Apr 2021 19:26:46 GMT

GET
H/1.1 200
OK updatestar.png
windows-setup-remediations-x64-kb4023057.updatestar.com/img/ 2 KB
3 KB 9ms
9ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/img/updatestar.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 8258bb34dad58a914df8656951e209095425f9e97ef34c285850534870956a81

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: windows-setup-remediations-x64-kb4023057.updatestar.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Connection: keep-alive
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Thu, 10 Mar 2016 16:51:54 GMT
Accept-Ranges: bytes
ETag: "a3208026ed7ad11:0"
Content-Length: 2398
Content-Type: image/png

GET
H/1.1 200
OK default32.png
w2.updatestar.com/img/ 275 B
511 B 71ms
8ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/default32.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: e7a22b586532669e3e86d019c3faa366bb89af54fea98c28eb526415d01990a7

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Sat, 01 Mar 2014 12:41:49 GMT
Accept-Ranges: bytes
ETag: "80e419d4b35cf1:0"
Content-Length: 275
Content-Type: image/png

GET
H/1.1 200
OK 194656.16.png
w2.updatestar.com/img/icons/ 889 B
1 KB 64ms
9ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/194656.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: df459cee9ec384ffb36fe3bd30be6223768026a9504aabfcb20f3591b560f118

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 10:58:58 GMT
Accept-Ranges: bytes
ETag: "3967218b5ecd1:0"
Content-Length: 889
Content-Type: image/png

GET
H/1.1 200
OK 308712.16.png
w2.updatestar.com/img/icons/ 636 B
873 B 67ms
9ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/308712.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 0701062315db741bfead2f54f7fc780406199066f0c86c8841c010a3cf28ae24

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 11:29:07 GMT
Accept-Ranges: bytes
ETag: "1a6fd1378f5ecd1:0"
Content-Length: 636
Content-Type: image/png

GET
H/1.1 200
OK 194663.16.png
w2.updatestar.com/img/icons/ 902 B
1 KB 68ms
9ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/194663.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 4ce4d3e7b658426e6172ad2bd9ebff862b0c6d79a7e37f231c5cbb9863b7e2de

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 10:58:58 GMT
Accept-Ranges: bytes
ETag: "c2ea8b18b5ecd1:0"
Content-Length: 902
Content-Type: image/png

GET
H/1.1 200
OK 2309965.16.png
w2.updatestar.com/img/icons/ 766 B
1003 B 69ms
8ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/2309965.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: d1aad7a983d9b2bdcc158d96f17db24a864603727d954ad3afe8a188f20c179d

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Sat, 20 Aug 2016 01:23:35 GMT
Accept-Ranges: bytes
ETag: "7cf1fb7881fad11:0"
Content-Length: 766
Content-Type: image/png

GET
H/1.1 200
OK 155665.16.png
w2.updatestar.com/img/icons/ 742 B
979 B 70ms
8ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/155665.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: a9a2626d6b1d0fb3f24fddcadf96b79a9c107ccaa5250b1885ba11f922ec0e40

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 10:12:00 GMT
Accept-Ranges: bytes
ETag: "34162b72845ecd1:0"
Content-Length: 742
Content-Type: image/png

GET
H/1.1 200
OK 355293.16.png
w2.updatestar.com/img/icons/ 508 B
745 B 10ms
8ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/355293.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 171b6e355c235e58754a27d900371770b434e5093e5bf7a9d2a8b912e6cdbbd6

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 11:38:57 GMT
Accept-Ranges: bytes
ETag: "bb8bbf97905ecd1:0"
Content-Length: 508
Content-Type: image/png

GET
H/1.1 200
OK 1928840.16.png
w2.updatestar.com/img/icons/ 754 B
991 B 9ms
9ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/1928840.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 89555f8516be696ecc1157f52331730b4000680c9aae8341f0500981940a264c

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 10:58:24 GMT
Accept-Ranges: bytes
ETag: "1d6548ed8a5ecd1:0"
Content-Length: 754
Content-Type: image/png

GET
H/1.1 200
OK 1988109.16.png
w2.updatestar.com/img/icons/ 564 B
801 B 9ms
9ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/1988109.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: a2ce29ef0387dbb94fa1b193f97d25f34ed6616fa062130e6f2b4f947a40bb07

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 11:00:11 GMT
Accept-Ranges: bytes
ETag: "335b4c2d8b5ecd1:0"
Content-Length: 564
Content-Type: image/png

GET
H/1.1 200
OK 1988107.16.png
w2.updatestar.com/img/icons/ 624 B
861 B 9ms
9ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/1988107.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: ef398d5b03e57f4b4428d8a75e8dc57c6e7f07795f2fae93973f67bcdd5c737e

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 10 Jul 2012 11:00:11 GMT
Accept-Ranges: bytes
ETag: "afec352d8b5ecd1:0"
Content-Length: 624
Content-Type: image/png

GET
H/1.1 200
OK 2236023.16.png
w2.updatestar.com/img/icons/ 566 B
803 B 9ms
8ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/2236023.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 283652e99752eb1b23ac025393eadcfbd463292066f6a4d3523d02ae83b5b208

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Sun, 23 Aug 2015 23:01:54 GMT
Accept-Ranges: bytes
ETag: "bcd02fb4f7ddd01:0"
Content-Length: 566
Content-Type: image/png

GET
H/1.1 200
OK 2434529.16.png
w2.updatestar.com/img/icons/ 471 B
707 B 9ms
8ms Image
image/png 2a01:488:67:1000:523:fd96:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://w2.updatestar.com/img/icons/2434529.16.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:523:fd96:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 83255723be76a8574abc6aee2787abebdcfbaa6181b3adfa9acf87561062ff8d

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:42 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 21 Jan 2020 00:07:10 GMT
Accept-Ranges: bytes
ETag: "a00e2b9eecfd51:0"
Content-Length: 471
Content-Type: image/png

GET
H/1.1 200
OK us32.png
www.updatestar.com/img/ 465 B
701 B 10ms
9ms Image
image/png 2a01:488:67:1000:5bfa:5108:0:1
GODADDY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.updatestar.com/img/us32.png
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:5bfa:5108:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: bdcc0895910efb7613d6b32a61ddd3a0ea248d74c871b9e12e6cfd674130902d

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:45 GMT
Cache-Control: public,max-age=31536000
Last-Modified: Sat, 01 Mar 2014 12:41:49 GMT
Accept-Ranges: bytes
ETag: "80e419d4b35cf1:0"
Content-Length: 465
Content-Type: image/png

GET
H/1.1 200
OK bundle-dark.min.css
www.updatestar.com/css/ 150 KB
23 KB 40ms
29ms Stylesheet
text/css 2a01:488:67:1000:5bfa:5108:0:1
GODADDY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.updatestar.com/css/bundle-dark.min.css?v=8dd4aad29b89f2cd9db3505dd13b07cd
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:5bfa:5108:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 8d533af61758c8947ccc7cd5dda53a8ac1b61e299644bfd7a6181c4756d93d01

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Feb 2021 14:57:07 GMT
ETag: "80234293d5d71:0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Content-Length: 23006

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 94 KB
33 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 17:35:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6650
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33507
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Apr 2022 17:35:56 GMT

GET
H/1.1 200
OK main.min.js Show response
www.updatestar.com/js/ 32 KB
10 KB 20ms
10ms Script
application/x-javascript 2a01:488:67:1000:5bfa:5108:0:1
GODADDY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.updatestar.com/js/main.min.js?v=ccec977235c3015dc3f1f31606063ec2
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:5bfa:5108:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: 6566c2fd04425e23474c3c6fa04f5556d2c8fc40229553e69d67428b93821d2f

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Feb 2021 11:56:22 GMT
ETag: "077e4e8235d71:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Content-Length: 10437

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 62 KB
21 KB 35ms
14ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bee022a4099fdb924d19ba7cdd46c87f30d360ccf955a7fdcb45f8f83ddf4b2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "846 / 231 of 1000 / last-modified: 1618610925"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21051
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:47 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 19 Mar 2021 19:22:18 GMT
server: Golfe2
age: 5596
date: Sat, 17 Apr 2021 17:53:31 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19463
expires: Sat, 17 Apr 2021 19:53:31 GMT

GET
H/1.1 200
OK icomoon.ttf
www.updatestar.com/fonts/ 4 KB
3 KB 57ms
9ms Font
application/x-font-ttf 2a01:488:67:1000:5bfa:5108:0:1
GODADDY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.updatestar.com/fonts/icomoon.ttf?mv55hb
Requested by: Host: www.updatestar.com
URL: https://www.updatestar.com/css/bundle.min.css?v=b116cd141edf70764e73fe73ed6ce56c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2a01:488:67:1000:5bfa:5108:0:1 , Germany, ASN20773 (GODADDY, DE),
Reverse DNS
Software: /
Resource Hash: b816668594e35fd9456a9b017f3a1496506cb22763392958396b8edb1d1b0fd9

Request headers

Origin: https://windows-setup-remediations-x64-kb4023057.updatestar.com
Referer: https://www.updatestar.com/css/bundle.min.css?v=b116cd141edf70764e73fe73ed6ce56c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:45 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Dec 2019 15:15:20 GMT
ETag: "0b46378a3aed51:0"
Vary: Accept-Encoding
Content-Type: application/x-font-ttf
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Content-Length: 2841

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20190131/ 222 KB
83 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4118765744455397&plah=windows-setup-remediations-x64-kb4023057.updatestar.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11d5cc5bb3db6c56fb91f9068e7f4741f6212c8e2e5546b17039c1c58720fb83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 84747
x-xss-protection: 0
server: cafe
etag: 7950800710615234990
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 17 Apr 2021 19:26:47 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210414/r20190131/ Frame E417 10 KB
5 KB 8ms
5ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210414/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210414/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 17 Apr 2021 14:17:37 GMT
expires: Sat, 01 May 2021 14:17:37 GMT
content-type: text/html; charset=UTF-8
etag: 10446291943670460780
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4644
x-xss-protection: 0
age: 18550
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 27ms
13ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j89&a=1935585767&t=pageview&_s=1&dl=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&ul=en-us&de=UTF-8&dt=Windows%20Setup%20Remediations%20(x64)%20(KB4023057)%20-%20Download&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=33594317&gjid=952362899&cid=458093147.1618687607&tid=UA-113330-2&_gid=467462536.1618687607&_r=1&_slc=1&z=341048974

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://windows-setup-remediations-x64-kb4023057.updatestar.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 11ms
11ms Image
image/gif 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j89&a=1935585767&t=event&_s=2&dl=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&ul=en-us&de=UTF-8&dt=Windows%20Setup%20Remediations%20(x64)%20(KB4023057)%20-%20Download&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Downloads&ea=NoDownload&el=Windows%20Setup%20Remediations%20(x64)%20(KB4023057)&_u=IEBAAAABAAAAAC~&jid=&gjid=&cid=458093147.1618687607&tid=UA-113330-2&_gid=467462536.1618687607&z=956749599

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 02:29:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 61052
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2021041301.js Show response
securepubads.g.doubleclick.net/gpt/ 295 KB
104 KB 135ms
48ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

31e420b79e7760a7860ed2fb595c4f11b498559791571fed7eb22be20c7fa5e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Apr 2021 08:38:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 106168
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:47 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 204 B
640 B 376ms
50ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=windows-setup-remediations-x64-kb4023057.updatestar.com&callback=_gfp_s_&client=ca-pub-4118765744455397

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210414/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4118765744455397&plah=windows-setup-remediations-x64-kb4023057.updatestar.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

30928d56339eb13baf78412546f54a0c88c666e812e24af89c47b0d04280682b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 192
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
799 B 40ms
19ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=windows-setup-remediations-x64-kb4023057.updatestar.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 33ms
14ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=windows-setup-remediations-x64-kb4023057.updatestar.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2692 54 B
56 B 77ms
76ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&adk=1812271804&adf=3025194257&lmt=1618687602&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607066&bpp=13&bdt=135&idt=156&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6376118320302&frm=20&pv=2&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&dtd=177

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

166a4ec3cb90d525f7f744c7616c01b36bebd6dcecd486c8f5be14ccc0a7b3da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4118765744455397&output=html&adk=1812271804&adf=3025194257&lmt=1618687602&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607066&bpp=13&bdt=135&idt=156&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6376118320302&frm=20&pv=2&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&dtd=177
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 17 Apr 2021 19:26:47 GMT
server: cafe
content-length: 34
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 17-Apr-2021 19:41:47 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Apr 2021 19:26:47 GMT
cache-control: private

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 28ms
13ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74e1cf077493c33fe895c7ce5732cda76b195e2d357d928f094bc3367cc7a75f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1618423639646658"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28266
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:47 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
116 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c0d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-113330-2&cid=458093147.1618687607&jid=33594317&gjid=952362899&_gid=467462536.1618687607&_u=IEBAAAAAAAAAAC~&z=1311287785

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0d::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 17 Apr 2021 19:26:47 GMT
content-type: text/plain
access-control-allow-origin: https://windows-setup-remediations-x64-kb4023057.updatestar.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C70A 74 KB
25 KB 428ms
427ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&h=280&slotname=7484580198&adk=3746994897&adf=4224226154&pi=t.ma~as.7484580198&w=587&fwrn=4&fwrnh=100&lmt=1618687602&rafmt=1&psa=0&format=587x280&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607128&bpp=5&bdt=197&idt=131&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6376118320302&frm=20&pv=1&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=392&ady=805&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cEGpiHs0PF&p=https%3A//windows-setup-remediations-x64-kb4023057.updatestar.com&dtd=139

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c10dc19e6af1691814a11c57928e5c27b7c379fdb6842c7bfe8cd4237ab0c441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4118765744455397&output=html&h=280&slotname=7484580198&adk=3746994897&adf=4224226154&pi=t.ma~as.7484580198&w=587&fwrn=4&fwrnh=100&lmt=1618687602&rafmt=1&psa=0&format=587x280&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607128&bpp=5&bdt=197&idt=131&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6376118320302&frm=20&pv=1&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=392&ady=805&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cEGpiHs0PF&p=https%3A//windows-setup-remediations-x64-kb4023057.updatestar.com&dtd=139
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 17 Apr 2021 19:26:47 GMT
server: cafe
content-length: 25590
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 17-Apr-2021 19:41:47 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Apr 2021 19:26:47 GMT
cache-control: private

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
108 B 30ms
29ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-113330-2&cid=458093147.1618687607&jid=33594317&_u=IEBAAAAAAAAAAC~&z=446921432

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
30ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-113330-2&cid=458093147.1618687607&jid=33594317&_u=IEBAAAAAAAAAAC~&z=446921432

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 30ms
15ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=windows-setup-remediations-x64-kb4023057.updatestar.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 28ms
14ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=windows-setup-remediations-x64-kb4023057.updatestar.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 171 KB
44 KB 1448ms
1395ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2184664486121229&correlator=3253719344442924&output=ldjh&impl=fifs&eid=31060787%2C31060789%2C21068766%2C31060413%2C31060736%2C44733568&vrg=2021041301&ptt=17&sc=1&sfv=1-0-38&ecs=20210417&iu_parts=1032860%2CDetail_Left_Top_WideSkyscraper%2CDetail_Center_Top_Leaderboard%2CDetail_Right_Middle_MediumRectangle%2CDetail_Right_Bottom_MediumRectangle%2CDetail_Center_Bottom_LargeRectangle&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=160x600%2C728x90%2C336x280%2C336x280%2C336x280&cust_params=Product%3Dwindows-setup-remediations-x64-kb4023057&cookie_enabled=1&bc=31&abxe=1&lmt=1618687602&dt=1618687607417&dlt=1618687606931&idt=463&frm=20&biw=1600&bih=1200&oid=3&adxs=191%2C392%2C1046%2C1046%2C517&adys=526%2C136%2C536%2C836%2C1638&adks=2459160219%2C54240663%2C1989851401%2C3518012090%2C132238113&ucis=1%7C2%7C3%7C4%7C5&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=211x990%7C1058x90%7C440x1311%7C440x1311%7C617x1923&msz=160x600%7C728x90%7C336x280%7C336x280%7C336x280&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=false&fws=512%2C0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

52eb3461764bc72867e3ae26f0f1ede92d99f9e351e6dbb06614bba4bd75bf0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45171
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://windows-setup-remediations-x64-kb4023057.updatestar.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 76ms
14ms Other
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-38/html/ 0
0 27ms
6ms Other
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 31b4ea2bd2a51d39610fc8aa214e4119.js Show response
www.gstatic.com/mysidia/ Frame C70A 6 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/31b4ea2bd2a51d39610fc8aa214e4119.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&h=280&slotname=7484580198&adk=3746994897&adf=4224226154&pi=t.ma~as.7484580198&w=587&fwrn=4&fwrnh=100&lmt=1618687602&rafmt=1&psa=0&format=587x280&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607128&bpp=5&bdt=197&idt=131&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6376118320302&frm=20&pv=1&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=392&ady=805&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cEGpiHs0PF&p=https%3A//windows-setup-remediations-x64-kb4023057.updatestar.com&dtd=139

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1152be785978aa809034ab61de86ce4d03c5a301c95e96995e336d2462832a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 16 Apr 2021 02:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 01:23:38 GMT
server: sffe
age: 148509
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2779
x-xss-protection: 0
expires: Thu, 15 Jul 2021 02:11:38 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C70A 3 KB
674 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 17 Apr 2021 18:14:39 GMT
server: ESF
date: Sat, 17 Apr 2021 19:26:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 17 Apr 2021 19:26:47 GMT

GET
H2 200 e91d763233dfa13a1924fbe91cfd4845.js Show response
www.gstatic.com/mysidia/ Frame C70A 8 KB
4 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e91d763233dfa13a1924fbe91cfd4845.js?tag=pingback

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bedddb3e8da114412602440e01aa8122a149527f3f30859c276f5efa31ecb7e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 06:51:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Apr 2021 02:07:20 GMT
server: sffe
age: 218107
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3798
x-xss-protection: 0
expires: Wed, 14 Jul 2021 06:51:40 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame C70A 1 KB
909 B 9ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:24:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:24:16 GMT

GET
H2 200 0107d4d65a69ef1d3370745262ab87c7.js Show response
www.gstatic.com/mysidia/ Frame C70A 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/0107d4d65a69ef1d3370745262ab87c7.js?tag=analytics_pingback_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aeef6f2fa6044cadada5782a968531ac7b2a0207e741d67671e441b1fc5a656d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 09:11:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 01:23:38 GMT
server: sffe
age: 209724
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1307
x-xss-protection: 0
expires: Wed, 14 Jul 2021 09:11:23 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/ Frame C70A 17 KB
7 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76d293cad87de584b5105472b9672fb1460dcf35f82079e274e44a47860bf700

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:25:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7113
x-xss-protection: 0
server: cafe
etag: 11066897925667386271
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:25:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame C70A 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:25:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:25:42 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C70A 118 KB
36 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1618423651533291"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36717
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:47 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame C70A 13 KB
5 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

231064110361844d6320331a5c35979c2a492a546604d97181eb6cf7aa4ae1cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:21:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5602
x-xss-protection: 0
server: cafe
etag: 7525161794280374107
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:21:49 GMT

GET
H3-29 200 a0b5068ca1fc7f6ff765c7833258ec42.js Show response
www.gstatic.com/mysidia/ Frame C70A 25 KB
10 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a0b5068ca1fc7f6ff765c7833258ec42.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

789a93f4315357995e96053e32ee793d6b12f592fad617bb04f795c750f0c3bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 09:54:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Apr 2021 02:07:20 GMT
server: sffe
age: 293566
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10491
x-xss-protection: 0
expires: Tue, 13 Jul 2021 09:54:01 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame C70A 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CwlAxdzZ7YMzGEdD33wPfia-QB-76-YNi2d6Q39ANpJWmtYIPEAEg1rWlBmCViviBlAegAbDonrQDyAEBqAMByAPLBKoEgQJP0D474dNiEY7ad2Kmv5_WRcmW6MMieS_RpzwPcL9nGzuM75UkzcpY4D49rhNum3XCRFYdnWvaZJNH9NA5MaVZZibmYnTI5JBaI7sJ1meSjP3nq7f1tROQArBMy2U7v8gbGQRye8fLysTGYoI09JKK13L2d1EGByLf4p3kXb15WmDkmf8iMfhrjh6uQjPgkdwb2yMiwiIX8URrZNBJbzi9EDKvIKSfDRu4-bicJNVnXnElWT86dBc6GbD-yW3ZxGuTEpLnYL-sTPxrT6ro7nS8tZUV-dX-8ema6C9iNDMOpTtgCc-c76ELyTCxPqqR0nLUFxw9525ZLmW_NS6BO2-vb8AEvtjs37IDkgUECAQYAZIFBAgFGASAB7iX4UuoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwUQ4MXMAtIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi00MTE4NzY1NzQ0NDU1Mzk3&sigh=Loo_2i2XIVg

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&h=280&slotname=7484580198&adk=3746994897&adf=4224226154&pi=t.ma~as.7484580198&w=587&fwrn=4&fwrnh=100&lmt=1618687602&rafmt=1&psa=0&format=587x280&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607128&bpp=5&bdt=197&idt=131&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6376118320302&frm=20&pv=1&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=392&ady=805&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cEGpiHs0PF&p=https%3A//windows-setup-remediations-x64-kb4023057.updatestar.com&dtd=139
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 17 Apr 2021 19:26:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:47 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 35BD 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&h=280&slotname=7484580198&adk=3746994897&adf=4224226154&pi=t.ma~as.7484580198&w=587&fwrn=4&fwrnh=100&lmt=1618687602&rafmt=1&psa=0&format=587x280&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607128&bpp=5&bdt=197&idt=131&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6376118320302&frm=20&pv=1&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=392&ady=805&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cEGpiHs0PF&p=https%3A//windows-setup-remediations-x64-kb4023057.updatestar.com&dtd=139
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4118765744455397&output=html&h=280&slotname=7484580198&adk=3746994897&adf=4224226154&pi=t.ma~as.7484580198&w=587&fwrn=4&fwrnh=100&lmt=1618687602&rafmt=1&psa=0&format=587x280&url=https%3A%2F%2Fwindows-setup-remediations-x64-kb4023057.updatestar.com%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1618687607128&bpp=5&bdt=197&idt=131&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6376118320302&frm=20&pv=1&ga_vid=458093147.1618687607&ga_sid=1618687607&ga_hid=1935585767&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=392&ady=805&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060614%2C44740079&oid=3&pvsid=2184664486121229&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cEGpiHs0PF&p=https%3A//windows-setup-remediations-x64-kb4023057.updatestar.com&dtd=139

