www.edocr.com Open in urlscan Pro
54.225.57.142 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Submission: On January 14 via manual (January 14th 2022, 3:10:45 pm UTC) from US — Scanned from DE

Summary HTTP 112 Redirects Behaviour Indicators

Summary

This website contacted 32 IPs in 5 countries across 21 domains to perform 112 HTTP transactions. The main IP is 54.225.57.142, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.edocr.com.
TLS certificate: Issued by Amazon on April 28th 2021. Valid for: a year.

This is the only time www.edocr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	54.225.57.142 54.225.57.142	14618 (AMAZON-AES) (AMAZON-AES)
10	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:2638:1::2 2a02:2638:1::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a02:2638:1::11 2a02:2638:1::11	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	185.29.132.242 185.29.132.242	30419 (MEDIAMATH...) (MEDIAMATH-INC)
4	138.201.63.149 138.201.63.149	24940 (HETZNER-AS) (HETZNER-AS)
1	104.79.88.164 104.79.88.164	16625 (AKAMAI-AS) (AKAMAI-AS)
3	138.201.84.252 138.201.84.252	24940 (HETZNER-AS) (HETZNER-AS)
2 2	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
1	88.198.250.30 88.198.250.30	24940 (HETZNER-AS) (HETZNER-AS)
2	46.236.13.147 46.236.13.147	12703 (PULSANT-AS) (PULSANT-AS)
1 2	142.250.186.134 142.250.186.134	15169 (GOOGLE) (GOOGLE)
1 1	94.23.99.218 94.23.99.218	16276 (OVH) (OVH)
1	54.76.176.197 54.76.176.197	16509 (AMAZON-02) (AMAZON-02)
1	104.92.94.3 104.92.94.3	16625 (AKAMAI-AS) (AKAMAI-AS)
14	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.2.148 178.250.2.148	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	178.250.2.135 178.250.2.135	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	178.250.0.162 178.250.0.162	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	18.66.248.39 18.66.248.39	16509 (AMAZON-02) (AMAZON-02)
2	34.242.207.34 34.242.207.34	16509 (AMAZON-02) (AMAZON-02)
112	32

10 54.225.57.142 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-57-142.compute-1.amazonaws.com

www.edocr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::11 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.132.242 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.149 (Hockenheim, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.149.63.201.138.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.79.88.164 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-79-88-164.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 138.201.84.252 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.252.84.201.138.clients.your-server.de

hal900024.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 145.239.193.130 (France) 2 redirects

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.198.250.30 (Mannheim, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88-198-250-30.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.236.13.147 (United Kingdom)

ASN12703 (PULSANT-AS, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f6.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.23.99.218 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip218.ip-94-23-99.eu

medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.176.197 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com

ad-server.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.92.94.3 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-94-3.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.148 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 178.250.2.135 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.am5.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.250.0.162 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-39.dus51.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.242.207.34 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-242-207-34.eu-west-1.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	criteo.net static.criteo.net — Cisco Umbrella Rank: 587 pix.eu.criteo.net — Cisco Umbrella Rank: 7190 csm.eu.criteo.net — Cisco Umbrella Rank: 7303	485 KB
19	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 94 tpc.googlesyndication.com — Cisco Umbrella Rank: 127	209 KB
10	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 44 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 70719	35 KB
10	edocr.com www.edocr.com	677 KB
7	redintelligence.net hal9000.redintelligence.net — Cisco Umbrella Rank: 27409 hal900024.redintelligence.net — Cisco Umbrella Rank: 166706	56 KB
6	gstatic.com fonts.gstatic.com	207 KB
6	criteo.com rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 11592 ads.eu.criteo.com — Cisco Umbrella Rank: 7328 cat.nl.eu.criteo.com — Cisco Umbrella Rank: 9529 rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 12937	103 KB
4	mathtag.com tags.mathtag.com — Cisco Umbrella Rank: 3328 pixel.mathtag.com — Cisco Umbrella Rank: 1039	3 KB
3	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 18477 api.webgains.io — Cisco Umbrella Rank: 52909	51 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 37	2 KB
3	medialead.de 3 redirects pv.medialead.de — Cisco Umbrella Rank: 42689 medialead.de — Cisco Umbrella Rank: 41904	2 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 151	112 KB
3	google.com adservice.google.com — Cisco Umbrella Rank: 69 www.google.com — Cisco Umbrella Rank: 8	2 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 202	10 KB
2	webgains.com track.webgains.com — Cisco Umbrella Rank: 41628	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33	20 KB
1	awin1.com www.awin1.com — Cisco Umbrella Rank: 12936	702 B
1	ad-server.eu ad-server.eu — Cisco Umbrella Rank: 55305	312 B
1	media01.eu pb.media01.eu — Cisco Umbrella Rank: 41136	629 B
1	google.de adservice.google.de — Cisco Umbrella Rank: 8579	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 745	642 B
112	21

	Domain	Requested by
14	static.criteo.net	ads.eu.criteo.com
10	pix.eu.criteo.net	ads.eu.criteo.com
10	pagead2.googlesyndication.com	www.edocr.com pagead2.googlesyndication.com tpc.googlesyndication.com www.googletagservices.com
10	www.edocr.com	www.edocr.com
9	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
8	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.edocr.com
6	fonts.gstatic.com	fonts.googleapis.com
4	csm.eu.criteo.net	ads.eu.criteo.com
4	hal9000.redintelligence.net	www.edocr.com hal900024.redintelligence.net
3	fonts.googleapis.com	hal900024.redintelligence.net cdnjs.cloudflare.com
3	hal900024.redintelligence.net	hal9000.redintelligence.net hal900024.redintelligence.net
3	tags.mathtag.com	googleads.g.doubleclick.net tags.mathtag.com
3	www.googletagservices.com	googleads.g.doubleclick.net
2	api.webgains.io	analytics.webgains.io
2	cdnjs.cloudflare.com	ads.eu.criteo.com
2	cat.nl.eu.criteo.com	ads.eu.criteo.com
2	5994599.fls.doubleclick.net	1 redirects www.edocr.com
2	track.webgains.com	www.edocr.com googleads.g.doubleclick.net
2	pv.medialead.de	2 redirects
2	ads.eu.criteo.com	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com 5994599.fls.doubleclick.net
2	www.google-analytics.com	www.edocr.com www.google-analytics.com
1	analytics.webgains.io	track.webgains.com
1	rtb.fr.eu.criteo.com	googleads.g.doubleclick.net
1	www.awin1.com	googleads.g.doubleclick.net
1	ad-server.eu	googleads.g.doubleclick.net
1	medialead.de	1 redirects
1	pb.media01.eu	hal900024.redintelligence.net
1	pixel.mathtag.com	tags.mathtag.com
1	rtb.nl.eu.criteo.com	googleads.g.doubleclick.net
1	www.google.com	tpc.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
112	33

This site contains no links.

Subject Issuer	Validity	Valid
edocr.com Amazon	`2021-04-28` - `2022-05-27`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-09` - `2022-04-06`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-09` - `2022-04-10`	3 months	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2020-04-15` - `2022-04-22`	2 years	crt.sh
redintelligence.net R3	`2021-12-21` - `2022-03-21`	3 months	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2021-06-29` - `2022-07-07`	a year	crt.sh
*.media01.eu RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-05-27` - `2022-05-27`	a year	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-20` - `2022-06-20`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2021-06-11` - `2022-06-16`	a year	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-12-01` - `2022-02-24`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-12-01` - `2022-02-25`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-09` - `2022-04-04`	3 months	crt.sh
*.webgains.io Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh

This page contains 14 frames:

Primary Page: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Frame ID: 4F28B008AF4EA0A979666DBDDCD504A8
Requests: 25 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/zrt_lookup.html
Frame ID: 3A21AD08F0E2C60898CE0D3CAE9A644D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1642173039&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039274&bpp=6&bdt=1247&idt=91&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&correlator=3120942988240&frm=20&pv=2&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MMrJir168Y&p=https%3A//www.edocr.com&dtd=110
Frame ID: EDCD48C876D236D15F4E9691836FEBF5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1642173039&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039280&bpp=1&bdt=1253&idt=113&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xMyATMZ2vN&p=https%3A//www.edocr.com&dtd=119
Frame ID: B51793FCB22665F26BA197FB4BC186B3
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1642173039&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039281&bpp=1&bdt=1253&idt=120&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XqSEYM7tkn&p=https%3A//www.edocr.com&dtd=126
Frame ID: AC24F665E853F6CEB647D1B056516B68
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&adk=1812271804&adf=3025194257&lmt=1642173039&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039303&bpp=1&bdt=1276&idt=106&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600%2C300x250&nras=1&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=111
Frame ID: 07EC978848AC96FB38F82FCDB1E59F93
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 6AEF470DCECC34AFAAE95A87B82AB33F
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 8FA44C6922A2DED55AC678C25FC1B321
Requests: 2 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YeGSbwAGftYKixBjAAZVcgpe-ttFtDaEJ-Xldw&u=%7CuDOJbdwQKOsqCzxgeDETjpafEtPKYtl9VOrPEPoml0M%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy2QKiI0Jg3g86PgOGRgROWFgpFKq1sL1Y1SGqocTupFIbxJuEeiJnLLOKVnlebt8fC-xBaF9JxV9WNzqVvYSu-G2wIr6wSOypY_U_3TzN8NXWKuK1-TzOw986kXNrnq83VF6Vi_7fhNqdFEReTojec4N7XrPivlYoG1HBeWwPu6pqttc9VlHZQou08cKLlj-TUQuv8L53P3DuwU636KQkFDCoVaIl6mKh6TKqHFuBpueqHaLY-3KDuOKxXD1PvJTSK-xZ06Sed0jctF21BkZIKfX9JvbSXHEwT27mYH4Xnbt1OUHDrO_Jd1G_VSOredAGFWmWF1Y6lgaXMwbrUDQbSe4Xkll7aIzkbVri8WuunGW4x8HsCyybvVNO0ys6qRMs4QPm6DXlKXN&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9qYJb5LhYdb9GeOgrATyqpnQBsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAulfGhjoOLM-qAMBqgT9AU_QQmjBFhVH4NwaNwG5x_ZYWmN64r0NY1I3ZojlNY12imd_NWaMUXdQmQ7UewVX4dA-B7NYW3NGlMVhuX_DYyud3XxnDpGTNc8-mPS-QqIKCAu_iV6LyY7J2C-a1E9DHnXHnm2_L0VDwb_8uZ3Gw5t6GWjDuw4ewjMLa-vbY3rqXqt1vRTagn8t0EhskXlOQXU1cnxJUsVikeC1NjWyh7RJGAJu9e1ThyDHBcbqpHRnMbgZK3Bl8GHPTHiIHyorQgzny2Eiepcnei807Gv4Gi1HLafXJsXc1lJNS884OKO7lmFd5gXbpdEU2VgC_7rDraw3LYx0uOQXs5AgRzWABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0QrQQEIpnVXXMthwXhvYRAFJVZCg%26client%3Dca-pub-6933461940627641%26adurl%3D
Frame ID: A07D8E603C0A74FE4E05F33E82F84F16
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CNHGQb5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIECT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwOpVB-t1UuhMd7nPaqnItbj339ex_o6bG2bR3AorKUAr9YvGFiUTCABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi02OTMzNDYxOTQwNjI3NjQxGAA&sigh=v0efeflZdtw&uach_m=[UACH]&cid=CAQSGwCNIrLM2-9L5z5dbrySOGZ26Ju2OKP0lVeSqRgB&tpd=AGWhJmtb2YJeobw-mJAD2Bdi7uwCdf-SIEiB5RWXjBO9L1FW8MF0_FEgJEYRBiJlSQgw3jGrAXuVjwYngtXDHAhLvczWjXOnUG5tLMiNeUXMQ2oaOfIOvfNVaeWObcr2zaRqx1Vv9EzxdK6aaWcP_yhBg1JjL2sXZPv2_eCJNPzRwhpZ-j6-2smawZtGEZowaY_R2dK6DmETh30LYbzCw7v6wVBBM_qQYZ-RXeExD5leGpuees9nA7xPEqe8i9yP-9a79GG0rBs3ErE4QCrXM_0z5QkSMM_7J7RN1mRcNZ_OyNuPuLYUIumoBMS8MrZ4gTmPAXWkUfdSFkfzLkqsUHIdwsoe9Cm25PQ_i7jyBNH011RjjZ7wwYmkbso9k21ddTdbMv5d3_jxSZGONUElLVcoNTZwBwFDG674w53oZpszT5q9YSs1PaKdugWtUrvpMwxGpK3uLbjCuZ5LTDh3zZEQAE16EGLZSNYKFMhjE8TsYwgaGdfRcq12ZE_6CmzrTMV4yN-aGX2Q5vZj7BPnvtBvUwCEhWQ0_9STORaIOBXfn8L4K2BQKABMfn90hbAnWYc5sJ6ID03rewjhSNe4Du6g3-GcbGNmOSQqdkMb3-FiLBuNscF8dR5IvnG0wQTixm-2VK0NrJJzYUyuWPYnwfABXc9XKwBVk5qWHNUokCwT0McBnCThjsxVgs8Ugno8OorUaTOBNAbPkhfROsSBQEjPfbbyktJZWCOxJPUNTO0ui4tt-FfGQkg2bVeHGMQZDEarnToNt6flYExfxVODlobmXJCKyCZnHqeS1yF8ZbgbQdVuo-pVXiGsS3-cxbjHs3cfYAo4j27cugZb10XfFKOcLZgIcUZ_FD0Sr9Wc_TLhu_7d1ucIHB4yWC7BnqSYPhtQ4WCOy3NLZN5LsYnrAFrgTAtNo7EcLoFKtpatRJQVEd4RBjakGeeUxzbwhNs4_OwuJ73vWynmFvvPyoUaIVpas5X5s0bCbG3UPKw97Urb06nhskUf5DZ9UBmQ6gqGS90kr-wMsn23eDDXHrNYDst9AwkSshj9sPo-qiQq3iqgWhvvU_jBF2vVe9jMB9zd4L6rIueguek
Frame ID: 6C4E4F4EFB7A5084F98AFCFE9D5B0709
Requests: 17 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29179900146482200951393011839024&actionid=879111&produktid=ratenkredit&dt_url=
Frame ID: 7F05AC72C4B768C4396BCCEAEB463F1F
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429
Frame ID: 61D9BC3DF2B156089C591CFF28CBFF08
Requests: 2 HTTP requests in this frame