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 17 Apr 2021 19:23:25 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 202
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C70A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4d8f412282d8066bb35295f8f4a335f70276d365c152267bb77b1451063aef67

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame C70A 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
age: 552189
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
expires: Mon, 11 Apr 2022 10:03:38 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame C70A 21 KB
21 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 02:03:02 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
age: 235425
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
expires: Fri, 15 Apr 2022 02:03:02 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 9 KB
7 KB 27ms
26ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210414&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ad9afc00b9bbda56877958b80a8ef7f850dd2a4960c2fb298c79c8578eb4f6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6930
x-xss-protection: 0

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 35BD
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
38ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmir1-c04G0ho69UM33evkYclFstAVFPs2kXQP2PsUMai7rYGCgAj-VI3X0zSA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 17 Apr 2021 19:26:47 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 17-Apr-2021 20:26:47 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Apr 2021 19:26:47 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 17 Apr 2021 19:26:47 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js Show response
pagead2.googlesyndication.com/bg/ Frame 40E9 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

693a39255f808f38ae64d4daf12a78de32d51bca970b01fb398534e81fb641b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 12:29:47 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 25020
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5682
x-xss-protection: 0
expires: Sun, 17 Apr 2022 12:29:47 GMT

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C70A 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=ChgIASoUYmFubmVyLWxhcmdlLXZhbmlsbGEKCggCKgZzZXJ2ZXIKGggEKhZteXNpZGlhX2FuYWx5dGljc19leHAyCgcIBioDMTAwCg0QAyEAAIi6Hit-QDAECg0QCiEAAABc61ELQDAECg0QDSEAAAAAMHqEPzAECg0QHioHNTg3eDI4MDAECg0QGSoHNTg3eDI4MDAECg0QDiEAAAAAMHqEPzAECg0QECEAAAAAAATZQDAECg0QESEAAAAAAAAAADAECg0QEiEAAAAAAAAAQDAECg0QEyEAAAAAAAAAQDAECg0QBCEAABDuUW5-QDAECg0QDyEAAAAAMHqEPzAECg0QFCEAAAAAABCFQDAECg0QFSEAAAAAAAAQQDAECg0QFiEAAAAAAAAIQDAECg0QBSEAAMjB9XB-QDAECg0QFyEAAAApXAqBQDAECg0QGCEAAKiQwt6BQDAEEhpDSXplMXA2Qmh2QUNGZEQ3ZHdvZDM4UUxjZyIQdGV4dC92YW5pbGxhX3JkYSgD

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/e91d763233dfa13a1924fbe91cfd4845.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:47 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame EBB0 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Sat, 17 Apr 2021 15:25:26 GMT
expires: Sun, 17 Apr 2022 15:25:26 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 14481
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js Show response
pagead2.googlesyndication.com/bg/ Frame EBB0 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

693a39255f808f38ae64d4daf12a78de32d51bca970b01fb398534e81fb641b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 12:29:47 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 25020
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5682
x-xss-protection: 0
expires: Sun, 17 Apr 2022 12:29:47 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210414&jk=2184664486121229&bg=!YWKlYibNAAZUuIlwVLg7ACkAdvg8Wi52GlASugqhp2cWNkMuN5zHazNWv3B0UPcqpNm5k6cgH_enWwIAAABZUgAAAAloAQcKASpzQEjuAj6P54XpVMuivMhMA5N50TrYwd1q6dLggSj3rJ5kRftvLTtCzFVshwh4FJ8lNyul17ZwdTwvOdteiO0NGUok3oYIF6ARk4EwIeXCWebubp9D8jHWSSkIjQwa7shZ3-5lzbBKWfsJm_H5NckOHrtixa8Xy_nr3bqOKpdZrMc047RoIKvogqevFwxozToFvEqb-by8MXwW-A5Z9-EBJ3rDCBrAu6ygAqdzUH4OWPjnCnh1QM25lwIOC04N2Sm7Uu_usTukloac7UAVNICTPSxr8JBkzA4GtySkRz1pSpgU2Jp3HErVBBCwj6yM8WzI_t48NS0Hqaoie5mXRyJsZ1AGj0DlbOLGznxyMjqJwCUotCyzzYrwVszNy4AGUsRY3xqiSuQlfE_EmQJNadCkI8uRkvv9PzyjqGdV-YEXBh3jmNlcElR5qYNPsQyHSbWzdlpvsxHEMVNNQAgoci49gLfJ5jKkKrnSP_lXDRrolg0h5ZL75Huc-9T2_3LsRszcJyMqPNnZCtbITqRVi74krrhcfrjpwWL1lOC_kKCxG7I7nO5ypkEbqn0SNJxEqVZ8mnVr-D0WdTvTIxidIhu0unQFnCkNbyXeMubbZ5PBk0Cq9Jt93yHSgrNfV9pOGeuV5eq9i6Uye1aVzsgb0euol7S4GTPm_qnDIXzgYD4_J9wbc8huVFyVokAbwYIKRIClbmX5TnGTVmZicsqk2HPhvGD8WlOSpn00BxeY19wU5LGgq90KakOuJN223XjSRwMKcuWeoi7PYmeUtXWDD3INS-MKO0QFixkHouwVRG7b7x6XF1MnPJSe06EMF1sS12kPOARP7g7ViTlsXBiAYNPLC_nA8mgPqAa3NoE67zWborpPkTKJDUAH41V162dGsLRrlhPrd9JNr3cNaw2ICAIK_eZtJB6Ge6D6YNJ4f_k2O68ZlIyZWWPATmUdxnNT5IeotDqTr6hhHhcQzJw5lEUyxD_JTxTwrKOjUESi9nk1SMpd5gyvU8Z-rUdLTWlE4I6rKF_Nc6BIcleQuwnk4DQWU_djPei43P3E5qzZxP_fCayqK9yopyhpbSorDjQtCXXRPyQRkwxCQ3QiCoLkIJsly3SIFZF_hOIOUlgbhY7UozSObShYYIl0E5LuyJkBjLJTWDkQ3f82yXpJ8fB3y3PT_aSzFDh-q_YMfA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C70A 42 B
64 B 41ms
40ms Fetch
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu2rfIuK-7ggM7YsLp91Oqn3ZMO2q2hC_6Hm5HUWXAkP5v1FVgS5f_c-DywVtXktK8rvlMAbHJ7ykRXCXw7dXIZmc7Y9yBnAz6WeCSF5yjzue0ZXn7_6vcsnoi48g&sai=AMfl-YR3nq8b_NS7jITbZTYwbp5YiT4deiMM-qI5gPt1B31IMJyq4aVksk5RO_un6Ub6fWDkCU11XsFkChlJ&sig=Cg0ArKJSzBE7eTaKFEYuEAE&id=lidar2&mcvt=1000&p=805,392,1085,979&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210414&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=3746994897&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1618687607271&dlt=429&rpt=62&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 24CA 6 KB
3 KB 20ms
6ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Sat, 17 Apr 2021 19:26:47 GMT
expires: Sun, 17 Apr 2022 19:26:47 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012103020108001/ Frame 298F 190 KB
55 KB 29ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e553b4e88ac4a1819d608fe9dcb46544ca5fb776d4e0c84d773f37b1df18211

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93896
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55046
x-xss-protection: 0
server: sffe
date: Fri, 16 Apr 2021 17:21:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "aeaf363b1ad89b36"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Apr 2022 17:21:52 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 298F 12 KB
5 KB 39ms
15ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9560479a05fb86854546c40ec030edc2bac692d4142391d69b16e5c033a185

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93895
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4548
x-xss-protection: 0
server: sffe
date: Fri, 16 Apr 2021 17:21:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4eb73d471ab4cb2c"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Apr 2022 17:21:53 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 298F 87 KB
27 KB 41ms
18ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6f768cbb894f2690011ee62662d3ac9480d12f5088fa46be57e650fcc4d835c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93895
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27208
x-xss-protection: 0
server: sffe
date: Fri, 16 Apr 2021 17:21:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "22950e05e749846e"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Apr 2022 17:21:53 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 298F 27 KB
9 KB 40ms
17ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21d45a4ed77653b3b1ee2b47a786a4dbb936a3b19fc56e1b44c16aed35eb80ee

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93895
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9587
x-xss-protection: 0
server: sffe
date: Fri, 16 Apr 2021 17:21:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "739644f32ad1483f"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Apr 2022 17:21:53 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 298F 40 KB
13 KB 39ms
16ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c6af60796cc240ad277098308cf363c2700f5296264ec1b43b4e1362763c439

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93895
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12827
x-xss-protection: 0
server: sffe
date: Fri, 16 Apr 2021 17:21:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5cc8dcc2368726c7"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Apr 2022 17:21:53 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 298F 3 KB
578 B 23ms
21ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 17 Apr 2021 18:18:27 GMT
server: ESF
date: Sat, 17 Apr 2021 19:26:48 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 17 Apr 2021 19:26:48 GMT

GET
H3-29 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/1157778757752516151/ Frame 298F 4 KB
4 KB 7ms
7ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1157778757752516151/downsize_200k_v1?w=100&h=100

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98aa21f37c7c33954b30ef5586e103e1e07cfdeb899a8dbf2e07b8bbfff6fd97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Apr 2021 10:05:37 GMT
x-content-type-options: nosniff
age: 552071
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4395
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 21:12:40 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Apr 2022 10:05:37 GMT

GET
DATA 200
OK truncated
/ Frame 298F 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4980081661d8bdc7873b8dff4e3694aa28adb873ad95a4616e671c6a9bf0e456

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 container.html Show response
f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BE98 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Sat, 17 Apr 2021 19:26:47 GMT
expires: Sun, 17 Apr 2022 19:26:47 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 608D 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Sat, 17 Apr 2021 19:26:47 GMT
expires: Sun, 17 Apr 2022 19:26:47 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5A80 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Sat, 17 Apr 2021 19:26:47 GMT
expires: Sun, 17 Apr 2022 19:26:47 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 en_bl.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 298F 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en_bl.png

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 13:14:33 GMT
x-content-type-options: nosniff
server: cafe
age: 22336
etag: 11660698925711390587
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2471
x-xss-protection: 0
expires: Sun, 18 Apr 2021 13:14:33 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 298F 295 B
319 B 7ms
7ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 16 Apr 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 76184
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sat, 17 Apr 2021 22:17:05 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 298F 0
0 14ms
13ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQYiX70McXLM1ivC6jFm_VImwi2ZlO3Erl3NmdrWKAsY76FuHd23n_CgU4MMTaNGWvJBHtAbYvYF3cYXLeVEZjljJOd9g
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 298F 0
0 84ms
83ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C4BoOdzZ7YNTMIJb57gOyvp2YCqv7qYNh66nKrf8Mqtu_oNQBEAEg1rWlBmDRgbmC0AegAf_bisgDyAEB4AIAqAMBqgSyAk_QBr3HGCV1GM91osY2U8ky6Z5y0yHA1rpQjijmSqNOlmsGWqGza-vFnqVNLMPXXZSVHphlbhHjvGoYyD0CyXAHeECnZ6MLlQW9VzDwJtFuiveuwHZ1e5YACeDXltCZU32zaZokc9ftUNxEYd3Q6AiuijD4TWQlZOmAmot-Rdbr9t6BcNTmQfC4VaSxIitofEC53slSbVMiejIdb_V5-HGKvhXsmV4O09vDXOkce3E93-xdOzdktfnKUI6pgUbkOzYvszJhNbLOuDoA4W3CHNlTU5cuNR3QDvjJwMxX0p0OyR0J_MOLszwEIGyNKjyEZ3CqFckxEb4-HIrUQNDqhflFKgGdcRO6Z0NQtloOG0I6Ix7PDpyYJk4QBo5dz3WOgfa0cgGdVQKiTkCvSQcolSjvW8AE8aHTr7kD4AQBkgUECAQYAZIFBAgFGASAB_DurKICqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcFEJuV9ATSCAkIgOGAEBABGB2ACgHICwHYEwyIFAGyFxoKGAgAEhRwdWItNDExODc2NTc0NDQ1NTM5Nw&sigh=gDoVTFH3M9k&template_id=5001
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 298F 21 KB
21 KB 16ms
14ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://windows-setup-remediations-x64-kb4023057.updatestar.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 02:03:02 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
age: 235427
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
expires: Fri, 15 Apr 2022 02:03:02 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 298F 21 KB
21 KB 15ms
14ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://windows-setup-remediations-x64-kb4023057.updatestar.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
age: 552191
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
expires: Mon, 11 Apr 2022 10:03:38 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9CE5 624 B
297 B 17ms
16ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYsqqHkgEwAQ&v=APEucNVwpYvLSaA4DtMBpnyYlDxn2-uBm8JRFUGAcw6ghg2S-zVE-TUbBMfQU45GmLFqCN6-2odiPVOnorsakIqkCLgo6izAx3Ex-ZPWmvBibt2BuQ_3FomQEy3r5vo0JXBWlWZ3zNfY1UUxF5xCwh8VJOzFU-J2HTNZeKlkr2VF4xAJ9AePBKRSaWfpxO9_FjzTTZSzXj2_IcuwV2DzTalEpI8zutY6vA

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CICfxAEQ7KXQkAIYsqqHkgEwAQ&v=APEucNVwpYvLSaA4DtMBpnyYlDxn2-uBm8JRFUGAcw6ghg2S-zVE-TUbBMfQU45GmLFqCN6-2odiPVOnorsakIqkCLgo6izAx3Ex-ZPWmvBibt2BuQ_3FomQEy3r5vo0JXBWlWZ3zNfY1UUxF5xCwh8VJOzFU-J2HTNZeKlkr2VF4xAJ9AePBKRSaWfpxO9_FjzTTZSzXj2_IcuwV2DzTalEpI8zutY6vA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlEqWiQKDSlgoFzF0OSq762NKxRqbp2IlJQljiBwreE9oHaOeL6P1VzOl83UX8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 17 Apr 2021 19:26:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 24CA 38 KB
18 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BnWAxhWefQ8Ox-jjlgZDFx9y5PPIvvzeOjv5548UV8oPynToV1JkSt-_XoAJQUibcmJPGKdQjHljw4WmaGLM-hQQOvuanEAs8ETRvDDzU8obP9SGSfseQvZlSxt4UcflKWxU4Yubq6MkcX9fVSdJOWDB0vZA&dbm_d=AKAmf-CgEvGtRENVoHNna8Zq8XCtAJqfok-cZeMH8vxOvn9mekz1bm_2IXXbsacmtptExU6XYrb36jRRW1j9AtpTU8HJk8TcWzvBtiAyR1T87P9AjHP-414UVC4B0qoaKMZnms0Dvc77E2K84wgsMBGIsYMQZxr6YloLzIU6FkrhCXhuUIYEwzaZjU9TSobqYjoJi-qnzlBZcJTTuSo-zkTDIcje1U3gZ8exxxP97at5ly7Iyw6yQtUAgbNwVycBG2sr4g8b1VxN2yQrgZmL6PMT8creOpP9A3BytTIVGOT5IdNbZZAA-yn8fhal8T3Zap6iRXvlCmhr8Mna3fjMYZUN8MqQDftd3NXXlV9_C-Lljl7_iLPZBpopDnNR8FKurq9gQe7Ninu5dlr0V2YSpp1X1a4zlZP1rw8v2isF7nk6geG09Qsc751DAGGqZHur0feXkCAKjDkbPUUdyfOKb321XkTgYJdPA47DZWgZiDw1t55X1vHzj2m6cSivuQl3OrWipF57K-EdMXjGLl3SYZD06Jy7OpYxLkbdQAP-4K90t6qWKFZFO2Rorzjmf5PKQ3GGFJOaUSL9XX8Dt7d57xCU6PqYjF-S-ESOK5pBcEdj5vDEZgBaAha0MvY8GfB9nZIfK9L0IQ4Gi-_Y10R3KpaVGMH95vL3ZViAwzC_72N56KSOFVx1b_HerIDN38isLcFdZJXaMDhezoZJEtj1UlwZbf57C4lPyqIYhyv6hSbAWHtzPSitvrFEGsYbhvZnZvS2CTXJIsN1eqye1hGbyUcYLouW0NOPtkTJDRmUCr9B3O_kY79AuGVJ1_viQKp5qGOAlRK4YEbXvTAEucOkDRMWPBoCQ_MyVQVhBHVu_nYogfgM0BnbhuoNvaZvrzsE8RQH35HSO2dvNckLcjinigoZEEzi2LKImIweP50B5fPVQyvqxuZV21PQiXT5aAK4trXWZ5lI-obh1oYeRSvbyi0MifhLRNNbclvoznVlf1dUl29AE7Y-63w_sKe8kA0AUSS00ixdFhKYHTwvNzx7krei0sW12k1sYaX8WyhxZc4w9SNGu5SceMI02QLdsU7xmuSOZhVQa4XxcM-4xmL54SfoYQGZ8XzDa_ky244heqZfHCviNJH56kI4gA2c1V_5Djq2N9w44wF9Q8IMW0IxgO-460wt2rhqn36bM3Ib6vqdeHuIHxJtDfg0gDKR-ohVx1IYfnFCUZsRm5n0XN-YD-fr2lA32Tb1yY4YVTxlohk3K9GOt5YDs_60G6sBfED353Zom-YLU1yLVryucaYRvksydcM2Fin-I-CJBtjL_jnyF6J7TFnrZ7sOgeu4C6s9Y5oZHwinIpGxDe9J0xO1jtB2NpCyPH5anMrdAnRbLDURykq2-nN-fpqfBm2w0L1G8xn4dfHRug4ZOwJQQAI2ePEKSkD97o_OdFf3ILzzc88HJk2IwK_xsSPF3TgVIwe79Ruvs7R7MNzqBaFUueeiIXfbmknQmH7uzTxtkpbe8QAZyVHGsjnOd2ntq2CekCyG4POguwQVmllzPIn4jwzkeVszxjymJroQMFK3ey8osx8i-k-7o83ZjfJFBVmHfXqb60BWW7YbgQzfTAakH8DKQbJlU2zIQVUkx09P3sBWK8W-S-zzjm_dK3DuLFt-HJ7_TUO_yLg2YKHcaEWSQUfo4cvXPmFzfCDSp2ZD02Iq2uhJMf5iyQRGJns746kQXcxlQZNQQZYJpgXH6yFkHjdSw0ey9W_VAmJGfKiISFvPOcA5sUOvNRzMp55EoxRXIsP6mJgciLzDzbwzafXsaeaAqFW8VPo1ePBnviAH_cUTRoXw56R2bpF3BBmd97uU-Vf_WZb3g5_vN2AiTMoLCcQf8BVTEp7Gk66Y2fyjS1VItIyHLjCwBxcUXfLsLu8V8rxS7DzZ_MeYnOofNQ5IBXjYkaDYyZ0SpLpU7crPuQ10DmlLGsxv2BsOCF_N7iU2QGXPbHJy1h6xKTZ9vNBJ1IyK8Hr6mwJudTy1vHv32gjjKfAIOvtwC0RtmP4sPJbvFpo65cOkYPi8TKJQaSoeZsqe6DjH-1iR8rnK-99jcbbiHLLODJrpsbfLRoZRkuUVUiY24-L4fVJisCzkcwAkHlscEULohCnZE1LX6mb9WMrx-YzklcXdNkjUdhzDYnYFQYgRDZsILYof63kuJAj0d7lEpFJCwAudacQcENdtlDLRgAmgW83sW0CclSWoh0ct3kTnrLMpP8m7nYylp29_29uSXHT_f5c_VO8Jzys8gFi-eKcQ2ouCz0I_HcMbAlkKsqNv6Y3x65u6welTjb_Dj9KLn8NuGxxjqgIVivp2TP0p_YAtuBo0uWcwCm1JhL8G0dMCECpwef1vGY2c7ExqRTAYa2BGv-8vNQcO1TZidVPrOYqdCxdoPgBx-JQWhQd77SiyhSZ6tvI7RhZWgMIITjUEfThoPqQxMldSuAsWBI043mLtlQqQKSvUzC9_hpRWiWP6xAjKZ_rFB5Z3ZAHxKCZPahoojgqwoY9JrAi6FO3oDSkAi4R9ERXUna6MhtNAmYX19VNp381U4CTe72TFfVYfezthNZv8QYzaCwTOlw9F8R2Rk3inqeTNDRRbQvttohxuDKwX8bfx7r8n1z3KyEsH7eybJXbqq-UIKNPjVuaKQznwdv6rLin_z-fy_sI9eWfhIeOKyOASDMhIpabM-5fE_o8TDpNsetKWecddp3EtQa47maxcbTgyKtAou6uthYKiTG-Lu0TFjgsrCIJ86uUyjwAM37YzhK3tNTTBpjLGmXCjbuib3WEt7TsDlD20VqyziSr8ALXhKRJCcAo9gewd5-r7LmC-niEldnZCbR-hziaTgk6rO2dZ64t2qm-sHUKEZD2tGFInN9THcteKq__0_NBP5WEXX7RP8TArNLusZHlK8QC4-_E-vm3x0crSc8z7v4J7240wyZ9lETgeZtUgIGIqRaTS-_zvkbWYDhjJ8QWMinBm1UuDmDLw99YziZ6J7YbICOHqRuGEydaN0ZycMGGLKDu5-AzkOQY3WTOUpDKuHUdQnIkuRgHMLHGAVN-y6mK0OFCDTrd7TqfQfM0qM50FDfXBNw_FaqiZ6heQabMHb3txPcAHJvOS_BV8MgV2hvnWWXstVfzL-inBrpdVqQWh7wjR70K2fvu-z7MfSuTDmZI_nyNL5JU&cid=CAASEuRo6C1mnwgmhu1ECj8iwPE_ng&rfl=1%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

090aa1a441c5d0a8f32cddd6096f2624f223bb0ef495598ef75e205a90c258a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18821
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 24CA 42 B
63 B 39ms
38ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DwcEqiKVq5em4hjh15itQkJE9pbLu-jn5QcSy7fU11KamcJN3F89i8oxIggA4Zjko3PbUoF9_8wJ4PHZLwFUlLhVRpuaUovZjKIIkFFzZaUjdjs1g

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame 24CA 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/window_focus_fy2019.js

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:25:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:25:42 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 24CA 118 KB
36 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1618423651533291"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36717
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame 24CA 13 KB
5 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

231064110361844d6320331a5c35979c2a492a546604d97181eb6cf7aa4ae1cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:21:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5602
x-xss-protection: 0
server: cafe
etag: 7525161794280374107
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:21:49 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 421C 640 B
316 B 18ms
16ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNWUraB85muKRfKIfmqAlWbU2mVBlUqGP8U5NsOyvS-tbRHY8c-nwALek51--YWZOimZEA82AXWARAmEceQ9IRVPMBzlPYijt30HsBD6MA2iB-mi1c5zsB2WZMjdP_KXvZZLylekEY7I-DzcVMD_M5h1LUwwLT9BVjYQqPmoK-XCq_bhBGAxrdeBGlICUuiaEyBXXTGjGr2cDeH6NR20k0-tdRq9mw

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNWUraB85muKRfKIfmqAlWbU2mVBlUqGP8U5NsOyvS-tbRHY8c-nwALek51--YWZOimZEA82AXWARAmEceQ9IRVPMBzlPYijt30HsBD6MA2iB-mi1c5zsB2WZMjdP_KXvZZLylekEY7I-DzcVMD_M5h1LUwwLT9BVjYQqPmoK-XCq_bhBGAxrdeBGlICUuiaEyBXXTGjGr2cDeH6NR20k0-tdRq9mw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlEqWiQKDSlgoFzF0OSq762NKxRqbp2IlJQljiBwreE9oHaOeL6P1VzOl83UX8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 17 Apr 2021 19:26:49 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D5A1 38 KB
18 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DpQKg8m7MrcxZoFPmvX2pC66zDYW7uQyosi8dbU_1eGiMZb7yV9m4n49f4l4sE8zcajpuwVpWrBjIGCuHe-XKLjuEMiSLHn5obZGoUZUqg5jZaGiMdzX7wKS_BjXYmNgJjejaIPWz3z-YnkNjJRj4WmiiulQ&dbm_d=AKAmf-CuaoKpiOUsUq-vUYdeHeGjcmuv8q9PDdgZmJo9KC5jMQ51X8XD6tor6rMozjPPxPzxJuNYj4Mhit1GKVD02xHEY0IqipPIT0IRsHXHd9Bv8uleTTb0b0NiwI9Xmt17iOX7A3Qo1A-KL-Hd8OFlqC2RTelO0ta67CVUntNI1Sw-tBvRKj6Icdq1fm2sOU3z0CyxdEB2mXq4d1LZhRywxd7YV-oIJ8o_nm_ajwTVVrwCK8gKmt4AwPv3BC1G0_PNM2k1kTHwIJpKG7xgU9Yfo4pEpyCkevszyQvG9-dTPOEyWK6VqJLSIoKQEi22WR712Worne0RzSboOOArpyKoDqPTmXzvbwTWxgOI8tA7m4mJ9HH2AhFapazINxu53D-Vn4zKv5d70IA8fj6ZGvPbU68S7NvRU0RWIR7fVLShAfjjcTBOrEhCAF8ty7C-2mGBYGEgBnaPYAoVMAj9Bs0sNCyKM7PELMhzILgfkOkCgH-107Dj7XKKqiQKDoNY8Ipsa4bkStAKHCpi56rffuLZhJJZOSd5bNOd3Lr9TUwkxPxhneGMqVKl_2Yh2ntrI_qm07tfq_J07LyJ_Q6Sv7RCaOINyaJ5Y35qx-SWvJ73ikT_6wPdEcW6mdkxcfLrRDLDApwQCySZm7DCFWHxJBNVQHrPs7Cv-NhjfNUI6FGoVThC3a3FKt4Hsy3Ajsa2MHJhv57nuhre-MjwEZoWWoNunEmfCEoNTuP9-afmOIm5ShqpSFqNB0TRBb1wsEw2-3L_26M5aez9Ivg0ni5noy4XKQ2EgFYG064nlodlB52hPtfU7U3pOw-11yuurpyXz5cMc9EowKNfv04tJtQSTMmuxY6cJ9B1XWhOw5X63DxCitRE-MUUTUGkF-r7HAeglPsLFpg2HOFsjZOmd-2V1AiWqwDGfXEJXYifEMXzOrt3T8gVCmTV_BnJ8LN_FSnFKXwq-UaezJjiEGTYE64nafOA_G9rgqYbQb2A0rVXnqyS5QaioUtySZFQvP1qYCTjXhQRlNd6a_BklcrP85fY_CWId64oEhU67dhDvoStYiIiAOdP1DKIUDd8U6LKeH2iIISZEWXnY3lnh-NWG5pOzFrVYCTyOeLGeYyKpKDgYsfD7yySHAbGMkA18DriEVqMV8Y-Pr1WZrv7hc0fe4fXMFTSaW_g25q1R9535FLqfg_VgUkokBKObWY8UtaHlbQbcyBeHxtrYbaLpWejZVpUz2W7CXCLZRo6J07-hKgwQpsllZnP7-DILFb_YJNxsJa_7BLhFtll355TUNORwIgCOrVuIaKGyFH6OM4nh_ucBoOZ5GMYA-P6h3Z-in_4weoRe_azmHoOfMmJMIdq6X-yq9DBktgcUowcUGpxYjX9sQOfSd0rKpk_ho7v58WcMNy9xRZYOk_Ebor4u1xLI4f0SOyt05Ot4RXsWpkO6aYwOt013IwzZ-u7_5MGkPvb1xFK_q1A-EpUeA_n0qzDMuCiQikSzI9DjzRuomAcJniOl975qdzCyBdg5cpsUSthUnL8DqxqC4xo1ReUvVmvxF5ATfwamiKX33SmKR_J76y-uxmk71h6pkM_POuDrUJl2G33WNBWN0GoQnpNzg5McHjedZ0RlaPz5Ujg5JnP4i1d1sUlDxSM41j8Py4nSCJiQhUnDXK_-HKdx9T1ItprvTJqFKJH77yJ-5oPiN4MXxq4fOq6CcpC0BjJmtyj2UsiUkgAnRk_p0JHKsHax1NzexeW19S2BZebKhFUU5GWEnOOwk8IyLE5I5cNq1GHWnFJCSii0YHMajb4kUQaNnX2dseEd2hmc3tgArzfC1X7ul6l4rme08ipvwNacRKzwvrLuZ-gjeM9ee8WWR036LvzA5bCs96D3Agv1O3KlD16R33LWbBSptYuxQr2W2Ap8CckfGmzt4VmQlpriyhC4oYz8-3NeXy2fnJqaYkaJqFr4gEvY0AmGiftLCYd39wQgs5A52acUt7w1DqIBBsDLEiS-TfHQ_T9YEcWw1qIdfNj7_PFVQKr1kdSpUV7Pu8ho7mB2wcmV-xvvR5zz9LvnGSY1Cz0exw7En-kiufQyELz4zCvROvV_oMAymkyGpncqUTfLbCBmy34MwB389QNwtF3UhrzL7Is0yUBUBiPPucxKTumbzmJT2fq8xIzzO50i0DYvJLYi_QqFHblg3BtAXRauK6oBIoJUM4A9MNMkEJWTr9Y3FP6cxTeO1myM2eMhU2gD28-GqtIwxGj74EVaeyMDyOb6JK4SSs7q87Zm3sK4Swc_0j_ltJ8ni-WMB8u7rLFUJX0nwANeJE2gSWzjd_Zxu11XoTOAxUokQrq8pLdyuw62l6Jn6K8wgpVSXj06NiwSwUTKnrrbfNci0N7ofKgLrwWGgKAMWRJQzGfMujLy5FleBZhp-JSUVKoLLxxSYThWNIKeDh3FwYTTri2-xpJH3RzdpSrfpmxiVK7S4Xc1yxsdRHzvYUizpmc2a1LJld6l70_5RJYCrIAlfm2siy9KjaVVWaYQLuBFtaUZUxdBfSM-6au0HHxHc43TtATlXJQfxUyLFNFOD4SuporDzf_qUkx7GBU2Eax5VsDfwVTbNV0K7GtsIzWbqTf8woVRhraunMfAETuFAc9rfX8uCg18Enk35fh9UEjBFjWO5qS9bKjG6-DM7m6Wbryyq_3y1IYWqzja81YgwKPJEcNojvfPBJHR5PbFzOLrHR3nZJP3lJp9eXcI16P5ZX9WC3zR-JIdKNymjicRirtL-mCiejfa0TGXI8auYNXeZAHSZwBKxfOggQ0khnFFYu12DPCaHbzgjCc7loTEEE05birDgueRLmYkw2gjKu3myvPKpLXK3kt7CtWK3NZ4D6CaCXERTc4L0AETGPYSWt680mQkMWP_B0BLmG_PxQ5kHQwmCuWv9hl7bpN35yVdQ2BZLSSaV7SGtcREd-sSgeX25r9KF5rc5iCMvSpHTRDOp_vNrLoonfMtvxsYnsgl73y-xaldkcDxV0xuU1JQ__G69QW87eauLXATNozbWGn2tIP_DTam5PYWMXqYn5mhw609o2SZeug0iz9XLnVvXdv5UBg6ocmHYVSwNEQK_Nmj8-u3EkrIel7yQDBU2ELtrMoTpf1bqeJ0ZpqwE_vSZLnusJ3uDeMuqbTSe1S473IeukY4jVgK3mAdx6qC7I136faaY5ePXy6YC7MD20qtxp7vUrq&cid=CAASEuRoNroesVOy3ZIPHODcKM-J8g&rfl=2%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

798171b8ceb888e1d1d3238b97615fb257b7cd981659b2f1119f7e5545b37ed7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18662
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame D5A1 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/window_focus_fy2019.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:25:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:25:42 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D5A1 118 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1618423651533291"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36717
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame D5A1 13 KB
5 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

231064110361844d6320331a5c35979c2a492a546604d97181eb6cf7aa4ae1cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:21:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5602
x-xss-protection: 0
server: cafe
etag: 7525161794280374107
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:21:49 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame D5A1 0
0 15ms
13ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRtssHF18RmVsHOTLJUhtU2gckJ1Nf6e2fo4tVn2p10MrJvoZ2pIrGjjvTwhoB8fHmesqxo26uEjceAcTl7-uY-UPy0Tg
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D5A1 42 B
63 B 40ms
38ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AZuX2ewrKX0I7_JqqDChYk_HcucKBJM0f-yoyNuD_ICj1S1yzEHZsJww7luKhfx3UtxjPAUbXMbetyp_AEdFrPFYMBpKc6mpsCBnF7CFDBX3noYcI

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 298F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

42ms
41ms

Image
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 658E 482 B
274 B 17ms
17ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNX2dMM2SUTRANk7N3TTlDIoIEruw_CdyK7pLvloyo4tJJrVuJKBFtKv1TqBQf4zbaJxPccedw50CMBXsYFfYgCqvsSxQV8gONcFdwz7_MN5kkUHybHkRyh1FEy46_cVuRPEwW5yflDTqri_ieLPIg8v5tPFEA7vRf9C8BvvN8nc4L8vXNGEMkVeH17n9w1MPNoxRjqecqMFk55FS54TaU_IY38RXg

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7599e0a5ce1ba2a12f036e998e19e60b6e982178e4363d4630ab3a91ca73bf62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNX2dMM2SUTRANk7N3TTlDIoIEruw_CdyK7pLvloyo4tJJrVuJKBFtKv1TqBQf4zbaJxPccedw50CMBXsYFfYgCqvsSxQV8gONcFdwz7_MN5kkUHybHkRyh1FEy46_cVuRPEwW5yflDTqri_ieLPIg8v5tPFEA7vRf9C8BvvN8nc4L8vXNGEMkVeH17n9w1MPNoxRjqecqMFk55FS54TaU_IY38RXg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlEqWiQKDSlgoFzF0OSq762NKxRqbp2IlJQljiBwreE9oHaOeL6P1VzOl83UX8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 17 Apr 2021 19:26:49 GMT
server: cafe
cache-control: private
content-length: 253
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4945 38 KB
18 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CmQN0tuzWieaGuJcuKCwB2a2Da1B9ldy-70OC23ESXmNY2JxEuNU92y5vR_m1wsv-_dJfDxuOlVc8LeU5BmwS2dUQ9Nn1pDECG8ZhLprbLQNKFtRrLD4Y_s4YFpV8LJC9zRSDHM8R2Qy3Xow8zD3kiSGEXIQ&dbm_d=AKAmf-Coy8DRaVotPu1itOXZ1AZppxzBlNrEuMS6yKYuna4VUQd6XD3mWccKDZU5EcA2JuHULwb4jfWmjiiav6t9QutDyN9LowP5Qcmp0YSy8LeEbVeWpEC7Fmv9IQInAkM11xtIpuz6a6lvAq3g5_txlvvqvH32sgHt7uVQfQiN5hjocm1KyucpZgauvFdaFQTd6GdFmbFe8k-5FHTydMRg4qmKt9kTYhqS8ewiMJilVUH2Ko2PhMqnqiEDEhN0bE14JbY_b2ZuI1KwEWkYu07fkahP7Z3ZC8p8k26lhym-0LvpZvLo2yf8A8JYXsHaGG0NkhltNqzCM9PVqkE2bNE_H-wNk7RDv-fWoU_jRVASEo_qMzn-3N0ktulRTzrCb8DF__NLmvvIAqUSWrDk_jHcbbh-nfw6_Mocg7yJWUL4LIiEZR1Ljtjooc3ZESeBzKsGZq6Mx6kKr5tzxwLcMSFxPMG0QDrMuRRiZu8Lm6dGrCVssXISDz5x48uA1QR1GmWTZzU6glXf4neBMejLOVXFdjRITCUOO4iTcHTKwnRDlI_IT1IpeOIRqoXmrfZsC_Ct38MH_zbsOMfUp3hQ5323i14VXI_AbxwP3Gk6uhVrSKirV12DWhDUWU8YbDH1rqOhaBp7Y1tjWUClBHvpO1pdm7FZLiuvX0azuYedE0Tbxs68UU4j-YW4-o_UX8VP1O13Wjpu_jGdnsLfXXyipTRa_j3uAC3vF-9_mR-G_DeOHQA7qzA_L9XjrYEPx0qiyjpsvb26q8CHbkpO_LXj3-agcReQhtjajDJLuCfLlSt9vbX1IcuVyQ8xeFgDFGe8I1BjabB93kpESa6SFFk0xzSAKrx9RNJfc1nl3O0iUF-eynRjFoNLFXGkSASxxIbBgo7bLvKfij82ofqAqEOtHvM2SkNYPAknjhhhU5E2V7hlueKcr-ZZuNVygTM1cr8FphlQ3RKIQ0EccvnyOUGOHE19II9D76-yfP5nmxeGdM1YLtgYFws62f1fwwc4_7NtGN7g_hvYQuSip4tNjW2Zi99R7xd-1qJYUTF-wugGs3uDhutDgjfaEfScLKcbgMiRy-tHomfoY8NZm_W36bTuF6l6Sp0MH3oQsLAkpdRFpDt7sgtqK4PblAzOhJ1pgot6hUCukMAaGXWquCHf_rSf3MSD6xgFF06k6cb3pdXhZOLudkB1AlfsbBMYHiHRWXJBRGqMVBBHSyEMRD2Fk1tzPFxf_2xorrUFg4_bJL_Thmc_QYiGQFZVhpcp5qbTYvAYh00V4r-6hqz6JLfmRBGN5meXqliZCye_IHiO982aqDtrme0TiNL-Mi4NIe9-sBfznHs9OHnCi0eeD4AEfNsUurp9tqtTKIfAtoxr7a1aMPMkK66DJN1IIVHnllhG4eAaNK16viKgIUa5ICwCxkeSc-a25XDvZazHUNmi2Y3J5z3lrHWzLWE7HDaJJwV7l6MpM68xkeVMxcn8iNVBBAQk0v_3fkej0gxwrlhE4KH_IDX9s2Vk2H22dFB6v_D1f4JPgLOoOptDGC8DmkrgLuYMsKZh-dBWtMLPHvqSxeadPqp9tC09Okuy574cwSAfXcuGhZak-oFZK-KgqPZHZMk1qOEpU39z7khemCOsYBYa_5T56eIqJHQGqQbI_82GCK9iyP46GqzycihABVdvFsTph2pCeaREWutzzUrgKX8bjDLcEhwhC_ou9vtUEuZ7OFDiz3IXNvcpJhiS6hw8BVdlHoiNiPFPJBJb2kk2ggKXk_pNC6riEIpioOoYHcXUK0c1i6j1kbYrze8ph7zPDGO1t4-jFc2OeOrEzcMdchf32x6TS270UL_EfrZpu8BQlxOoyr0_gy8z17Z3MRrTLSuwX9dL-R2N-yQGi6pXZkUTeeYoO0spOMrq721krOhhQ54eEZPdSZc0Z376FhSNpOZaMFOEETDi5tSSa4c7CGEefsFGvunkLzGoFFauFHfAoU77_4gsihnq4eKVrpHG2Ee8l8zzAnQZqtLXbVJv10HmLugLEq7qKDTSge2Ot2uNMkbfGMcPA50Ey5N5m0uy1r7DqioRclwupwEPNBY0IdcCeOcJ5XkzWHxKly9Q5L2uMkJw-pcGPYgOfCIQ0vEGlTUbRUkL9VmoCBWUnbWSTyjC6HGM50-J3RIAspNHAQUsjxzyVub3W08hFs-wovCkV4Wim8obKlY6_wlsm6MhB4uD9_6XQxxtf3eHiZqei96DctUFUPDX47CP6c0o74QKNElKcXukWvOmRXd6kx4OtJXt9kPFA-OTk5Z3uT2jngp-Xfrjn0WCxZcdXizQNPRe4mfcRKjamh7ri2vpsdiDnfSc3gwzSlwePAIsoAOhSz-ZHHzOqspZpGuNHxYzGCXxUcFE3DjSXnBz1yxcwGDErqG25aRkQMLvyAm7DUkV9zMooRtx-IhX0tcHemgPkIbWam5DuGA_CGk0KH3SsKPVAOzApG8GIFs9-jCLSdcsdJFLEBcJeB1rUKB8fhUIgHmbcxQuU2JSyShXi2Frnc1TgoYQlwvU_91aqpun68XBIG8ThJbryFfo7p5L_nKWfcksfL6trc0m5LIt4IkAn5lbhA6wzLXCtRPeMoMSLGDwBjAgy2-h2jNsRgQr6CdH1m60erZ0cawdaiEUJY7xqX7IsyH2PIjmvzfF_XV57zVnt-F4-INKDVVqML-OLmTBLLmXGkoQdkKSwMUWm0NBf8K_qGpOE8BFvWLqK3Byt2MD1pks_A3q873L1flTUYMFNnN-bPCOj3dtRt8ph4cuyzjA5hIWFIW6ETI9Bv5mfHpgrB8tMtVISBvAqHOxPA-f6vMSpTeBeO4bBlSTqf-ugYTY7qo4MYf4vx2WAQz1y3BBJxbTqjRjpVoSZ4YlBGsSk0OPh2RyHC_415lqL-_SXwXy-DO0NvEE-0OliBSyHzbrXXci_X-CFfQxsjTOZX1ymh_QpfltF-7u1N40qmQjrE3O0N10l2Gq9G40QtHYHevYi5oAkQxPqt66tl6uHagjvixf0swJyuiRQLzcTXxOuoHWUQSY1kbUN-I-TY7cNeS4K4KDPdfaFcs1ioIs0HU9PE7OJWzHj4CeqeDNH8Fnu3Ykmv9-lPgYH5KcQxWhHKejqa9y4pmTINRWQIpUPEAcBn75CSRXk8HDwj2eO5HRjKMZOLC-Qj41gQI17XQ4e5gdqZ-rM34a-jrJqpno55CJ&cid=CAASEuRoqC6Z1iOCGPaKU2a4D29_6Q&rfl=2%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aadcecc199f6c06fc8c727313c974924c5883da2c246910bd465bb6bec9153f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18769
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame 4945 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/window_focus_fy2019.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:25:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:25:42 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4945 118 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1618423651533291"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36717
x-xss-protection: 0
expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame 4945 13 KB
5 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

231064110361844d6320331a5c35979c2a492a546604d97181eb6cf7aa4ae1cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:21:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5602
x-xss-protection: 0
server: cafe
etag: 7525161794280374107
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:21:49 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4945 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Axh2mCCrLzU5EnbDWOycmB0_3o8OiIb4SMYmP4sQK16pYi1ktaRzEpnBGtcQXVVvczOfRDQnuV-ZqofYnBVtj0TcV7IgYwKc8PlEYxMjWZ1m-_w5o

Requested by

Host: windows-setup-remediations-x64-kb4023057.updatestar.com
URL: https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/ Frame 5A80 17 KB
7 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/abg_lite_fy2019.js

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76d293cad87de584b5105472b9672fb1460dcf35f82079e274e44a47860bf700

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:25:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7113
x-xss-protection: 0
server: cafe
etag: 11066897925667386271
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:25:00 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 5A80 8 KB
713 B 20ms
19ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

398b4849b670aa5659a8fe1d8a925591d3c581176db6313a9ef7208d77310ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 17 Apr 2021 18:14:41 GMT
server: ESF
date: Sat, 17 Apr 2021 19:26:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/ Frame 5A80 14 KB
3 KB 30ms
7ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/outstream.min.css

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 21:11:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252948
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Wed, 14 Apr 2021 19:29:16 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 14 Apr 2022 21:11:01 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/ Frame 5A80 353 KB
123 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/outstream.min.js

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d538b0d8a37f89edf8ca7adb41c50ee0339b7852cc46fd2c5f8900907cb6e218

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 21:11:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252948
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125399
x-xss-protection: 0
last-modified: Wed, 14 Apr 2021 19:29:16 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 14 Apr 2022 21:11:01 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame 5A80 13 KB
5 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

231064110361844d6320331a5c35979c2a492a546604d97181eb6cf7aa4ae1cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:21:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5602
x-xss-protection: 0
server: cafe
etag: 7525161794280374107
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:21:49 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 5A80 0
0 19ms
18ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRIzs07HDLvaU8jbQzHnGtLpUgnyv62Y_Jt-J-r0ACH8UEotKk8eaDENrkxuFa3t9vLi07oHf-m9EaTaeondFVHr5j0sg
Requested by: Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/ Frame 24CA 21 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BnWAxhWefQ8Ox-jjlgZDFx9y5PPIvvzeOjv5548UV8oPynToV1JkSt-_XoAJQUibcmJPGKdQjHljw4WmaGLM-hQQOvuanEAs8ETRvDDzU8obP9SGSfseQvZlSxt4UcflKWxU4Yubq6MkcX9fVSdJOWDB0vZA&dbm_d=AKAmf-CgEvGtRENVoHNna8Zq8XCtAJqfok-cZeMH8vxOvn9mekz1bm_2IXXbsacmtptExU6XYrb36jRRW1j9AtpTU8HJk8TcWzvBtiAyR1T87P9AjHP-414UVC4B0qoaKMZnms0Dvc77E2K84wgsMBGIsYMQZxr6YloLzIU6FkrhCXhuUIYEwzaZjU9TSobqYjoJi-qnzlBZcJTTuSo-zkTDIcje1U3gZ8exxxP97at5ly7Iyw6yQtUAgbNwVycBG2sr4g8b1VxN2yQrgZmL6PMT8creOpP9A3BytTIVGOT5IdNbZZAA-yn8fhal8T3Zap6iRXvlCmhr8Mna3fjMYZUN8MqQDftd3NXXlV9_C-Lljl7_iLPZBpopDnNR8FKurq9gQe7Ninu5dlr0V2YSpp1X1a4zlZP1rw8v2isF7nk6geG09Qsc751DAGGqZHur0feXkCAKjDkbPUUdyfOKb321XkTgYJdPA47DZWgZiDw1t55X1vHzj2m6cSivuQl3OrWipF57K-EdMXjGLl3SYZD06Jy7OpYxLkbdQAP-4K90t6qWKFZFO2Rorzjmf5PKQ3GGFJOaUSL9XX8Dt7d57xCU6PqYjF-S-ESOK5pBcEdj5vDEZgBaAha0MvY8GfB9nZIfK9L0IQ4Gi-_Y10R3KpaVGMH95vL3ZViAwzC_72N56KSOFVx1b_HerIDN38isLcFdZJXaMDhezoZJEtj1UlwZbf57C4lPyqIYhyv6hSbAWHtzPSitvrFEGsYbhvZnZvS2CTXJIsN1eqye1hGbyUcYLouW0NOPtkTJDRmUCr9B3O_kY79AuGVJ1_viQKp5qGOAlRK4YEbXvTAEucOkDRMWPBoCQ_MyVQVhBHVu_nYogfgM0BnbhuoNvaZvrzsE8RQH35HSO2dvNckLcjinigoZEEzi2LKImIweP50B5fPVQyvqxuZV21PQiXT5aAK4trXWZ5lI-obh1oYeRSvbyi0MifhLRNNbclvoznVlf1dUl29AE7Y-63w_sKe8kA0AUSS00ixdFhKYHTwvNzx7krei0sW12k1sYaX8WyhxZc4w9SNGu5SceMI02QLdsU7xmuSOZhVQa4XxcM-4xmL54SfoYQGZ8XzDa_ky244heqZfHCviNJH56kI4gA2c1V_5Djq2N9w44wF9Q8IMW0IxgO-460wt2rhqn36bM3Ib6vqdeHuIHxJtDfg0gDKR-ohVx1IYfnFCUZsRm5n0XN-YD-fr2lA32Tb1yY4YVTxlohk3K9GOt5YDs_60G6sBfED353Zom-YLU1yLVryucaYRvksydcM2Fin-I-CJBtjL_jnyF6J7TFnrZ7sOgeu4C6s9Y5oZHwinIpGxDe9J0xO1jtB2NpCyPH5anMrdAnRbLDURykq2-nN-fpqfBm2w0L1G8xn4dfHRug4ZOwJQQAI2ePEKSkD97o_OdFf3ILzzc88HJk2IwK_xsSPF3TgVIwe79Ruvs7R7MNzqBaFUueeiIXfbmknQmH7uzTxtkpbe8QAZyVHGsjnOd2ntq2CekCyG4POguwQVmllzPIn4jwzkeVszxjymJroQMFK3ey8osx8i-k-7o83ZjfJFBVmHfXqb60BWW7YbgQzfTAakH8DKQbJlU2zIQVUkx09P3sBWK8W-S-zzjm_dK3DuLFt-HJ7_TUO_yLg2YKHcaEWSQUfo4cvXPmFzfCDSp2ZD02Iq2uhJMf5iyQRGJns746kQXcxlQZNQQZYJpgXH6yFkHjdSw0ey9W_VAmJGfKiISFvPOcA5sUOvNRzMp55EoxRXIsP6mJgciLzDzbwzafXsaeaAqFW8VPo1ePBnviAH_cUTRoXw56R2bpF3BBmd97uU-Vf_WZb3g5_vN2AiTMoLCcQf8BVTEp7Gk66Y2fyjS1VItIyHLjCwBxcUXfLsLu8V8rxS7DzZ_MeYnOofNQ5IBXjYkaDYyZ0SpLpU7crPuQ10DmlLGsxv2BsOCF_N7iU2QGXPbHJy1h6xKTZ9vNBJ1IyK8Hr6mwJudTy1vHv32gjjKfAIOvtwC0RtmP4sPJbvFpo65cOkYPi8TKJQaSoeZsqe6DjH-1iR8rnK-99jcbbiHLLODJrpsbfLRoZRkuUVUiY24-L4fVJisCzkcwAkHlscEULohCnZE1LX6mb9WMrx-YzklcXdNkjUdhzDYnYFQYgRDZsILYof63kuJAj0d7lEpFJCwAudacQcENdtlDLRgAmgW83sW0CclSWoh0ct3kTnrLMpP8m7nYylp29_29uSXHT_f5c_VO8Jzys8gFi-eKcQ2ouCz0I_HcMbAlkKsqNv6Y3x65u6welTjb_Dj9KLn8NuGxxjqgIVivp2TP0p_YAtuBo0uWcwCm1JhL8G0dMCECpwef1vGY2c7ExqRTAYa2BGv-8vNQcO1TZidVPrOYqdCxdoPgBx-JQWhQd77SiyhSZ6tvI7RhZWgMIITjUEfThoPqQxMldSuAsWBI043mLtlQqQKSvUzC9_hpRWiWP6xAjKZ_rFB5Z3ZAHxKCZPahoojgqwoY9JrAi6FO3oDSkAi4R9ERXUna6MhtNAmYX19VNp381U4CTe72TFfVYfezthNZv8QYzaCwTOlw9F8R2Rk3inqeTNDRRbQvttohxuDKwX8bfx7r8n1z3KyEsH7eybJXbqq-UIKNPjVuaKQznwdv6rLin_z-fy_sI9eWfhIeOKyOASDMhIpabM-5fE_o8TDpNsetKWecddp3EtQa47maxcbTgyKtAou6uthYKiTG-Lu0TFjgsrCIJ86uUyjwAM37YzhK3tNTTBpjLGmXCjbuib3WEt7TsDlD20VqyziSr8ALXhKRJCcAo9gewd5-r7LmC-niEldnZCbR-hziaTgk6rO2dZ64t2qm-sHUKEZD2tGFInN9THcteKq__0_NBP5WEXX7RP8TArNLusZHlK8QC4-_E-vm3x0crSc8z7v4J7240wyZ9lETgeZtUgIGIqRaTS-_zvkbWYDhjJ8QWMinBm1UuDmDLw99YziZ6J7YbICOHqRuGEydaN0ZycMGGLKDu5-AzkOQY3WTOUpDKuHUdQnIkuRgHMLHGAVN-y6mK0OFCDTrd7TqfQfM0qM50FDfXBNw_FaqiZ6heQabMHb3txPcAHJvOS_BV8MgV2hvnWWXstVfzL-inBrpdVqQWh7wjR70K2fvu-z7MfSuTDmZI_nyNL5JU&cid=CAASEuRo6C1mnwgmhu1ECj8iwPE_ng&rfl=1%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d04fe3e6d57be524334f1688f690be20fb65e09d806c549e1f78aa8d3f7dbae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8468
x-xss-protection: 0
server: cafe
etag: 17868783254023373946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:26:20 GMT

GET
H2 200 enEU-EU-WoW-Modern-ShadowlandsLaunch-LAUNCH-BusstopRevendreth-BUYNOW-STD-160x600-0.jpg
s0.2mdn.net/10176009/ Frame 24CA 33 KB
33 KB 29ms
7ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10176009/enEU-EU-WoW-Modern-ShadowlandsLaunch-LAUNCH-BusstopRevendreth-BUYNOW-STD-160x600-0.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30bed512ee77840bcbb79d3f1b3c4b56931d84f4d0446c12b5175a4e016a75d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 08:23:59 GMT
x-content-type-options: nosniff
last-modified: Fri, 20 Nov 2020 21:12:50 GMT
server: sffe
age: 39770
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33681
x-xss-protection: 0
expires: Sun, 18 Apr 2021 08:23:59 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/elements/html/ Frame 24CA 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:22:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:22:04 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 24CA 0
61 B 192ms
82ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstjieOY-ELOtohTMnsegZlZ9l1PFB2GSaSU2XngzBBwPubQpumfumRpy4F1Q7hbkF4r_rnL6UtJI7h9goBQmHfoGpSG2C9pdvd2ipusjwDFouFLF4-w8_1J623HYPa7NgmX3cf8j4DOdkp9ZCW7lu9Il_UCGozJEQu7m-5-zLw-5TQh_De5kn5QlCqEGCRFw8gWP2MneMy2GeVuKeG8pIiRZ--HTL6BsGx26lYV8wNzPG6Ew1RiSzI6Ww3UIoRbYPnhGkU59MK05xLJviDEifermcZQmvTYyb_uE1LxDMs0hAVwS8N1y0DsISIHchWRvM9cOagyY5zu0fY7QBf6ZxKZPCHw3U7AJE6CvEg9umpd_AFIYosvgo6PM8ravaebLOY5qV4Vju6aLiFhA-dfsaZcK7QMk3vqsYf4sTkFOnpqOfs3xCaQDlXv_5G16_e2xHMJxbTDqiPqCvvY4FIMjj-3GieOXPiM_Ktivy-Llve23em_p7LC9Ook3qhsA4ln5xn2WagHh24cW5n2gzc-0dve5y7Rwm1VBMn83-qkoGi3Rw-FmqlcQFU7zUdo1QdqlyrvSw0jXH1_jgKEsZ8TW4zBA7JkLrQTBPjgb4K4DpRbOlpHewNKqgeRzjiHnnaEQap2dEh4q_k1L-GmvGQsX7-DuZQA3O6uZbSutK3m7r3498DBcUnmvx4Ib6yRf-4Dq13IWjjY80uG9ebOpvn1Tq4cUhNIb16dIXWipNlPqb348j9Mp3CfnI-SfrDhgXN5ZXFuniOOIy8hOCdpYtNz3NcEuP9k3ISmZu3LyyrM0Gc7x-dPGheVISh-yjek-8mXyHr-V1S7ZDQQi6OswUvTQIbi6ajckpN1nPpgCG2vei0he3pJ2jnNNpuz9Xp_fpJI3whJQzYCfSbg-6JS8zckhUdOnvHqDms64m6yYTeAxwtIjtKfpoU3HXTc5YnezLaQO9JsEDbik61r3iluS-Dh0MOXKkEx9cfHhFWAgK69NiO0-5x9-WIUOeIA-SJYc7x2iEGHKg0wZAAvfMeULtlFqlfA_xRyvhd7m-x_5Pip-fc5V8zUgiWlLkpe691SFGV1iQKzfgWh20wLsGBOs8KoRtsIMidNW33hA24ajBBkuamOtYNK8FCaU9Q1OZSAvG2LIsz6095Kai-Mcn-MI5qPKEHYgwNJIma8xSBnzHMuyrZ6RKeucTx_dat7oJTDCx4frrfEOBTSoOIUoNNdgQ0-7Oj_keWxdFmNlfqSEJr0Ws8AN3wIHfJ5XeFuA-D_EK6TM76KTXmKWKhY2VB0wgW5pp2O99iO3WuiywgPH2Lr22UomI9uuXXCxdIZfWk67Pje&sai=AMfl-YScYXO7skUa5puYZKM4znVtmntyMZ0nQugmXr6-oTfoyrdr0XOwBef2UZCBe2nHnnFILZvnRJre8Lt3AhFApPpfd7VT41OjC0OkwGoBdx4EVD9ADtsae4q6WZgSIz297P6MjbWhf35CqWRpyPP9FJ2FcA4xiQ&sig=Cg0ArKJSzOA2oyKDJXutEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210414.52453&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 17 Apr 2021 19:26:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 24CA 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 15:05:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15667
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Apr 2022 15:05:42 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/ Frame D5A1 21 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DpQKg8m7MrcxZoFPmvX2pC66zDYW7uQyosi8dbU_1eGiMZb7yV9m4n49f4l4sE8zcajpuwVpWrBjIGCuHe-XKLjuEMiSLHn5obZGoUZUqg5jZaGiMdzX7wKS_BjXYmNgJjejaIPWz3z-YnkNjJRj4WmiiulQ&dbm_d=AKAmf-CuaoKpiOUsUq-vUYdeHeGjcmuv8q9PDdgZmJo9KC5jMQ51X8XD6tor6rMozjPPxPzxJuNYj4Mhit1GKVD02xHEY0IqipPIT0IRsHXHd9Bv8uleTTb0b0NiwI9Xmt17iOX7A3Qo1A-KL-Hd8OFlqC2RTelO0ta67CVUntNI1Sw-tBvRKj6Icdq1fm2sOU3z0CyxdEB2mXq4d1LZhRywxd7YV-oIJ8o_nm_ajwTVVrwCK8gKmt4AwPv3BC1G0_PNM2k1kTHwIJpKG7xgU9Yfo4pEpyCkevszyQvG9-dTPOEyWK6VqJLSIoKQEi22WR712Worne0RzSboOOArpyKoDqPTmXzvbwTWxgOI8tA7m4mJ9HH2AhFapazINxu53D-Vn4zKv5d70IA8fj6ZGvPbU68S7NvRU0RWIR7fVLShAfjjcTBOrEhCAF8ty7C-2mGBYGEgBnaPYAoVMAj9Bs0sNCyKM7PELMhzILgfkOkCgH-107Dj7XKKqiQKDoNY8Ipsa4bkStAKHCpi56rffuLZhJJZOSd5bNOd3Lr9TUwkxPxhneGMqVKl_2Yh2ntrI_qm07tfq_J07LyJ_Q6Sv7RCaOINyaJ5Y35qx-SWvJ73ikT_6wPdEcW6mdkxcfLrRDLDApwQCySZm7DCFWHxJBNVQHrPs7Cv-NhjfNUI6FGoVThC3a3FKt4Hsy3Ajsa2MHJhv57nuhre-MjwEZoWWoNunEmfCEoNTuP9-afmOIm5ShqpSFqNB0TRBb1wsEw2-3L_26M5aez9Ivg0ni5noy4XKQ2EgFYG064nlodlB52hPtfU7U3pOw-11yuurpyXz5cMc9EowKNfv04tJtQSTMmuxY6cJ9B1XWhOw5X63DxCitRE-MUUTUGkF-r7HAeglPsLFpg2HOFsjZOmd-2V1AiWqwDGfXEJXYifEMXzOrt3T8gVCmTV_BnJ8LN_FSnFKXwq-UaezJjiEGTYE64nafOA_G9rgqYbQb2A0rVXnqyS5QaioUtySZFQvP1qYCTjXhQRlNd6a_BklcrP85fY_CWId64oEhU67dhDvoStYiIiAOdP1DKIUDd8U6LKeH2iIISZEWXnY3lnh-NWG5pOzFrVYCTyOeLGeYyKpKDgYsfD7yySHAbGMkA18DriEVqMV8Y-Pr1WZrv7hc0fe4fXMFTSaW_g25q1R9535FLqfg_VgUkokBKObWY8UtaHlbQbcyBeHxtrYbaLpWejZVpUz2W7CXCLZRo6J07-hKgwQpsllZnP7-DILFb_YJNxsJa_7BLhFtll355TUNORwIgCOrVuIaKGyFH6OM4nh_ucBoOZ5GMYA-P6h3Z-in_4weoRe_azmHoOfMmJMIdq6X-yq9DBktgcUowcUGpxYjX9sQOfSd0rKpk_ho7v58WcMNy9xRZYOk_Ebor4u1xLI4f0SOyt05Ot4RXsWpkO6aYwOt013IwzZ-u7_5MGkPvb1xFK_q1A-EpUeA_n0qzDMuCiQikSzI9DjzRuomAcJniOl975qdzCyBdg5cpsUSthUnL8DqxqC4xo1ReUvVmvxF5ATfwamiKX33SmKR_J76y-uxmk71h6pkM_POuDrUJl2G33WNBWN0GoQnpNzg5McHjedZ0RlaPz5Ujg5JnP4i1d1sUlDxSM41j8Py4nSCJiQhUnDXK_-HKdx9T1ItprvTJqFKJH77yJ-5oPiN4MXxq4fOq6CcpC0BjJmtyj2UsiUkgAnRk_p0JHKsHax1NzexeW19S2BZebKhFUU5GWEnOOwk8IyLE5I5cNq1GHWnFJCSii0YHMajb4kUQaNnX2dseEd2hmc3tgArzfC1X7ul6l4rme08ipvwNacRKzwvrLuZ-gjeM9ee8WWR036LvzA5bCs96D3Agv1O3KlD16R33LWbBSptYuxQr2W2Ap8CckfGmzt4VmQlpriyhC4oYz8-3NeXy2fnJqaYkaJqFr4gEvY0AmGiftLCYd39wQgs5A52acUt7w1DqIBBsDLEiS-TfHQ_T9YEcWw1qIdfNj7_PFVQKr1kdSpUV7Pu8ho7mB2wcmV-xvvR5zz9LvnGSY1Cz0exw7En-kiufQyELz4zCvROvV_oMAymkyGpncqUTfLbCBmy34MwB389QNwtF3UhrzL7Is0yUBUBiPPucxKTumbzmJT2fq8xIzzO50i0DYvJLYi_QqFHblg3BtAXRauK6oBIoJUM4A9MNMkEJWTr9Y3FP6cxTeO1myM2eMhU2gD28-GqtIwxGj74EVaeyMDyOb6JK4SSs7q87Zm3sK4Swc_0j_ltJ8ni-WMB8u7rLFUJX0nwANeJE2gSWzjd_Zxu11XoTOAxUokQrq8pLdyuw62l6Jn6K8wgpVSXj06NiwSwUTKnrrbfNci0N7ofKgLrwWGgKAMWRJQzGfMujLy5FleBZhp-JSUVKoLLxxSYThWNIKeDh3FwYTTri2-xpJH3RzdpSrfpmxiVK7S4Xc1yxsdRHzvYUizpmc2a1LJld6l70_5RJYCrIAlfm2siy9KjaVVWaYQLuBFtaUZUxdBfSM-6au0HHxHc43TtATlXJQfxUyLFNFOD4SuporDzf_qUkx7GBU2Eax5VsDfwVTbNV0K7GtsIzWbqTf8woVRhraunMfAETuFAc9rfX8uCg18Enk35fh9UEjBFjWO5qS9bKjG6-DM7m6Wbryyq_3y1IYWqzja81YgwKPJEcNojvfPBJHR5PbFzOLrHR3nZJP3lJp9eXcI16P5ZX9WC3zR-JIdKNymjicRirtL-mCiejfa0TGXI8auYNXeZAHSZwBKxfOggQ0khnFFYu12DPCaHbzgjCc7loTEEE05birDgueRLmYkw2gjKu3myvPKpLXK3kt7CtWK3NZ4D6CaCXERTc4L0AETGPYSWt680mQkMWP_B0BLmG_PxQ5kHQwmCuWv9hl7bpN35yVdQ2BZLSSaV7SGtcREd-sSgeX25r9KF5rc5iCMvSpHTRDOp_vNrLoonfMtvxsYnsgl73y-xaldkcDxV0xuU1JQ__G69QW87eauLXATNozbWGn2tIP_DTam5PYWMXqYn5mhw609o2SZeug0iz9XLnVvXdv5UBg6ocmHYVSwNEQK_Nmj8-u3EkrIel7yQDBU2ELtrMoTpf1bqeJ0ZpqwE_vSZLnusJ3uDeMuqbTSe1S473IeukY4jVgK3mAdx6qC7I136faaY5ePXy6YC7MD20qtxp7vUrq&cid=CAASEuRoNroesVOy3ZIPHODcKM-J8g&rfl=2%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d04fe3e6d57be524334f1688f690be20fb65e09d806c549e1f78aa8d3f7dbae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8468
x-xss-protection: 0
server: cafe
etag: 17868783254023373946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:26:20 GMT

GET
H2 200 enEU-EU-WoW-Modern-ShadowlandsLaunch-LAUNCH-BusstopArdenweald-BUYNOW-STD-300x250-0.jpg
s0.2mdn.net/10176009/ Frame D5A1 61 KB
61 KB 16ms
14ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10176009/enEU-EU-WoW-Modern-ShadowlandsLaunch-LAUNCH-BusstopArdenweald-BUYNOW-STD-300x250-0.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf89e3b0bbe8bc280b453823d44c9754dfd495fe7c03064938eda5d00c79012d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 10:00:54 GMT
x-content-type-options: nosniff
last-modified: Fri, 20 Nov 2020 21:09:56 GMT
server: sffe
age: 33955
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62666
x-xss-protection: 0
expires: Sun, 18 Apr 2021 10:00:54 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/elements/html/ Frame D5A1 8 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:22:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:22:04 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D5A1 0
107 B 170ms
80ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssKIbcuaU7TvS9n7jQyeeorQarGG-iIehT-J-vATASpbEj8m9pOoq0XAT4POrBEM6GAZqHJvlb0GFCyrin3Bb4UHRr1Rq_FyRHEgW1rLeQnUYtHfuPdmPXNRUvwirBacWQXnk-sqBNGTMSqVMEVtSDzX4ASu-ECWOR2WC5FGyLLW5mt-bmoBbViyjTb49HIKyoEViL-NN1IYhDmejqKFuCTiMYzlcQyHZNvYD4dKs_EIqyuUEiU-HtlhXlnVXs3FxjJvwkpf2lwYgzNi93Es401NWXXaacTuO8D6G3T7nLKQ7VBs7GUtBod4azP4lF8GqTtziLqvL5kmtsOPQZxWv2FC3H7E72hDdm6Ku6XbuVcdBTJ5ua2bSzTU1ZSXEtniYAZNzPFWmcZgEJG6ITVnPr4909dlzhx8z732YB6NZuwV7RnXUts7HNwFPYIErRvzkoQN26sRDFJZjyHRJMyUpBxCnX4UQAW8YE2MFcJjXmzmZSLGmU6UFHwMeM7biL7UgPGwWAAWGusQq_rO_epquIYGk4Chb9YcSCQwP1_uwFRQdZCJHLxb_eulwapSo_LCE7K_r7Uro92FH9HCo2H3q65-wuxhdPlVGCeBgIoS4fhxex-80e3ulC7gJP1iNylFr3rcR7ZqiSwnZcPSescdjgO72uhpOk3D_StkofpnnMMyYfy4_pQwoYHVUTkXFqeRdSNCUCZp67LJEEnsHp3nzbu6RqEUZRkQDxH86CGkzNUYooljpUjYjE2YtRANlD_8XQ6hnZDGarMtpmWKhgDfGYv1bBAGrTqcG_cO9SG0aHKNpAURK4mgfV-AvRA0ZEeqB3Euembh1T5Yor7G5u7ZPWJ_hZOQK4LVXQz-DVaetM30Vf7J8AKNlVP2PEAvZ-7Dg_iZLXKbFm80qOipTjixeJ5hPYg0J5jLRROhrCWgp_80jrQcsv9MYq2clqTwr94TIwG0vzrdw_yUfsXKICuhruLianUIGUiUh8oT7CsAxLARZokRdwaZmsNSUFiuiu3d7LkJ2lOTnAz5rMWz1tjXV8QQOCv2Ng80iqS-hJ7pzhaYc1oTAO1hb1iZQQX65FVOFVfkARoSC9bCiAppLQIUtjUv7KZGdaxPCCfxjVcZgXsYoZOHIg2HDT2pHPizHn3HLgjftJXZbsEyFcEppVgHXUf3gWMkl7bM4WraZ7sDaOtch29V0OoUZBiZVvA5mk9ouFsS-64eHFgYE2vAZZDFyLfvDpSZiDCD3_zDylkSbHhsw0jEqG-4TB5VOdhl5qG1yeeiinXlW1vsoYHi2pRH8_892y_soyfrx6_9YcJF8eBCpTloyYrD2B785M3UajLxkXBfA&sai=AMfl-YSxP5EyBcqT5wzZ4Utb5-FodxekiVre_rFJQWUIDsD9eFzgg_9fdtj6SIdxs6zOsaw9Y7y0jw0ICbEEiycwXHNgp_wVAkgNZ-hOCcxHIUmxWjNRoyAOxBKfOyaGCcuePvCUv6zd-ORk-46Z6bfj-6yCL2djrA&sig=Cg0ArKJSzLm44ScjsuddEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210414.40244&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 17 Apr 2021 19:26:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D5A1 41 KB
15 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 15:05:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15667
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Apr 2022 15:05:42 GMT

GET
H3-29 200 enEU-EU-WoW-Modern-ShadowlandsLaunch-LAUNCH-BusstopArdenweald-BUYNOW-STD-300x250-0.jpg
s0.2mdn.net/10176009/ Frame 4945 61 KB
61 KB 22ms
7ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10176009/enEU-EU-WoW-Modern-ShadowlandsLaunch-LAUNCH-BusstopArdenweald-BUYNOW-STD-300x250-0.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CmQN0tuzWieaGuJcuKCwB2a2Da1B9ldy-70OC23ESXmNY2JxEuNU92y5vR_m1wsv-_dJfDxuOlVc8LeU5BmwS2dUQ9Nn1pDECG8ZhLprbLQNKFtRrLD4Y_s4YFpV8LJC9zRSDHM8R2Qy3Xow8zD3kiSGEXIQ&dbm_d=AKAmf-Coy8DRaVotPu1itOXZ1AZppxzBlNrEuMS6yKYuna4VUQd6XD3mWccKDZU5EcA2JuHULwb4jfWmjiiav6t9QutDyN9LowP5Qcmp0YSy8LeEbVeWpEC7Fmv9IQInAkM11xtIpuz6a6lvAq3g5_txlvvqvH32sgHt7uVQfQiN5hjocm1KyucpZgauvFdaFQTd6GdFmbFe8k-5FHTydMRg4qmKt9kTYhqS8ewiMJilVUH2Ko2PhMqnqiEDEhN0bE14JbY_b2ZuI1KwEWkYu07fkahP7Z3ZC8p8k26lhym-0LvpZvLo2yf8A8JYXsHaGG0NkhltNqzCM9PVqkE2bNE_H-wNk7RDv-fWoU_jRVASEo_qMzn-3N0ktulRTzrCb8DF__NLmvvIAqUSWrDk_jHcbbh-nfw6_Mocg7yJWUL4LIiEZR1Ljtjooc3ZESeBzKsGZq6Mx6kKr5tzxwLcMSFxPMG0QDrMuRRiZu8Lm6dGrCVssXISDz5x48uA1QR1GmWTZzU6glXf4neBMejLOVXFdjRITCUOO4iTcHTKwnRDlI_IT1IpeOIRqoXmrfZsC_Ct38MH_zbsOMfUp3hQ5323i14VXI_AbxwP3Gk6uhVrSKirV12DWhDUWU8YbDH1rqOhaBp7Y1tjWUClBHvpO1pdm7FZLiuvX0azuYedE0Tbxs68UU4j-YW4-o_UX8VP1O13Wjpu_jGdnsLfXXyipTRa_j3uAC3vF-9_mR-G_DeOHQA7qzA_L9XjrYEPx0qiyjpsvb26q8CHbkpO_LXj3-agcReQhtjajDJLuCfLlSt9vbX1IcuVyQ8xeFgDFGe8I1BjabB93kpESa6SFFk0xzSAKrx9RNJfc1nl3O0iUF-eynRjFoNLFXGkSASxxIbBgo7bLvKfij82ofqAqEOtHvM2SkNYPAknjhhhU5E2V7hlueKcr-ZZuNVygTM1cr8FphlQ3RKIQ0EccvnyOUGOHE19II9D76-yfP5nmxeGdM1YLtgYFws62f1fwwc4_7NtGN7g_hvYQuSip4tNjW2Zi99R7xd-1qJYUTF-wugGs3uDhutDgjfaEfScLKcbgMiRy-tHomfoY8NZm_W36bTuF6l6Sp0MH3oQsLAkpdRFpDt7sgtqK4PblAzOhJ1pgot6hUCukMAaGXWquCHf_rSf3MSD6xgFF06k6cb3pdXhZOLudkB1AlfsbBMYHiHRWXJBRGqMVBBHSyEMRD2Fk1tzPFxf_2xorrUFg4_bJL_Thmc_QYiGQFZVhpcp5qbTYvAYh00V4r-6hqz6JLfmRBGN5meXqliZCye_IHiO982aqDtrme0TiNL-Mi4NIe9-sBfznHs9OHnCi0eeD4AEfNsUurp9tqtTKIfAtoxr7a1aMPMkK66DJN1IIVHnllhG4eAaNK16viKgIUa5ICwCxkeSc-a25XDvZazHUNmi2Y3J5z3lrHWzLWE7HDaJJwV7l6MpM68xkeVMxcn8iNVBBAQk0v_3fkej0gxwrlhE4KH_IDX9s2Vk2H22dFB6v_D1f4JPgLOoOptDGC8DmkrgLuYMsKZh-dBWtMLPHvqSxeadPqp9tC09Okuy574cwSAfXcuGhZak-oFZK-KgqPZHZMk1qOEpU39z7khemCOsYBYa_5T56eIqJHQGqQbI_82GCK9iyP46GqzycihABVdvFsTph2pCeaREWutzzUrgKX8bjDLcEhwhC_ou9vtUEuZ7OFDiz3IXNvcpJhiS6hw8BVdlHoiNiPFPJBJb2kk2ggKXk_pNC6riEIpioOoYHcXUK0c1i6j1kbYrze8ph7zPDGO1t4-jFc2OeOrEzcMdchf32x6TS270UL_EfrZpu8BQlxOoyr0_gy8z17Z3MRrTLSuwX9dL-R2N-yQGi6pXZkUTeeYoO0spOMrq721krOhhQ54eEZPdSZc0Z376FhSNpOZaMFOEETDi5tSSa4c7CGEefsFGvunkLzGoFFauFHfAoU77_4gsihnq4eKVrpHG2Ee8l8zzAnQZqtLXbVJv10HmLugLEq7qKDTSge2Ot2uNMkbfGMcPA50Ey5N5m0uy1r7DqioRclwupwEPNBY0IdcCeOcJ5XkzWHxKly9Q5L2uMkJw-pcGPYgOfCIQ0vEGlTUbRUkL9VmoCBWUnbWSTyjC6HGM50-J3RIAspNHAQUsjxzyVub3W08hFs-wovCkV4Wim8obKlY6_wlsm6MhB4uD9_6XQxxtf3eHiZqei96DctUFUPDX47CP6c0o74QKNElKcXukWvOmRXd6kx4OtJXt9kPFA-OTk5Z3uT2jngp-Xfrjn0WCxZcdXizQNPRe4mfcRKjamh7ri2vpsdiDnfSc3gwzSlwePAIsoAOhSz-ZHHzOqspZpGuNHxYzGCXxUcFE3DjSXnBz1yxcwGDErqG25aRkQMLvyAm7DUkV9zMooRtx-IhX0tcHemgPkIbWam5DuGA_CGk0KH3SsKPVAOzApG8GIFs9-jCLSdcsdJFLEBcJeB1rUKB8fhUIgHmbcxQuU2JSyShXi2Frnc1TgoYQlwvU_91aqpun68XBIG8ThJbryFfo7p5L_nKWfcksfL6trc0m5LIt4IkAn5lbhA6wzLXCtRPeMoMSLGDwBjAgy2-h2jNsRgQr6CdH1m60erZ0cawdaiEUJY7xqX7IsyH2PIjmvzfF_XV57zVnt-F4-INKDVVqML-OLmTBLLmXGkoQdkKSwMUWm0NBf8K_qGpOE8BFvWLqK3Byt2MD1pks_A3q873L1flTUYMFNnN-bPCOj3dtRt8ph4cuyzjA5hIWFIW6ETI9Bv5mfHpgrB8tMtVISBvAqHOxPA-f6vMSpTeBeO4bBlSTqf-ugYTY7qo4MYf4vx2WAQz1y3BBJxbTqjRjpVoSZ4YlBGsSk0OPh2RyHC_415lqL-_SXwXy-DO0NvEE-0OliBSyHzbrXXci_X-CFfQxsjTOZX1ymh_QpfltF-7u1N40qmQjrE3O0N10l2Gq9G40QtHYHevYi5oAkQxPqt66tl6uHagjvixf0swJyuiRQLzcTXxOuoHWUQSY1kbUN-I-TY7cNeS4K4KDPdfaFcs1ioIs0HU9PE7OJWzHj4CeqeDNH8Fnu3Ykmv9-lPgYH5KcQxWhHKejqa9y4pmTINRWQIpUPEAcBn75CSRXk8HDwj2eO5HRjKMZOLC-Qj41gQI17XQ4e5gdqZ-rM34a-jrJqpno55CJ&cid=CAASEuRoqC6Z1iOCGPaKU2a4D29_6Q&rfl=2%2Chttps%253A%252F%252Fwindows-setup-remediations-x64-kb4023057.updatestar.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf89e3b0bbe8bc280b453823d44c9754dfd495fe7c03064938eda5d00c79012d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 10:00:54 GMT
x-content-type-options: nosniff
last-modified: Fri, 20 Nov 2020 21:09:56 GMT
server: sffe
age: 33955
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62666
x-xss-protection: 0
expires: Sun, 18 Apr 2021 10:00:54 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/ Frame 4945 21 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d04fe3e6d57be524334f1688f690be20fb65e09d806c549e1f78aa8d3f7dbae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8468
x-xss-protection: 0
server: cafe
etag: 17868783254023373946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:26:20 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/elements/html/ Frame 4945 8 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:22:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 01 May 2021 19:22:04 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4945 0
61 B 149ms
82ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsszSrytROG_cwRpGOwTF06dQBUlMS-5eKNHsr7RNfqAr4stcM607WgBaIsKrWtX12RsbUBr-jUKoKiMSiDYq_ROT6xyNvtf6TySuioqaHapA7jsl6x2xXbRzFJowJFr57jFdStVL1VFJBj2ebb51U-t8T9gNQRJyJkPq9fyt-o6gNGNzMzyJch4ponjtkSfhMpPQZPDmMleUoxVqWps4tetNbWCzTPOxUeJ9JI0QfASKGWXmHRio6sGCiCwV6jQFeeUsvDagIZ1kb3NHe3yK215xybq2hL4Rw_M9R4CIpgcca0JFlQTToDCWbY82NT7m7W1eX7nwTpLXUJ8g210c1AoVDmTq61tLd2LognlRE2YCc3P-vqCZ7LAI_f_uVwHJ9vNDUZ59KhoXygVAaETvpdPzfGlBKaonYB78v9TlvKSvhmXttedW54QfI5dUv-1VqO4VFIbs57pen2qxobeHbQfz8EeJfXWao5wxJ9nBMilahmKDRTN2c9YrhhR53i8Wj64PLSqf5cQI7WTFX_gJdiLoZq-vcmSxibQ-HNs7W-J_6ms-dlNMwb7OeMbK9uIH61BhnnnO8yNy1CoUroHR4rfH9wrhhZy6Aj1QqdlOJ2oyxWknkGINBtLD-4Jiw3s7DTFhg_uVLl2yVO08uB6IhD1uZ2PMxoltF_Ac5SmJFpS-DF_yimQxFDAmT1k81T4GrVc9OcL-PYT03VYf82T7A7B8a9-RzCqyKjOQ1i0hKHyGs-SuUK7mg_t3UYQZiNBHM7tKw7bsx7TpmgaOrEWZemzGL5E70YdgOIZbxfVgHSMNIwE9e0oEy4PDnknsta-uP-nK_yu6itLkNyTh57D_ZxpVU8G2it8fWsTySu297dwmHL252p4z3-xZio7DM-t0qeeMD3sVM9gZ4I9qFN9zeZWqIWZ5FbYFHTyalAaCWMgOGmA0cnyZb5QGjK7ABU7b7xq9cWoyNSQVia1ihCCCH1wY34ym7YwgGJNiMAVRBsRolrTkNAe2nWhHBFY60at10rDrnre3iABXAOyQ4cyXD6ZRvVhGX_Ag3233GZqT3QNoOtzPsED-griJO85oS0IW_LqYanVEHoFBIptESfLcGYHHzKWfCZ00VB08a4nw5Uo9b1efBt-w-NTe6ofdHM-2dm-D3LqG7zYCiS9HUrGXIG2R4wb8EiIP6PEa8igjM7zUnEFhFs-L4tDoQ81NkZZgW9gkn39Ko3yY11e8x1mjSuBrqNUhVJbkbUC3kxt4Y-wt4PVHurNcRmoPa0wJTTrCFOu0OBrb2_HyMGfJge3bxIkdojVcI3DeF5QLursxrHaRkMIl3SQBiLyyu2kK_vdUupoPQ&sai=AMfl-YTZEsybyg6Lt5RHEynsJizmSzhlTzlB3SHKBmHtNS7kOwGTuugK8OwYaY4-WAydTwIi3zO_Xnk7W9U0xnSrxnHwo-wnuJua9TIJR2GRbhKZ1J1PGmmCESjLfj3V1nX2PKVz5PcqDvF79yzhiQQUnnaH0jrrnA&sig=Cg0ArKJSzMZemBvSYW3WEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=1&cisv=r20210414.69744&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 17 Apr 2021 19:26:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4945 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 15:05:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15667
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Apr 2022 15:05:42 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9CE5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1

43 B
1012 B

97ms
89ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYsqqHkgEwAQ&v=APEucNVwpYvLSaA4DtMBpnyYlDxn2-uBm8JRFUGAcw6ghg2S-zVE-TUbBMfQU45GmLFqCN6-2odiPVOnorsakIqkCLgo6izAx3Ex-ZPWmvBibt2BuQ_3FomQEy3r5vo0JXBWlWZ3zNfY1UUxF5xCwh8VJOzFU-J2HTNZeKlkr2VF4xAJ9AePBKRSaWfpxO9_FjzTTZSzXj2_IcuwV2DzTalEpI8zutY6vA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 17 Apr 2021 19:26:49 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9CE5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YHs2eUhM6iSynMkhMIHn2wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1

43 B
892 B

80ms
78ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYsqqHkgEwAQ&v=APEucNVwpYvLSaA4DtMBpnyYlDxn2-uBm8JRFUGAcw6ghg2S-zVE-TUbBMfQU45GmLFqCN6-2odiPVOnorsakIqkCLgo6izAx3Ex-ZPWmvBibt2BuQ_3FomQEy3r5vo0JXBWlWZ3zNfY1UUxF5xCwh8VJOzFU-J2HTNZeKlkr2VF4xAJ9AePBKRSaWfpxO9_FjzTTZSzXj2_IcuwV2DzTalEpI8zutY6vA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 17 Apr 2021 19:26:49 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECe7NkA2_JRyMbwU86cPTnM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 9CE5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHzpg7hhOCVKJwqP3Yco4Cc&google_cver=1

43 B
1017 B

68ms
32ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHzpg7hhOCVKJwqP3Yco4Cc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYsqqHkgEwAQ&v=APEucNVwpYvLSaA4DtMBpnyYlDxn2-uBm8JRFUGAcw6ghg2S-zVE-TUbBMfQU45GmLFqCN6-2odiPVOnorsakIqkCLgo6izAx3Ex-ZPWmvBibt2BuQ_3FomQEy3r5vo0JXBWlWZ3zNfY1UUxF5xCwh8VJOzFU-J2HTNZeKlkr2VF4xAJ9AePBKRSaWfpxO9_FjzTTZSzXj2_IcuwV2DzTalEpI8zutY6vA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.37:80
AN-X-Request-Uuid: 33711ad6-9ed3-4137-a90e-335bdbcc6ac6
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHzpg7hhOCVKJwqP3Yco4Cc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9CE5
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE1NjU1NDY1MzI5MTQ1MDg4Ng%3D%3D

170 B
188 B

63ms
46ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE1NjU1NDY1MzI5MTQ1MDg4Ng%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.53:80
AN-X-Request-Uuid: 89fc2b4a-fa99-4b6b-af56-70cef648b40f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE1NjU1NDY1MzI5MTQ1MDg4Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 421C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOZFwgZjyxOzBpWQG2yfi-I&google_cver=1

43 B
180 B

73ms
69ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOZFwgZjyxOzBpWQG2yfi-I&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNWUraB85muKRfKIfmqAlWbU2mVBlUqGP8U5NsOyvS-tbRHY8c-nwALek51--YWZOimZEA82AXWARAmEceQ9IRVPMBzlPYijt30HsBD6MA2iB-mi1c5zsB2WZMjdP_KXvZZLylekEY7I-DzcVMD_M5h1LUwwLT9BVjYQqPmoK-XCq_bhBGAxrdeBGlICUuiaEyBXXTGjGr2cDeH6NR20k0-tdRq9mw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.205.4 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: OXGW/16.205.4
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOZFwgZjyxOzBpWQG2yfi-I&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 421C
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWVlNjllOTYtZjRhYi0yZjk1LWMwZGMtNDE5ODg1NmEzM2Iw

170 B
188 B

62ms
46ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWVlNjllOTYtZjRhYi0yZjk1LWMwZGMtNDE5ODg1NmEzM2Iw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNWUraB85muKRfKIfmqAlWbU2mVBlUqGP8U5NsOyvS-tbRHY8c-nwALek51--YWZOimZEA82AXWARAmEceQ9IRVPMBzlPYijt30HsBD6MA2iB-mi1c5zsB2WZMjdP_KXvZZLylekEY7I-DzcVMD_M5h1LUwwLT9BVjYQqPmoK-XCq_bhBGAxrdeBGlICUuiaEyBXXTGjGr2cDeH6NR20k0-tdRq9mw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: gzip
server: OXGW/16.205.4
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWVlNjllOTYtZjRhYi0yZjk1LWMwZGMtNDE5ODg1NmEzM2Iw
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 421C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEFNEd2FpRvJx8uWzJrgI6zM&google_cver=1

23 B
172 B

64ms
60ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEFNEd2FpRvJx8uWzJrgI6zM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNWUraB85muKRfKIfmqAlWbU2mVBlUqGP8U5NsOyvS-tbRHY8c-nwALek51--YWZOimZEA82AXWARAmEceQ9IRVPMBzlPYijt30HsBD6MA2iB-mi1c5zsB2WZMjdP_KXvZZLylekEY7I-DzcVMD_M5h1LUwwLT9BVjYQqPmoK-XCq_bhBGAxrdeBGlICUuiaEyBXXTGjGr2cDeH6NR20k0-tdRq9mw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 17 Apr 2021 19:26:49 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEFNEd2FpRvJx8uWzJrgI6zM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 421C
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZDI3MDg0ZGQtNTRiZS00MzgyLThjNjktNDZjMjA4OTkxZWIx

170 B
188 B

97ms
52ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZDI3MDg0ZGQtNTRiZS00MzgyLThjNjktNDZjMjA4OTkxZWIx

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: akka-http/10.2.3
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZDI3MDg0ZGQtNTRiZS00MzgyLThjNjktNDZjMjA4OTkxZWIx
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 71BD 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 17 Apr 2021 03:14:09 GMT
expires: Sun, 18 Apr 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 58360
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame D5A1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 96f9f8ad97a1c1d208b350effcf9cc86c9da739ac3e5fb9ebb145a2d15c4416f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 24CA 0
528 B 87ms
78ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

sync
partners.tremorhub.com/ Frame 658E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESEM1iFuzhNlQ_6Bw1hIVHBU4&google_cver=1

43 B
183 B

273ms
88ms

Image
image/gif

2600:1f18:612b:4232:380b:6483:6fb1:583d
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEM1iFuzhNlQ_6Bw1hIVHBU4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNX2dMM2SUTRANk7N3TTlDIoIEruw_CdyK7pLvloyo4tJJrVuJKBFtKv1TqBQf4zbaJxPccedw50CMBXsYFfYgCqvsSxQV8gONcFdwz7_MN5kkUHybHkRyh1FEy46_cVuRPEwW5yflDTqri_ieLPIg8v5tPFEA7vRf9C8BvvN8nc4L8vXNGEMkVeH17n9w1MPNoxRjqecqMFk55FS54TaU_IY38RXg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4232:380b:6483:6fb1:583d Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://partners.tremorhub.com/sync?UIGL=CAESEM1iFuzhNlQ_6Bw1hIVHBU4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 658E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGF-zLnZsg79UukkmnFATA0&google_cver=1

43 B
548 B

36ms
32ms

Image
image/gif

185.94.180.126
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGF-zLnZsg79UukkmnFATA0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNX2dMM2SUTRANk7N3TTlDIoIEruw_CdyK7pLvloyo4tJJrVuJKBFtKv1TqBQf4zbaJxPccedw50CMBXsYFfYgCqvsSxQV8gONcFdwz7_MN5kkUHybHkRyh1FEy46_cVuRPEwW5yflDTqri_ieLPIg8v5tPFEA7vRf9C8BvvN8nc4L8vXNGEMkVeH17n9w1MPNoxRjqecqMFk55FS54TaU_IY38RXg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.126 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 38
Connection: keep-alive
Content-Length: 43

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGF-zLnZsg79UukkmnFATA0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 658E
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZGIyMzk5YzMtOWZiMi0xMWViLTgyYWYtMTRlNTgzMzAyYjA2

170 B
188 B

54ms
53ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZGIyMzk5YzMtOWZiMi0xMWViLTgyYWYtMTRlNTgzMzAyYjA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIYrJqHkgEwAQ&v=APEucNX2dMM2SUTRANk7N3TTlDIoIEruw_CdyK7pLvloyo4tJJrVuJKBFtKv1TqBQf4zbaJxPccedw50CMBXsYFfYgCqvsSxQV8gONcFdwz7_MN5kkUHybHkRyh1FEy46_cVuRPEwW5yflDTqri_ieLPIg8v5tPFEA7vRf9C8BvvN8nc4L8vXNGEMkVeH17n9w1MPNoxRjqecqMFk55FS54TaU_IY38RXg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZGIyMzk5YzMtOWZiMi0xMWViLTgyYWYtMTRlNTgzMzAyYjA2
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 72
Connection: keep-alive
Content-Length: 0

POST
H2 204 csi
csi.gstatic.com/ Frame 5A80 0
322 B 50ms
29ms Ping
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~knm4t4vk&c=6470332669639&slotId=3235166334819.5&qqid=CJfk5Z6BhvACFZa8ewodMl8How&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C75259407%2C75259408&nsei=44714510%2C75259405%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 5A80 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 21:15:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 425461
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Tue, 12 Apr 2022 21:15:48 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 5A80 15 KB
15 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 21:15:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 425461
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Tue, 12 Apr 2022 21:15:48 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A80 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CzIRvdzZ7YNfMIJb57gOyvp2YCsrVoaNi3Z3aguoMt8eE2roBEAEg1rWlBmDRgbmC0AegAZux9pMCyAEFqQIgAuV8Ixq0PqgDAcgDmwSqBJ0CT9CnlC7qSmv1QJd9vp5UMYjoiz0SnypFZte38VkjAVSriiFms1e2-FxIsMlr90DuCwXtjzuwSNLAP8qZh8lXnL--e4uTlyefqth79kU_rm1_0fqA9ytkoq0b39OMtEqH0kYIZXNUBY6nAvfUmSe3f3TiBTVtNR7RXPKr72vvdhqOaZ-OZ9dDDKP-oAQslH-C-BAF-HxG02yKhvst95YYSlYdlzEf5cQ-R1jGxP7XIQ25AHvbjx_v3OJoq9MS8QPhWQkHZdEF6ZpDSQ2VVZGwCgscMlyQ96Gu0CrP0kjzwvwgMLsE9Zczu6l8KLTJ3GPeQEmlXqODYa9JCc2KY5pgyxnRn-CtNNXyJ6D7Pd6Oo15wcB6gDAzc0G5pddYnwASfjbGIqwPgBAOQBgGgBk6AB83OiewBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgBAQARgdgAoBmAsByAsBgAwBsBOwrKIL0BMA2BMKiBQM2BQB&eventType=clickstring&clientTime=1618687609335&ai=CzIRvdzZ7YNfMIJb57gOyvp2YCsrVoaNi3Z3aguoMt8eE2roBEAEg1rWlBmDRgbmC0AegAZux9pMCyAEFqQIgAuV8Ixq0PqgDAcgDmwSqBJ0CT9CnlC7qSmv1QJd9vp5UMYjoiz0SnypFZte38VkjAVSriiFms1e2-FxIsMlr90DuCwXtjzuwSNLAP8qZh8lXnL--e4uTlyefqth79kU_rm1_0fqA9ytkoq0b39OMtEqH0kYIZXNUBY6nAvfUmSe3f3TiBTVtNR7RXPKr72vvdhqOaZ-OZ9dDDKP-oAQslH-C-BAF-HxG02yKhvst95YYSlYdlzEf5cQ-R1jGxP7XIQ25AHvbjx_v3OJoq9MS8QPhWQkHZdEF6ZpDSQ2VVZGwCgscMlyQ96Gu0CrP0kjzwvwgMLsE9Zczu6l8KLTJ3GPeQEmlXqODYa9JCc2KY5pgyxnRn-CtNNXyJ6D7Pd6Oo15wcB6gDAzc0G5pddYnwASfjbGIqwPgBAOQBgGgBk6AB83OiewBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgBAQARgdgAoBmAsByAsBgAwBsBOwrKIL0BMA2BMKiBQM2BQB

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 5A80 25 KB
13 KB 183ms
75ms XHR
text/xml 64.233.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-D-xa-21eGx-yeQF9ZrvZnHCzRJNiyNeCRDn0kc58W7z7QwiHg0szHqeuvVKY1vaIg5xjkgzRPouKvZuUcX-OBCayeIew&dbm_d=AKAmf-AC5_c0xZO2MuibC3YiczxD6JyH2J4RNCKJWSvBNhu-_ph5O-u_BTH7mK9kWLDYx-qwKFhHrb3VJtysFwhZVC1K6DamcIdT3nXlExx0KQ7Mf4SRcZRBXNveq5FbC7ohR6ANCHtnUTepboDFP85C6IDqpvYWvpmwiJHic4mWZJjGOW-EjaBZALN2OWJWahzU7NT66OmZDmatTv5iBuGnhEZiZ4xTsCjX6FYv0qcOtt8wN8Si_1KykOucMrGYwtded-hVnQggm4RGeUWXkeqRf0RDtBLfYJ0fD0n2g4qBhmzphl2HQAppy4rFgWkVERsatyfb3NhxcyVBmArMIFsHaF3wFe1LZxALU0VtoLGpX0aZ7_Hdgh2zUJj8hae_3FXmdnbHrEzwtk09wBba_QGC3kwspc5A_h56unfkBj14uCTUFrfYJMUbpIx4iz65Ty_b9bg-_vI_cZIavCEjnHz9V60dnQafCdCLdDkopld5ia0EX2GQyBYscELTiQzEY-Z53cJQWAEVYbtjd1rpOmSowAmVdM8zmG2ClTDbLlG1rHpPROxsVcS1mOqrX4cJ9M904XZhsUXsFguU4wqd6emExUL0AyGfSmFt3YSm55YU0A-CthBltqkqFkbN665Hd5J-QGvWBDeLctG1lI3zj2ryDzAkRrzksMiL_ruYfEBZ9uQWMW8cyeEw_ynuq4a3SClWJmszUAbGxjv_B6LJlb0zUMrMJFq7p6KJFdHqUU6WzZHocj2UQPwO4G5ch2rIfE0rDy3KBYZKRf1X7TjTw5CL_Q1WZzD6GSza5DWLSVWbTrcy5mxqt4WsajY7tgMlqcFj8pER6wObwGrVHNUssYoTwUxaXFDovQQSmaFo3Q3N3ht-R30PFt5rxl5_DuNtrlWqZ-h5g0b_nQlRsTuJRwkAex9r48Huuv1xjWF2msf3R9rhGzQFSH5anuI4EBOZFkOoPIpM9Qj05hSPMbTF1G2nHDF4xO6WAyhGM1c0O88bWpZUDiDsILy7L9COnhzNjhMEOt_qAKs3SNei3am2FtWJvM1Lp0Mh7DuKwZdMVj0R0pLr0cz_SQgmVksJpAV9ok1sZo3ySHrBkH-KrSrvQx0-cMiK9Eu_GpdM8Yh7q9mXU316sFLuEe6mNdrKVKWW2u3D-oNTbIsEtq-etodvqtjqFeKsTq7ZgA-mfnKEw9mh63qxQtNHaVrBuIVrFYAelBTU0VM0-g96JmYIULSLSRutngq4tmnYSF2yHYL_9NLENbhLK-33bpECQr_F_nq3XFT5QMGrNs-ryZ35-jt6Pscosx1bcIcmX28nkwBNCosdb0igaCLlwoJne6jwMARL4mGse-vyPvXc8boDJuve1hWNvIDEwXF6oGkPOB0YsQWyNvlsK_azfOCpeS3jpRh7p2FUGMX1M5TrsOHEQxX6cGrHNvvH3sjd9XHe7cmodtWjkhZzui4d7pbjfjBA7EBQbiM7PLx7WYnQt2jw5rHni_Vvbo-Z_XLrFAOkMrOn63-XveqelBbs1STgYnhfCbIKf1pDDapBCKBvWg25WUO-SGaDLl6hAJmbgezoUc8X5Oop2ftJmquGPUMpQFx3Htm6n0E5lvTOl4hxMlrHlL52sk4_q_VhP1ZaKnzFlNTLjfx_5hydTwd9wLRPjuy32pquj5rcQ-r7nraVxsPU06ZzisSBQfcoARX3ZtM6QW57W-cI_k8EnybGD99G-YckZE-i8H1-no0lFu_KJCddhlwIo9go8AGgt8ff2TsOG5Qq__x00DiNsxeXIDIHi4XrCbtLoW6wDYLvEFlBVdJmvO7MwLfy5Qvhn7bSiydcbT6gNgaS9TPqNHy7PhKYj1kKml9HlY1E4HRBhlFoAB3-DRGJeq22aW9c9PWz8xHbMHTuCps-QqMjn3XaxMZlBNdtIhex1rhK50ct8wSfbVyx8ATsEC20ljcI0M3gG8-ME7XOl8YYIdcR-uHkTNoi-6bu2jBoiLMXxv5n5pM7B4MET9Bl8LQjBkFF8KUMPZ2ft7qSH5XoXjpYO78YBDnRh7Vw_mNIWggRpM-qREEYUgHnummL2dnlihxpWKp8ex0z2bOLZVncB01RfKWYoyEoXivIMiHNMh9Eb8pyBaGvjZeX6pqXCuQpdUn9MolardG9HMSyFmGHzMqaoKUaALuC6TtUuBhMnM-46ehrEhL9DVuWcpnPnlmbt7ErGaC1zaT8SSTbmjGS9VabnkL4F-RUJ577n2xawTFTs6hFt-E-8yHepwaSFPGOYrgItTLxiFJivGjmKJ1Qmx9v72OPN8e9yILIGFFjrXIUiKPsBi_FWd-evWnlvJgXBdowYhwl1x_3v4t6jEaYly2iy48mdSVgWwQd_v3LN3KH68PdBDdn9WCH4YsV3aF864bQrSeHNS0eoNsl6McSSbjjl-7u9kgQVgI84jPVZ9DxbRV2GL3mz49uGlsr5-9ZUJMcbbtBb-zOTYs_7jOtT-jjaLEIR3e9umj8m73bJxZ3pBvkxKdebFedUdHMf9MCGCcBJbG3v7SY0Ll-RRoAR_xuWE6TIlFU9lZF6cdvCIhpAuI5SxDpRYCHytorORYAAu1VOovGt2N2cBj8TwS9HLNNHw1ES2gELXTKKWm410pOBl4mxk3IhYSEbI3MQQ7iUDManBl0Kn_c3Sd-G0jiUoloHeON8biCZ5IZxFjY9r_MMsWCa3j4mEgGZpk596F0-_YmHptB3SMAp2saQwDnhicc9TsFHj1FQNirhLHRUC3ML-k7bm6yWbCjgNpX7plwlvCDhHQbaEBeLGFSl0Ah3rV57raMBOuH9-t3FlGRUWAcjTR14l4wNEy1ogQ3wvkUNIDiakPxlrjnlDIMhTxto5lYhPlhXDnl6sSSjjG_-Nlp0zmP0tVK0OGKRIshT3DwH__aJi9HzdquGiF4TYQOw5_ZzYtOlBUv-pPc0g6cOvCgaaSeOMALDpHin2oX4kjcJATpxPDLnXsERm2uMEOl7iAE4QERia4fA6WaLWCDRYOB8j1tNLtO4n-Fd91Zcp8QYeg95jpcYwPh5Qn9uBR2LFqQQNXuS-8XemwINw8GR92DprWAHtSsRSXg-57_8by7g35F6tjIZDAI3uGqXatMYtMuJuNcTvvH9Zk2WQ8aWvUekT03DVgMA8Y9sEBeMt86-OTHazhpWAQNPW8J5IQy088JVspYzZD4Efd7_LaHMmCGjojcLH0J&cid=CAASEuRoelhzd4rt5aaC-T2NNeQ_2w&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wl-in-f154.1e100.net

Software

cafe /

Resource Hash

3e077843080165a011c30f8b8c924b246089c9a8745bf8301c8edf143b990fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12289
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5A80 0
0 85ms
81ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CPVUWdzZ7YNfMIJb57gOyvp2YCsrVoaNi3Z3aguoMt8eE2roBEAEg1rWlBmDRgbmC0AegAZux9pMCyAEFqQIgAuV8Ixq0PqgDAcgDmwSqBJoCT9CnlC7qSmv1QJd9vp5UMYjoiz0SnypFZte38VkjAVSriiFms1e2-FxIsMlr90DuCwXtjzuwSNLAP8qZh8lXnL--e4uTlyefqth79kU_rm1_0fqA9ytkoq0b39OMtEqH0kYIZXNUBY6nAvfUmSe3f3TiBTVtNR7RXPKr72vvdhqOaZ-OZ9dDDKP-oAQslH-C-BAF-HxG02yKhvst95YYSlYdlzEf5cQ-R1jGxP7XIQ25AHvbjx_v3OJoq9MS8QPhWQkHZdEF6ZpDSQ2VVZGwCgscMlyQ96Gu0CrP0kjzwvwgMLsE9Zczu6l8KLTJ3GPeQEmlXqODYa9JCc2KY8JheXPZtQC5ploZu7wdofVvYGyTs0wChVh-cVxxwASfjbGIqwPgBAOIBdjQh54skgUGCAMQARgBkgUGCBsQAhgBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZOgAfNzonsAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUb2AcA8gcLENTGkgIYk5yHkgHSCAkIgOGAEBABGB2ACgHICwGwE7CsogvIE6DHngnQEwDYEwqIFAzYFAGyFxoKGAgAEhRwdWItNDExODc2NTc0NDQ1NTM5Nw&sigh=V5vcUCCHk24&cid=CAQSOwCNIrLMpDKUE9sSYH0309cBz6ZT2YCBCoJKtzC7hUmdBtjF9MHoOGoep7CrwIJ5oDCJ1__1TGX4Iu8j&vt=10
Requested by: Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3661 1 KB
749 B 12ms
8ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 17 Apr 2021 03:14:09 GMT
expires: Sun, 18 Apr 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 58360
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 5A80 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2419d4e5984bce677a9766c89661f11b1a0097b37a9d6b42c3be6413f3af899

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D5A1 0
60 B 73ms
72ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FD91 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sat, 17 Apr 2021 15:06:07 GMT
expires: Sun, 17 Apr 2022 15:06:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 15642
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame ED12 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 17 Apr 2021 03:14:09 GMT
expires: Sun, 18 Apr 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 58360
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4945 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4aa6b1d79aed1a91a36a83aa694f8883032e674ad428b5d6e2e9eb432e89dd05

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9D2C 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sat, 17 Apr 2021 15:06:07 GMT
expires: Sun, 17 Apr 2022 15:06:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 15642
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4945 0
23 B 120ms
75ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3982 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 17 Apr 2021 03:14:09 GMT
expires: Sun, 18 Apr 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 58360
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 24CA 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 736b2675b897706a6ec7ca1e246a62362dd57daef3d71b4c5e4d7c4aebd50828

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 49A1 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sat, 17 Apr 2021 15:06:07 GMT
expires: Sun, 17 Apr 2022 15:06:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 15642
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 5A80 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/outstream.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Apr 2021 20:07:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 515945
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Apr 2022 20:07:44 GMT

HEAD
H/1.1

200
OK

file.mp4
r3---sn-4g5ednsz.c.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m... Frame 5A80
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sig...
https://r3---sn-4g5ednsz.c.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/acao,ctier,expire,id,ip,ipbits,i...

0
0

40ms
6ms

Fetch
video/mp4

2a00:1450:4001:6c::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-4g5ednsz.c.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/179B7F201601EA38D58BDD718154F4398D878F58.48DECBBC8B61B2F75739A1AA72D44BC0C0420830/key/cms1/cms_redirect/yes/mh/mg/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednsz/ms/onc/mt/1618686982/mv/m/mvi/3/pl/47/file/file.mp4

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:6c::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Apr 2021 19:26:49 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 4470335
Last-Modified: Wed, 30 Sep 2020 09:17:42 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Sat, 17 Apr 2021 19:26:49 GMT

Redirect headers

date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 652
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r3---sn-4g5ednsz.c.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/179B7F201601EA38D58BDD718154F4398D878F58.48DECBBC8B61B2F75739A1AA72D44BC0C0420830/key/cms1/cms_redirect/yes/mh/mg/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednsz/ms/onc/mt/1618686982/mv/m/mvi/3/pl/47/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 71BD 35 B
465 B 53ms
7ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECxP1ht4sVGYRfZrlnlMI1g&google_cver=1&google_push=AQvitULifxmofj87KXkb7KQI8Jox_kggUqokAaiU01eVJEBtkAWVet4Z2lADlCpeOWFtotdsZJoQH1w71ELjHlLKcb_Z8Wgl3g

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 71BD 43 B
324 B 140ms
59ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJ6AHlfiPBiBqN0qYNzVw0c&google_push=AQvitUIIwt3C8hC9rzT72T0uiJB999dY-cb7Wabjxte9ChejCKDztMPla_DRbkFDtkCKpPtY6MU0LMzODslrbGqOknpFqWCAkQ&google_cver=1
Requested by: Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 71BD
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitUK4sd5oXeAWg-lukzXzqedxpJ3CpFganupsUEo6ZNNWefG8hyYRrHfjzILce7nvAfd_c5_6wM83k7GJfCFJ4cV2Lm51lA
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUK4sd5oXeAWg-lukzXzqedxpJ3CpFganupsUEo6ZNNWefG8hyYRrHfjzILce7nvAfd_c5_6wM83k7GJfCFJ4cV2Lm51lA&google_hm=bd_HYJRayB8zSFeWnJHHag==

170 B
188 B

68ms
66ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUK4sd5oXeAWg-lukzXzqedxpJ3CpFganupsUEo6ZNNWefG8hyYRrHfjzILce7nvAfd_c5_6wM83k7GJfCFJ4cV2Lm51lA&google_hm=bd_HYJRayB8zSFeWnJHHag==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUK4sd5oXeAWg-lukzXzqedxpJ3CpFganupsUEo6ZNNWefG8hyYRrHfjzILce7nvAfd_c5_6wM83k7GJfCFJ4cV2Lm51lA&google_hm=bd_HYJRayB8zSFeWnJHHag==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: knandqfr47egn8210v0svul6hg36tp8u

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 71BD
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NqDoO5UmQKqLbUwA59I89g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

58ms
58ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NqDoO5UmQKqLbUwA59I89g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUIRQU9qqVHBiQFNZbdqnW82xBxU0_ztu0urzw6m4KTm3LlqORp_eSZ-shg-c8dxjBScKQB6iHAzhfotz4Fa3pKJW1RLcw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NqDoO5UmQKqLbUwA59I89g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUIRQU9qqVHBiQFNZbdqnW82xBxU0_ztu0urzw6m4KTm3LlqORp_eSZ-shg-c8dxjBScKQB6iHAzhfotz4Fa3pKJW1RLcw
Date: Sat, 17 Apr 2021 19:26:49 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 71BD
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitULClsjIljFmLt79jfmbN3QDaMUeySPjRpLgoXoydgJ8Aq-tGSb9epBxK6FV5EWXqj19CYz...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlEtMUstQ0pJUA==&google_push=AQvitULClsjIljFmLt79jfmbN3QDaMUeySPjRpLgoXoydgJ8Aq-tGSb9epBxK6FV5EWXqj19CYzEu_voYdP_Eupb4dA31vt8

170 B
188 B

54ms
54ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlEtMUstQ0pJUA==&google_push=AQvitULClsjIljFmLt79jfmbN3QDaMUeySPjRpLgoXoydgJ8Aq-tGSb9epBxK6FV5EWXqj19CYzEu_voYdP_Eupb4dA31vt8

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlEtMUstQ0pJUA==&google_push=AQvitULClsjIljFmLt79jfmbN3QDaMUeySPjRpLgoXoydgJ8Aq-tGSb9epBxK6FV5EWXqj19CYzEu_voYdP_Eupb4dA31vt8
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 71BD
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUJWA6ybwi9B4n0F5EvFxWnBs-TWnx0ZZ...

170 B
188 B

65ms
62ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUJWA6ybwi9B4n0F5EvFxWnBs-TWnx0ZZORB2nGMm6iXGwEME-pI5l_fkNV7Q6vIQD72htQH2iiyccYAgCBs-9OYe5pLYA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&google_push=AQvitUJWA6ybwi9B4n0F5EvFxWnBs-TWnx0ZZORB2nGMm6iXGwEME-pI5l_fkNV7Q6vIQD72htQH2iiyccYAgCBs-9OYe5pLYA
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 458
Expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H2 200 trk
ag.innovid.com/ Frame 71BD 43 B
297 B 68ms
20ms Image
image/gif 2a05:d01c:1d8:8100:1c45:c4d6:f2b8:9306
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESENMiqyuQYIVfdI7C3Sp-dQc&google_cver=1&google_push=AQvitULhp7xaPD0aLx9WDeUMR_qSoDGeEe8PYLQyy2a633SXBa1FyMAWr91Gq2977x870EMx5yV3l7Uc9I8wSW_Mf-DnJQmE
Requested by: Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:1c45:c4d6:f2b8:9306 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 71BD 0
12 B 59ms
56ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ijf95C3sc4awPjeTe72bZWfIFM4VgLtthXpnROHArST72hxwa58Yk647yvnP3cAUIhqvSI

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3661 35 B
464 B 51ms
10ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECxP1ht4sVGYRfZrlnlMI1g&google_cver=1&google_push=AQvitUI8LPDb7JorUeVgkMBH5uGUU22slSm-Hq-wNfc2zw3u10p-YgrOY85UjoNjqDUko_svq9I59o-IsNIaEGxUDEbYgyz2yZi_

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

1000.gif
id.rlcdn.com/ Frame 3661
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAQvitULv5-W7jZuVfWFBQ4J8ann38-b8f3xLahqkmMjZPBIGCIz5fKf-B2zrJkzIplr_fPzaV2wmsGRN_GMO_32JY0ItjBmzmfFv&google_gid=CAESEL6JlNzH9avfpGNuIt_PS3U&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPns7IMGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BUXZpdFVMdjUtVzdqWnVWZldGQlE0Sjhhbm4zOC1iOGYzeExhaHFrbU1qWlBCSUdDSXo1ZktmLUIyenJKa3pJcGxyX2ZQemFWMndtc0dSTl9HTU9fMz...

42 B
317 B

90ms
87ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPns7IMGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BUXZpdFVMdjUtVzdqWnVWZldGQlE0Sjhhbm4zOC1iOGYzeExhaHFrbU1qWlBCSUdDSXo1ZktmLUIyenJKa3pJcGxyX2ZQemFWMndtc0dSTl9HTU9fMzJKWTBJdGpCbXptZkZ2
Requested by: Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPns7IMGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BUXZpdFVMdjUtVzdqWnVWZldGQlE0Sjhhbm4zOC1iOGYzeExhaHFrbU1qWlBCSUdDSXo1ZktmLUIyenJKa3pJcGxyX2ZQemFWMndtc0dSTl9HTU9fMzJKWTBJdGpCbXptZkZ2
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3661
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitUIblm3x5WBrv0IiG1UAIofb9ee1KqpCqhlRsOj9r3VKj85b1MDDeA_Sx1r8qRWFV1m3cx-yQqlx_pUoiGcHHm9tCFjItVkIaA
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUIblm3x5WBrv0IiG1UAIofb9ee1KqpCqhlRsOj9r3VKj85b1MDDeA_Sx1r8qRWFV1m3cx-yQqlx_pUoiGcHHm9tCFjItVkIaA&google_hm=bd_HYJRayB8zSFeWnJHHag==

170 B
188 B

57ms
56ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUIblm3x5WBrv0IiG1UAIofb9ee1KqpCqhlRsOj9r3VKj85b1MDDeA_Sx1r8qRWFV1m3cx-yQqlx_pUoiGcHHm9tCFjItVkIaA&google_hm=bd_HYJRayB8zSFeWnJHHag==

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUIblm3x5WBrv0IiG1UAIofb9ee1KqpCqhlRsOj9r3VKj85b1MDDeA_Sx1r8qRWFV1m3cx-yQqlx_pUoiGcHHm9tCFjItVkIaA&google_hm=bd_HYJRayB8zSFeWnJHHag==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: er3v17evd9p3ni578t34b19dl1cqpp13

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3661
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=EtgpOObYRWKx_4m8vq32Pw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

73ms
72ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=EtgpOObYRWKx_4m8vq32Pw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULB7b11EflBF3n6OAFbZ28aYfpAR7cKf0YJC_4PHWJU1OHFP3hR62LTr7_NcJ4nxNTDQk2qfRG2p22wWI7YvYE1-T_8EjqVWQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=EtgpOObYRWKx_4m8vq32Pw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULB7b11EflBF3n6OAFbZ28aYfpAR7cKf0YJC_4PHWJU1OHFP3hR62LTr7_NcJ4nxNTDQk2qfRG2p22wWI7YvYE1-T_8EjqVWQ
Date: Sat, 17 Apr 2021 19:26:47 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3661
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitUKFbYKIS4yUsH1z9QQWiIVQAZ6r-IqPiVeOxHAvzMyQBDS1fJNELgsCi7ml2DulFVcB-Ni...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlItMUstR1k0Vg==&google_push=AQvitUKFbYKIS4yUsH1z9QQWiIVQAZ6r-IqPiVeOxHAvzMyQBDS1fJNELgsCi7ml2DulFVcB-NiBspuuEIpBPb1wMPaKm0ZDETV1

170 B
188 B

60ms
55ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlItMUstR1k0Vg==&google_push=AQvitUKFbYKIS4yUsH1z9QQWiIVQAZ6r-IqPiVeOxHAvzMyQBDS1fJNELgsCi7ml2DulFVcB-NiBspuuEIpBPb1wMPaKm0ZDETV1

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1NlItMUstR1k0Vg==&google_push=AQvitUKFbYKIS4yUsH1z9QQWiIVQAZ6r-IqPiVeOxHAvzMyQBDS1fJNELgsCi7ml2DulFVcB-NiBspuuEIpBPb1wMPaKm0ZDETV1
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3661
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_cver=1&google_push=AQvitUK4POuJkku4hTmFkQDNpwx8ihRAiAEl36_KqXoO-BE5QO2b7pbFero1luGnA6uAhwDN0Y-d...

170 B
188 B

60ms
56ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_cver=1&google_push=AQvitUK4POuJkku4hTmFkQDNpwx8ihRAiAEl36_KqXoO-BE5QO2b7pbFero1luGnA6uAhwDN0Y-dJtfDt2eDcepgozGx9uY6KEGpuQ&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_cver=1&google_push=AQvitUK4POuJkku4hTmFkQDNpwx8ihRAiAEl36_KqXoO-BE5QO2b7pbFero1luGnA6uAhwDN0Y-dJtfDt2eDcepgozGx9uY6KEGpuQ&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 462
Expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3661
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEGBx7yNBVoViJqBQmFxDd6Y&google_cver=1&google_push=AQvitUIcLcGVG3C6wjW2vMGK...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUIcLcGVG3C6wjW2vMGKN-ai-VEnomSDX2pYPb84vpSzm5AllKvS2_ZjLm09kx2CmmMZMf5YatAK3Yt0LTGMp1HRJKaY7lZOAw&google_hm=

170 B
188 B

59ms
59ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUIcLcGVG3C6wjW2vMGKN-ai-VEnomSDX2pYPb84vpSzm5AllKvS2_ZjLm09kx2CmmMZMf5YatAK3Yt0LTGMp1HRJKaY7lZOAw&google_hm=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUIcLcGVG3C6wjW2vMGKN-ai-VEnomSDX2pYPb84vpSzm5AllKvS2_ZjLm09kx2CmmMZMf5YatAK3Yt0LTGMp1HRJKaY7lZOAw&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-length: 0
expires: Fri, 16 Apr 2021 19:26:49 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 3661 0
12 B 57ms
56ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K46o3sVxKOQJrDoaXM1f_1ogQlFKcK4Vdpcjn9ubR-sDx-7P2ez_l7fUA51BAglAjm1MwezQ

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame ED12 35 B
464 B 29ms
8ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECxP1ht4sVGYRfZrlnlMI1g&google_cver=1&google_push=AQvitUJQkfMM-L3w8EWLp7Yu9rJCpiJpXzbxqS05pXWqAXtsbOpCdCrYGL1ZMGe5XG3y4p82E63D8kHrEES9zcopr8YWLsmtIh75PA

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame ED12
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAQvitULi4BSpphPdM3L5Ob-Hh0G0B36BuVdjxE-C1aEd7_bMOWf22izQMWDx0weGjQv9Gnp9cjBSY7YDjaDzg8scFgygnjleq_bDPg&google_gid=CAESEL6JlNzH9avfpGNuIt_PS3U&g...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=&google_push

170 B
188 B

65ms
62ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=&google_push

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame ED12 43 B
106 B 122ms
66ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJ6AHlfiPBiBqN0qYNzVw0c&google_push=AQvitUIE5QmU3iGfkPdJmOHSbPLMsHMoTVl3pyxQqG1rwAnEnUAVsFIKYEbelDL0HjcUB8pVOC0iGhHSmhiP6WdhjQ36ngMIM9immA&google_cver=1
Requested by: Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame ED12
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitULpcZR40grfiN7KNxHny_d3BL6R4klDFIwj32V6p7XZ0vgPNJlBpTRITF04yLe31nVUZ4qewzYEIgmRcOtfruWLkEuX0awoUw
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULpcZR40grfiN7KNxHny_d3BL6R4klDFIwj32V6p7XZ0vgPNJlBpTRITF04yLe31nVUZ4qewzYEIgmRcOtfruWLkEuX0awoUw&google_hm=bd_HYJRayB8zSFeWnJHHag==

170 B
188 B

58ms
57ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULpcZR40grfiN7KNxHny_d3BL6R4klDFIwj32V6p7XZ0vgPNJlBpTRITF04yLe31nVUZ4qewzYEIgmRcOtfruWLkEuX0awoUw&google_hm=bd_HYJRayB8zSFeWnJHHag==

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULpcZR40grfiN7KNxHny_d3BL6R4klDFIwj32V6p7XZ0vgPNJlBpTRITF04yLe31nVUZ4qewzYEIgmRcOtfruWLkEuX0awoUw&google_hm=bd_HYJRayB8zSFeWnJHHag==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: feldoms4chdf805sp2bqiun8in39nqln

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame ED12
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5ejttaobQyCIuMGWMVBD0w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

77ms
77ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5ejttaobQyCIuMGWMVBD0w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJX68Xjgc7wioy-vzp941Pn2dJF56zA47uOLGC4YIUvkAatJ8zI6kjLff8sGzxpthY-nORFlimmlIHLHNZrpQlC4f4fMBfBzQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5ejttaobQyCIuMGWMVBD0w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJX68Xjgc7wioy-vzp941Pn2dJF56zA47uOLGC4YIUvkAatJ8zI6kjLff8sGzxpthY-nORFlimmlIHLHNZrpQlC4f4fMBfBzQ
Date: Sat, 17 Apr 2021 19:26:49 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame ED12
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitULEgSCn5qGoPNz4hsqn6SZmuEVHeNZkq66h90c5y2yOykVCrKVzqwca3c0tbiFXPkSrr9R...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OFYtVC04Slc2&google_push=AQvitULEgSCn5qGoPNz4hsqn6SZmuEVHeNZkq66h90c5y2yOykVCrKVzqwca3c0tbiFXPkSrr9RgMx03lP86zg9n9ggmietbPz1UcQ

170 B
188 B

58ms
58ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OFYtVC04Slc2&google_push=AQvitULEgSCn5qGoPNz4hsqn6SZmuEVHeNZkq66h90c5y2yOykVCrKVzqwca3c0tbiFXPkSrr9RgMx03lP86zg9n9ggmietbPz1UcQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OFYtVC04Slc2&google_push=AQvitULEgSCn5qGoPNz4hsqn6SZmuEVHeNZkq66h90c5y2yOykVCrKVzqwca3c0tbiFXPkSrr9RgMx03lP86zg9n9ggmietbPz1UcQ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame ED12
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_push=AQvitUKMT5XFySsrV-_MqwAewxa5qds1M4bsS697hi3l-nz6Wfeh91Mo5BjQ7Mcfq-o7HTgDvTG0etFFyIiyg9Ikdu...

170 B
188 B

58ms
58ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_push=AQvitUKMT5XFySsrV-_MqwAewxa5qds1M4bsS697hi3l-nz6Wfeh91Mo5BjQ7Mcfq-o7HTgDvTG0etFFyIiyg9Ikduye_Ugz05KB&google_cver=1&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_push=AQvitUKMT5XFySsrV-_MqwAewxa5qds1M4bsS697hi3l-nz6Wfeh91Mo5BjQ7Mcfq-o7HTgDvTG0etFFyIiyg9Ikduye_Ugz05KB&google_cver=1&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 460
Expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame ED12 0
12 B 61ms
44ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lrepnqwc0aANDZA-Y6VS6Q2vNTcYxJ48GLX4bYrusX5zzN4ujoubhV0bsyukinK_Rg89cd

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3982 35 B
463 B 20ms
8ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECxP1ht4sVGYRfZrlnlMI1g&google_cver=1&google_push=AQvitUI2rIB7qoSU4sqMw3M1FjzMtnHPyi4nHT1KGpgyZSIIDv4cN78A4Pj_7tWoK5_tNclTg2JzGHq3beXCM1JZea9vpMX2NwM

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 3982 43 B
106 B 111ms
66ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJ6AHlfiPBiBqN0qYNzVw0c&google_push=AQvitULeZuIrzPc4QjJNsZ_Lt0b2SCiqfi31EU4uvim80dTyVfzWmz_BJNAFL4A11UbNHtUvBdzdrhIuG3XTGzdL1O2fPIrRmiw&google_cver=1
Requested by: Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3982
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEJ83Jkm1uQtLNa5jcf5WDyg&google_cver=1&google_push=AQvitULkQBEn-g0pBIyVM2E_flqes1qVyO60y4jwnsqTWD-h-bB-b4Wawrt2KEjrUGWCIpEiAV02dynSYeOuLCc34b_L649QCrA
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULkQBEn-g0pBIyVM2E_flqes1qVyO60y4jwnsqTWD-h-bB-b4Wawrt2KEjrUGWCIpEiAV02dynSYeOuLCc34b_L649QCrA&google_hm=bd_HYJRayB8zSFeWnJHHag==

170 B
188 B

58ms
56ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULkQBEn-g0pBIyVM2E_flqes1qVyO60y4jwnsqTWD-h-bB-b4Wawrt2KEjrUGWCIpEiAV02dynSYeOuLCc34b_L649QCrA&google_hm=bd_HYJRayB8zSFeWnJHHag==

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitULkQBEn-g0pBIyVM2E_flqes1qVyO60y4jwnsqTWD-h-bB-b4Wawrt2KEjrUGWCIpEiAV02dynSYeOuLCc34b_L649QCrA&google_hm=bd_HYJRayB8zSFeWnJHHag==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 2c408g339um2tbm3s2tf7mqq8dt9pc1q

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3982
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Gq136gYZSlqM4-D_-FQY4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

81ms
81ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Gq136gYZSlqM4-D_-FQY4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULEkzhRBvD-Zs3RPGZtk14hlVh-WReDfk26qFwXITxmbBBbG-NIApTYu2MHVASKQUg_XcN0znE1fSd2JS9qd_nzuPuDSA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Gq136gYZSlqM4-D_-FQY4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULEkzhRBvD-Zs3RPGZtk14hlVh-WReDfk26qFwXITxmbBBbG-NIApTYu2MHVASKQUg_XcN0znE1fSd2JS9qd_nzuPuDSA
Date: Sat, 17 Apr 2021 19:26:49 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3982
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH09ANXOIjCKgqUbFWOR2ac&google_cver=1&google_push=AQvitUI7vHlfsfIHbnIsNetcY7XpFDGo1hChDe9nHG0sOMohsCzZkNM8J9FTZmbUwRrMyorS1mQ...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OTEtNi1JTkk2&google_push=AQvitUI7vHlfsfIHbnIsNetcY7XpFDGo1hChDe9nHG0sOMohsCzZkNM8J9FTZmbUwRrMyorS1mQ792_OA9Kx3ZFCu4321Tqxp58

170 B
188 B

59ms
58ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OTEtNi1JTkk2&google_push=AQvitUI7vHlfsfIHbnIsNetcY7XpFDGo1hChDe9nHG0sOMohsCzZkNM8J9FTZmbUwRrMyorS1mQ792_OA9Kx3ZFCu4321Tqxp58

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05NNFQ1OTEtNi1JTkk2&google_push=AQvitUI7vHlfsfIHbnIsNetcY7XpFDGo1hChDe9nHG0sOMohsCzZkNM8J9FTZmbUwRrMyorS1mQ792_OA9Kx3ZFCu4321Tqxp58
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3982
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_push=AQvitUK4_mf2IWpi-RSd7iwb4DwHaR_o1fSPGr0136RNYZkaZdi...

170 B
188 B

71ms
70ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_push=AQvitUK4_mf2IWpi-RSd7iwb4DwHaR_o1fSPGr0136RNYZkaZdi_uzfrdNXm4BavrkxwMc9eHkylmypuX5DdzI1rRxsAnnpaFys&google_cver=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 17 Apr 2021 19:26:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHs2eUhM6iSynMkhMIHn2wAAANwAAAIB&google_gid=CAESEAxjP7qRKN9M8yHgNMNWZO8&google_push=AQvitUK4_mf2IWpi-RSd7iwb4DwHaR_o1fSPGr0136RNYZkaZdi_uzfrdNXm4BavrkxwMc9eHkylmypuX5DdzI1rRxsAnnpaFys&google_cver=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 459
Expires: Sat, 17 Apr 2021 19:26:49 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3982
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEGBx7yNBVoViJqBQmFxDd6Y&google_cver=1&google_push=AQvitUJ2ZGTMOo5WMgtfw_pW...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUJ2ZGTMOo5WMgtfw_pWFn122mVbGB2WGmlUXGf7fFbEV1hbQEzzQb6yvrTCR23wS51lvoCu8XMQtc7mQwePB2VRb09Xv6Wp&google_hm=

170 B
188 B

58ms
58ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUJ2ZGTMOo5WMgtfw_pWFn122mVbGB2WGmlUXGf7fFbEV1hbQEzzQb6yvrTCR23wS51lvoCu8XMQtc7mQwePB2VRb09Xv6Wp&google_hm=

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:49 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUJ2ZGTMOo5WMgtfw_pWFn122mVbGB2WGmlUXGf7fFbEV1hbQEzzQb6yvrTCR23wS51lvoCu8XMQtc7mQwePB2VRb09Xv6Wp&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-length: 0
expires: Fri, 16 Apr 2021 19:26:49 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 3982 0
12 B 62ms
53ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JD5Q7-vERPmZpfNBiCf-ZyRD88o2bSmAfswWXw84IjECbJoiISHINp6Qu0S6TQ1mAw0L3CXQ

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js Show response
pagead2.googlesyndication.com/bg/ Frame FD91 14 KB
6 KB 18ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

693a39255f808f38ae64d4daf12a78de32d51bca970b01fb398534e81fb641b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 12:29:47 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 25022
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5682
x-xss-protection: 0
expires: Sun, 17 Apr 2022 12:29:47 GMT

GET
H3-29 200 aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js Show response
pagead2.googlesyndication.com/bg/ Frame 9D2C 14 KB
6 KB 25ms
14ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

693a39255f808f38ae64d4daf12a78de32d51bca970b01fb398534e81fb641b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 12:29:47 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 25022
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5682
x-xss-protection: 0
expires: Sun, 17 Apr 2022 12:29:47 GMT

GET
H3-29 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 49D3 23 KB
9 KB 13ms
12ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8727
date: Sun, 11 Apr 2021 19:50:44 GMT
expires: Mon, 11 Apr 2022 19:50:44 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 516965
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js Show response
pagead2.googlesyndication.com/bg/ Frame 49A1 14 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aTo5JV-AjziuZNTa8Sp43jLVG8qXCwH7OYU06B-2QbM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

693a39255f808f38ae64d4daf12a78de32d51bca970b01fb398534e81fb641b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 12:29:47 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 25022
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5682
x-xss-protection: 0
expires: Sun, 17 Apr 2022 12:29:47 GMT

GET
H3-29 206 file.mp4
r3---sn-4g5ednsz.c.2mdn.net/videoplayback/id/315aa0ca359cef06/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3745905462/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m... Frame 5A80 192 KB
0 14ms
7ms Media
video/mp4 2a00:1450:4001:6c::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
URL: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:6c::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

date: Sat, 17 Apr 2021 19:26:49 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-4470334/4470335
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 4470335
expires: Sat, 17 Apr 2021 19:26:49 GMT
last-modified: Wed, 30 Sep 2020 09:17:42 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
client-protocol: quic

GET
H3-29 200 04GNmuDwX4NjTp5JBnlTI2cBXBmJ_FOcmcCRO2VtSUE.js Show response
pagead2.googlesyndication.com/bg/ Frame 49D3 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/04GNmuDwX4NjTp5JBnlTI2cBXBmJ_FOcmcCRO2VtSUE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3818d9ae0f05f83634e9e490679532367015c1989fc539c99c0913b656d4941

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Apr 2021 14:06:13 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 19236
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5636
x-xss-protection: 0
expires: Sun, 17 Apr 2022 14:06:13 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FD91 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bkdb7eTZ7YJT5B4OZrATC1JiwDgAAAAA4AeAEAg&bg=!hYalhsLNAAZUuIlwVLg7ACkAdvg8WnINnpS_0QyhPbTq6duKKX40f17yBqCaBAj7L9n3cfHmHktVgAIAAAGfUgAAADloAQcKAAGzmQKQwOglVWQo3aNccEoz2kc2gnd0e5W3SGqWAw0PmqvhfgA9I499ppRrHL3oFO57XAfO-Kv1ClAmFvovplth-2i-x9WedT-Dh-2mcvqhAYoTAM-vZWCRLxoP_-XCNYzbUELcfgiYo5HU1YQZl90Db_E8nuOlIGG5y0IyxdS8JXdzcRfNDe-qrdE8ikJLwVuqcvnJFtP329aP7p1P62SGEbJU31gWSCYc1QxXMHuiWlI2lswfWhPcikh27-59Jn0ME_ipBhNzga5nkPXuon_HgK2bHODYouu-hoZf_f13xZwmHVA-i5C9TdZv_3PzFZaXHb3iwucB3u2L9XLswhJsBQMlxqfaj2Nfp5Eow4Xv7Boe5fJ2xjqoToYRt1RdFZYNFClrz5ZD4LB5qkf0fsTIHujeLjhqyHz-Ng85AqPd-6y9MWOsOG5V_98pGY0xjw4Kw_vvLdVDEzn5I_1ip3mKlBo0Ieq9g8UR_zqugZXNqXX_dS7qorZrgTZ9s2fKiYpNuHeXxX7otqsfYk54WNBQ60CovwXZbCjIWo9Y-JamZfBO7K25kRoGTW4NiTbf-VZgQ6ivWF-PpH9WcLIkZx2zGPwbEqis9Gsqm3illO3zX41T6boELd_jXZimW5U39mzERpSLpgEg0Uuj3MFHJYedmDLQb70r7fRB3S1WLLUrbBv9v5jr3OS_u9N_hEFAg7h2EDKSSOfyWVBxc98TMJ7As3R3plTvFXbmwxMQPAueuEsBoMzviNKmC_ycvpyqFgzqqxUCsSvhvZ_lXH7m0auraxAT0Vq5tpVu8Eq7zLRe48MgROBjizSJTFphWRJXmZT3ki0gt_Jl8aREDrFg2dFclLGoAk_vjVrPuCghzlVw5BMWRQ0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D2C 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BrlzQeTZ7YL7nCLTO7_UPgPmewA4AAAAAOAHgBAI&bg=!RkWlRQHNAAZUuIlwVLg7ACkAdvg8WqHyUw0ArvO_t_QutZr3kLhRMPw70CiTJf1q-kYqbEoAqN7l_AIAAAGKUgAAAChoAQcKADGAISa_yv7Z9YUzrZhLaonKWD8ToqopNj6g09CrGp33L2IucT1AKw3kCG7OPFwxTvd0mQLtA7aPvsEYCq00U3a-pm2g8d5MNYDu_Vyuyn2O4pJRyiVtDtUEY2cTpq_8vQFqp4SOlFJn0aYfgiZVa3YIrQu60l2NPrlaqCKSBJ15Tt8j_UWBjW8c4st9cV5IaGLh1FTJgr3m05KVtpRW-d4BStmXBnCV1su5GnoH2opBNnuikgO_7OfkOcmfp0p31aYe_OpgwwmfDXz0BOfy7hrXPXVfStH5-U-wtF6kZGQkMD_4uq2scnYv_U4SY3TlHLYLlITpl_TrdNiDC-leqrlTW1UjWKcN4ZTdCq7F5kEcSVbDmhZJT3fdOlIkvV4paSPpNkirep9l6vlGlvvOaVEbEGJQz6maaCUddTQ3RDfvMB-g_XnEwcUbhfr7WdDdFht4c72magRLgJRwyCebEQZSV69iUS4vuTHkTN99Tst9wz0qd2b1ss_9xHuwNp-9_NgsUtCmUQ6SYB7NPF06cBK3-RmoDxTDtvG2ENQPmnPE0P1LciYCVZumLLII97Qv_y89XvScU1OFwJyx-KTxzW9kDeHG7vElth-ZONLbG0otWvpcuRw8uVeoNeVgJETC7mhDCvSw2UuTf8wowTLYLOTx0RMeBklNcWg6vDoAMCjEtOO86w4tUDcdqdeUR0Eg8dq3iIdDv56-fLo83pSnaXYMpCp_9HvY6CjJp5Gxv5uAqzl970oUz-18TpiyLmDQMJFfI0YPEZORYfwAvM6S_njvxrD_U06xA6nczXqkSsw3XKMXOyCU1kfNpB8xuuXTojZQ9unOjhTu7MRobeLiIstp45p6hEArazvCvk2VIsEyocEXat3xxl5xWz_fwmzgRM2jLbaTI-sia179Jluz1ZAykiqDtklRu9vV5_q3BSXorEjaklgXrkGoNHzHd1pr924icQEgBTg2Puo8dpSXUyD3B6oO8HMrCZt2NLRn9D2rrT1x57RsvIWpF2hMEkI60E4lkcyoU7PSO9m9Ss87qt6tDBb5PQAs5pYcMplhC0kHU7Y

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 49A1 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9rateTZ7YJv4Csj83wPji72gDwAAAAA4AeAEAg&bg=!QkGlQQXNAAZUuIlwVLg7ACkAdvg8WnVc4LshOWrYceS0LGsatPge5vqVzJMip1vNgI5xwYVHejFJwwIAAAGgUgAAAB5oAQcKADW6H1EZHDPsm4TMouZotpxxuhC6VZtnXV46psMferBll3IrT2e7inKDYyI-LRCWIjvBK3dNTJkC3sfUOxYXb6ic5UzXWCp0Vf9PMmSwDfjWT3-TVoqZSeXs830XYe78LFlbScQ6qvdC99vg2xp-5RGvWAW6fRf9y_ntCp-4C-NIUkX2LpeNU0Ltik4Hy-gtP0vVuOctYswZ43bj-pS3p3orFiJXO2Pmv_Bvc4RU-rjF88uiKULd8F4w3FS6pPffkfkFUq77EKqZj9FWWOBfhLNNz9Oq9UQ9fTxjFgW9zueB6169Oyy9-M_IUeJ3it0aDO0UKKN0JHg5EizAa-USsAhNcgSw6hRgsjo42j2ESZuBAyuhLhigTNFk204gztGiZb4AHdFahenJSu4hXcOITXhEtKDzflFOqc0I0z8dK_DuUvtJUBylphzWwRM8dtwM6BrxL0McoPLXUaHMwhiaT8lbdKhR7uhLLAkYUfcwQEj9eQymwRtDM1g4dVpzEUspCiQkPcxn54y5mg0ab1CXwYn2Bu5htcmjNMqgoWTFfOqJX1T6084bF0wXhHQgN5-kPm2fHPZ4YWNMZdATkQ0eAzWsU9wRP0tX1EWFnhlA9Q6oN5qAMVyN-3LFcubMKTJ2Uiodp7EbcpFDGNx3H_kuduB0_4x1LFLgQ3wEe8F5KJsdteI4LGGsDq00a9va_Rjp-R2Ac6xPTW1RjjhotxOsgjljfHbrdDlPN9NTMLspo9Kn6wiC7BtJfFwrxiJ7VKppX2YINs1Wapveo9WV9ZXIMNHRmnfEe8UxX61wjqvnALBC7NZoFE-1LDWL8Xht0XuifoR4rdAbVxzmatXT_eAhcsHGU0j5tDfKGCyR3bNOzt25ThTCkfp2K3vMB959CV7OqqjjJ9KfUWldpeRfBHL-HmiqtgMZvou1fWVygR-XUcOkBtICIG2G_lKZ4eW5mpbXXaIh1ULYULMyNMiQpfakkaGhlVx34VlpYF5u_OSX56hq8uRgvEyg6h8zyYG85MNYhTdg3F7a3LvUszGniI_49zZ3T6ouTTwZ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 49D3 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B8QIKeTZ7YOXnHqW5-waloZToBQAAAAA4AeAEAg&bg=!CQqlCk7NAAZUuIlwVLg7ACkAdvg8Wj3aNTLbmrkXt7fHbAWtykYKLw5xS_iRt9q87iiqUaVmNoJvgwIAAAFCUgAAAAloAQcKALWxiigXUbJgvlL6G9EGIPoQEc1Page0P-jVhKtnH7WBStLzA189KqemPytoAM2VJ7j7nwln-eircd0c2SyrNL7xkczWmg9bZ7mkuUP6JPq5o8JWaCGweUV-2yk6-qPVdC7FeNfRLXoNd_Kq49Otd7K47XPgAddFlCKjVabi5U76CsKxLIuE_ZZkSJ3SytI7F6xEeR0hNzUo0R4Dr9N08c2c2WN2mw7BXes1dY2nmXDibS3IvUXimQKgi7HMTAMpsyof7ldkL3TAJqKOi0f-KqwSVHZ41VlH3sBfg5adYQph_xMUHg9BfIKNbiLXY_jLDhAVfeeeidufDxgOf1fERcHsb0cojqOLTUd5MQKz3GL3KZw_PZ_4fnXidvCXARAWiBsy40y3HCGTr4KNTaChN_6F05f1oNWxY3PuQG9QW9bsQyWEkg-WI8KBHBgPW9x8fWiYOByQjEkgWkpdhD9UYFjyP0afEE3Eh3KrAf8OqnJimtavEScbW2vy_5C4ILu5v0vIw2oXPL-W3KnSaY7mRljXS6Qu1NtNohtigofmQUzVBRO1XAYa0pf1JeZN1kQdawYFi0w4UfCTp2ZGvErPo5LN2o4f36C_-p5IhGpaDH4wiWWWf97lhALUbiLeYmnyb8YJ13aIY2I62G9DlR7NW6rKU7UYAD0SDv_4g5ddbdj9XBoLh9O2ea7CS3jc-nBAvW9tjpzTmBbCt_o_akz0V5J4-fROLDuE-UOGVgcVYbnBCTHQ02WhyQN2-ufrHUwHXKtnSc9P38rTcFx_b7Rl0lexeOEhRDcFib0ZZoqmNuDtu-0rFvXKrEY6fV4bnSIenFP0u6FlESM5M_RzIpyfcNQ2_tyLhCouZkbRVr6MTB-K1zKtIDRgOuoFkJkP3QTNLG3PDgJAkKN3iaS4ImdJ2c5Vz9CuN8rvdvhi-W2jGcuYI5_1ZR0pIIn30LpSgyhenwj_lcsqAfUdcYOFTD2ytb973dl_LBO2aK6NqKGChFcW2aH9u-LENIScvAtkM8MIDT_yNnUm_SrpqOtAn6b0O-ny2ZwsObWn1QQi5FFNBrxMOOaHh88mTYO2YccpMhYsWVK3Goam3ZGAw43HX2EG-vPVO8Bn5TfGEiETpbabAvmyKIxMi9v5eZ9x

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 298F 42 B
64 B 46ms
45ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsukByEG_bzNcSZNGNo8n7RcuVszlEeD8wuL6a-wmyyjSFwkOtcBBXM9J42AroSyX3c_s5wX4fLboxKsNxHXALQMCXJrOMTnggcPGntG0j3eRFFpaXQuqc19h7439g&sai=AMfl-YR9mX_n-h9cZV1r_OG373bw5Q0U0uTZEyrXr81F4SEKfgRFlrzUGz5ltcsaTFa_qjiM5sW-1FvdCxkKgxX5dRmGi7ZaVdjFQY67L6fzVLcdmPWOxD_3bwU0RlE&sig=Cg0ArKJSzFmMWdrFVigYEAE&cid=CAASF-RoJkMYKD7YR5jTLG88APrLsI2xY5aa&id=ampim&o=392,136&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=298&tls=1298&g=100&h=100&tt=1298&r=v&avms=ampa&adk=54240663

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windows-setup-remediations-x64-kb4023057.updatestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D5A1 42 B
64 B 45ms
44ms Fetch
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssgHQkTve_fIae1ojcfM1ZQ-qNTT_RUzlmSBUAzatz4rKYO2r6KIJgWG346DdYy40CWhU3G2S0VgZodkD3V6iXC66P_uIlx3035L4sWZeu6G10V7F2d2sZOxYHwhA&sai=AMfl-YQOUJLFTKoTWwe995QUEc9uz8GgBIJqG3qUNkY7vEkKmyuTSxn8Hfgk7uUa1GJCu1OCqHWKzMAbIwHwJLt114e_FT22JCjEYQRmU7iKx2ATQNs6u5A3NSjNewY&sig=Cg0ArKJSzGSKF2rxbsQmEAE&cid=CAASEuRoNroesVOy3ZIPHODcKM-J8g&id=lidar2&mcvt=1001&p=536,1046,790,1346&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20210414&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=1989851401&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1618687609024&dlt=98&rpt=1&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4945 42 B
64 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvFU_zsP1yPJeVxLBIwoKBROUMEkpGboIe_69l1ozxdzsY7I7tZI6hd6LsVXN1o0--1QziUkgiRNiv57ex8JY6gjeQsvuULIqL_wXO3iwicAZsc1fIU6mbtiY5MTw&sai=AMfl-YThniIJg0XWZVaBdNfGN3ieF6VX53rz-WY2vhGwmGoe0s5K5Enj2smACE9KOz7V69QwaT8JiH06C9ZNKZl_AV24026vU2F4TOWBzijoTSQx1NRLa9S-WnRBUrE&sig=Cg0ArKJSzDHlQf5ZyynKEAE&cid=CAASEuRoqC6Z1iOCGPaKU2a4D29_6Q&id=lidar2&mcvt=1001&p=836,1046,1090,1346&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20210414&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=3518012090&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1618687609026&dlt=132&rpt=0&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 24CA 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssTsSvi9wELJZx3pYv6sWWVkMsOQKH8eibQU228L-peFV8CJb14KUbRpwdorYjFs5bw_kvzCiluvEQSz7ihPA7WrnWmhPPr-D7IGET9Y-8KR8LWHr_FTrr5OdDrCA&sai=AMfl-YTzNfSB0T0IuuB0Re2FMs_uWesFGagvOK38u7Ne4WTipDCQ4EuHEUOLfbpJtbXDrQWtMh3YDpB9DwTBa3Vtm_KyxPRSOe5O4z_9nhOJUqjM-vE6HTcDuRf78gM&sig=Cg0ArKJSzBViv_oxE-WrEAE&cid=CAASEuRo6C1mnwgmhu1ECj8iwPE_ng&id=lidar2&mcvt=1000&p=526,191,1130,351&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210414&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&app=0&itpl=20&adk=2459160219&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1618687608896&dlt=136&rpt=1&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 5A80 0
17 B 39ms
25ms Ping
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~knm4t4vt&c=6470332669639&slotId=3235166334819.5&qqid=CJfk5Z6BhvACFZa8ewodMl8How&fb=outstream-lima&gpm_i=12&gpm_c=12&gpm_a=12&smb=1000&br=995&mt=video%2Fmp4&vs=640x360&ulv=1&cll=0&vmfc=18&vhc=0&msm=1&aits=17%2C36%2C18%2C22%2C37%2C59%2C342%2C343%2C344%2C345%2C346%2C347%2C692%2C43%2C44%2C45%2C46%2C0&webm=3&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fwebm%2Cvideo%2Fwebm%2Cvideo%2Fwebm&hvmf=false&vms=1&bit=343&vsrc=doubleclick_dmm&ape=1&ple=0&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210414_RC00/outstream.min.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 17 Apr 2021 19:26:50 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.updatestar.com/	1970-01-20 02:59:43	Name: __gads Value: ID=70850ed4e4c6ecfc-22e720bc92a70015:T=1618687607:RT=1618687607:S=ALNI_MaunKJd0jRi2ieG79S693RQheHaCA
.doubleclick.net/	1970-01-20 02:59:43	Name: IDE Value: AHWqTUmir1-c04G0ho69UM33evkYclFstAVFPs2kXQP2PsUMai7rYGCgAj-VI3X0zSA
.updatestar.com/	1970-01-19 17:38:07	Name: _gat Value: 1
.updatestar.com/	1970-01-19 17:39:34	Name: _gid Value: GA1.2.467462536.1618687607
.updatestar.com/	1970-01-20 11:09:19	Name: _ga Value: GA1.2.458093147.1618687607

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2103020108001 https://windows-setup-remediations-x64-kb4023057.updatestar.com/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
ajax.googleapis.com
bid.g.doubleclick.net
cdn.ampproject.org
cm.g.doubleclick.net
cms.quantserve.com
csi.gstatic.com
dsum-sec.casalemedia.com
f8775736fb7680127ca328132a754abe.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
gcdn.2mdn.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
ib.adnxs.com
id.rlcdn.com
image6.pubmatic.com
imasdk.googleapis.com
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
partners.tremorhub.com
pixel.rubiconproject.com
r3---sn-4g5ednsz.c.2mdn.net
rtb.openx.net
s0.2mdn.net
securepubads.g.doubleclick.net
ssum-sec.casalemedia.com
stats.g.doubleclick.net
sync.search.spotxchange.com
sync.teads.tv
tpc.googlesyndication.com
us-u.openx.net
w2.updatestar.com
windows-setup-remediations-x64-kb4023057.updatestar.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.gstatic.com
www.updatestar.com
104.108.145.8
104.111.242.245
142.250.185.130
142.250.186.130
142.250.186.98
185.64.190.78
185.94.180.126
2600:1f18:612b:4232:380b:6483:6fb1:583d
2620:116:800d:21:36a9:ecb:e518:b308
2a00:1450:4001:6c::8
2a00:1450:4001:800::2002
2a00:1450:4001:803::200a
2a00:1450:4001:808::2001
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::200a
2a00:1450:4001:811::2001
2a00:1450:4001:812::2003
2a00:1450:4001:812::200e
2a00:1450:4001:813::200a
2a00:1450:4001:827::2002
2a00:1450:4001:827::2004
2a00:1450:4001:828::2003
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::2006
2a00:1450:400c:c0d::9b
2a01:488:67:1000:523:fd96:0:1
2a01:488:67:1000:5bfa:5108:0:1
2a05:d01c:1d8:8100:1c45:c4d6:f2b8:9306
34.98.67.61
35.227.252.103
35.244.159.8
35.244.174.68
37.252.173.62
64.233.167.154
69.173.144.139
79.137.69.91
0701062315db741bfead2f54f7fc780406199066f0c86c8841c010a3cf28ae24
090aa1a441c5d0a8f32cddd6096f2624f223bb0ef495598ef75e205a90c258a6
0ad9afc00b9bbda56877958b80a8ef7f850dd2a4960c2fb298c79c8578eb4f6a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
1152be785978aa809034ab61de86ce4d03c5a301c95e96995e336d2462832a10
11d5cc5bb3db6c56fb91f9068e7f4741f6212c8e2e5546b17039c1c58720fb83
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
166a4ec3cb90d525f7f744c7616c01b36bebd6dcecd486c8f5be14ccc0a7b3da
171b6e355c235e58754a27d900371770b434e5093e5bf7a9d2a8b912e6cdbbd6
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
21d45a4ed77653b3b1ee2b47a786a4dbb936a3b19fc56e1b44c16aed35eb80ee
231064110361844d6320331a5c35979c2a492a546604d97181eb6cf7aa4ae1cd
283652e99752eb1b23ac025393eadcfbd463292066f6a4d3523d02ae83b5b208
30928d56339eb13baf78412546f54a0c88c666e812e24af89c47b0d04280682b
30bed512ee77840bcbb79d3f1b3c4b56931d84f4d0446c12b5175a4e016a75d9
31e420b79e7760a7860ed2fb595c4f11b498559791571fed7eb22be20c7fa5e3
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
398b4849b670aa5659a8fe1d8a925591d3c581176db6313a9ef7208d77310ede
3e077843080165a011c30f8b8c924b246089c9a8745bf8301c8edf143b990fc5
48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7
4980081661d8bdc7873b8dff4e3694aa28adb873ad95a4616e671c6a9bf0e456
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4aa6b1d79aed1a91a36a83aa694f8883032e674ad428b5d6e2e9eb432e89dd05
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c6af60796cc240ad277098308cf363c2700f5296264ec1b43b4e1362763c439
4ce4d3e7b658426e6172ad2bd9ebff862b0c6d79a7e37f231c5cbb9863b7e2de
4d8f412282d8066bb35295f8f4a335f70276d365c152267bb77b1451063aef67
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
52eb3461764bc72867e3ae26f0f1ede92d99f9e351e6dbb06614bba4bd75bf0c
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5f52a2a4fd74335cf7c2e88aacea3f12fde14f83fbe3c8a666ebedfb795bd2f4
6566c2fd04425e23474c3c6fa04f5556d2c8fc40229553e69d67428b93821d2f
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
693a39255f808f38ae64d4daf12a78de32d51bca970b01fb398534e81fb641b3
6e553b4e88ac4a1819d608fe9dcb46544ca5fb776d4e0c84d773f37b1df18211
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
736b2675b897706a6ec7ca1e246a62362dd57daef3d71b4c5e4d7c4aebd50828
74e1cf077493c33fe895c7ce5732cda76b195e2d357d928f094bc3367cc7a75f
7599e0a5ce1ba2a12f036e998e19e60b6e982178e4363d4630ab3a91ca73bf62
76d293cad87de584b5105472b9672fb1460dcf35f82079e274e44a47860bf700
789a93f4315357995e96053e32ee793d6b12f592fad617bb04f795c750f0c3bf
798171b8ceb888e1d1d3238b97615fb257b7cd981659b2f1119f7e5545b37ed7
7b61158c957782546cc1ccfad539a099955dd6fb8991af678f5bb4f56ac834fc
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8258bb34dad58a914df8656951e209095425f9e97ef34c285850534870956a81
83255723be76a8574abc6aee2787abebdcfbaa6181b3adfa9acf87561062ff8d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
89555f8516be696ecc1157f52331730b4000680c9aae8341f0500981940a264c
8d533af61758c8947ccc7cd5dda53a8ac1b61e299644bfd7a6181c4756d93d01
8f9560479a05fb86854546c40ec030edc2bac692d4142391d69b16e5c033a185
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
96f9f8ad97a1c1d208b350effcf9cc86c9da739ac3e5fb9ebb145a2d15c4416f
98aa21f37c7c33954b30ef5586e103e1e07cfdeb899a8dbf2e07b8bbfff6fd97
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2ce29ef0387dbb94fa1b193f97d25f34ed6616fa062130e6f2b4f947a40bb07
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a
a6f768cbb894f2690011ee62662d3ac9480d12f5088fa46be57e650fcc4d835c
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a9a2626d6b1d0fb3f24fddcadf96b79a9c107ccaa5250b1885ba11f922ec0e40
aadcecc199f6c06fc8c727313c974924c5883da2c246910bd465bb6bec9153f0
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aeef6f2fa6044cadada5782a968531ac7b2a0207e741d67671e441b1fc5a656d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b816668594e35fd9456a9b017f3a1496506cb22763392958396b8edb1d1b0fd9
bdcc0895910efb7613d6b32a61ddd3a0ea248d74c871b9e12e6cfd674130902d
bedddb3e8da114412602440e01aa8122a149527f3f30859c276f5efa31ecb7e6
bee022a4099fdb924d19ba7cdd46c87f30d360ccf955a7fdcb45f8f83ddf4b2b
c10dc19e6af1691814a11c57928e5c27b7c379fdb6842c7bfe8cd4237ab0c441
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
cf89e3b0bbe8bc280b453823d44c9754dfd495fe7c03064938eda5d00c79012d
d04fe3e6d57be524334f1688f690be20fb65e09d806c549e1f78aa8d3f7dbae7
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d1aad7a983d9b2bdcc158d96f17db24a864603727d954ad3afe8a188f20c179d
d2419d4e5984bce677a9766c89661f11b1a0097b37a9d6b42c3be6413f3af899
d3818d9ae0f05f83634e9e490679532367015c1989fc539c99c0913b656d4941
d538b0d8a37f89edf8ca7adb41c50ee0339b7852cc46fd2c5f8900907cb6e218
dad2ac3f093b8cdcca3bfce4fb4d0d7c2e72bd3247ea05ec5e383559d4c3a77f
df459cee9ec384ffb36fe3bd30be6223768026a9504aabfcb20f3591b560f118
e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e7a22b586532669e3e86d019c3faa366bb89af54fea98c28eb526415d01990a7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef398d5b03e57f4b4428d8a75e8dc57c6e7f07795f2fae93973f67bcdd5c737e
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4

windows-setup-remediations-x64-kb4023057.updatestar.com Open in urlscan Pro 2a01:488:67:1000:523:fd96:0:1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

199 Requests

100 %HTTPS

64 %IPv6

25 Domains

44 Subdomains

38 IPs

5 Countries

1497 kBTransfer

4059 kBSize

5 Cookies

75 Outgoing links

Redirected requests

199 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

windows-setup-remediations-x64-kb4023057.updatestar.com Open in urlscan Pro
2a01:488:67:1000:523:fd96:0:1 Public Scan

Screenshot
Live screenshot

Full Image

199
Requests

100 %
HTTPS

64 %
IPv6

25
Domains

44
Subdomains

38
IPs

5
Countries

1497 kB
Transfer

4059 kB
Size

5
Cookies

199 HTTP transactions
6 data transactions