Frame: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783
Frame ID: 24E1C1955AE568547B2D7A895BE17FAC
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YeGSbwAHvR4KW9kNAA8mfW9UTiakvKi_cCV1vQ&u=%7CuDOJbdwQKOubmwVe6o8Kyndbo%2BvOVZgsgFqa9IASYtM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_ArHr9DlvVwUA0Lh10Pk2WlfeyBMX_as4AVFYMbMe0Cm1ZebXXvkDDWgG2x364uPFj0_-eVko8FvBPEjWZglhP49yFKeAFA3XoT7DPBg4qHdruifTUE6vUqvwV17N_YdfIEkF0UYM1_Nx0mriIpceZQsJ9XGh1wriu15ABdYq-wN619F-YLwvdyvXVzdbG1Jn6DruC49xrwyrdqeIBByT1E1lOMAC-r3_sauDFh0INFBs2Epl1iNxqbNgOJs_1J5A674NNaTCZw8igBTu6pfLmaNgJGagHtfVF0mbW2SCGQVwIWyInCw6Jm7wpE4tuXJdXNBd33BUrEvlZXCkrxOf5bp8qCZM9kikjolWQbxx61XNW1k3nsJ_wj-2PFan4TeRrjc9FoTf3trsqv5kC13dX6y-HCAExIsPAoDE5DL6zgt0v4n3W0v84PpauRwUzLQV6&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9Lsbb5LhYZ76Ho2y7wL9zLyABsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAsi3KyDvNrM-qAMBqgT9AU_QzX6l_AeNys96vynXkfRjfY4kreZnROsPD0S5Y1nJ2NhZLYQmr1ZqVXYf6UInZPISnYjeTxgAeRPXRNifMD9Dz9Yq-whEdhW7Ab0p9Xt8RUitgri8JA89d3SdylNAV8v_RM6B9-sgES5SQhYr-c4ERDewN8NfIMrWAw7ExxGFRyweK5lEUIpPUoKqO2U_9f2KyMx3u-7A1gU8BwYrjkyYJeLjqOweKB2Fn3L2KHoRoqI-NrS0im7H9PmRSZQiLX0kxwAloz9YQYnW8KBctkRaJ38r2B7CjYsaxyuqjzbL5mpaJPKbgVXzT72dFd39Y9czPf1wg3HvoCvIbXiABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1aGAJFik9lh-vrUljLKjME-WBZOg%26client%3Dca-pub-6933461940627641%26adurl%3D
Frame ID: ADFA6CF72212DDAC505F48F9E9349859
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

20 or so Tax Preparation Challenges for 2021 Filings | edocr

Detected technologies

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

Page Statistics

112
Requests

99 %
HTTPS

45 %
IPv6

21
Domains

33
Subdomains

32
IPs

5
Countries

1989 kB
Transfer

4725 kB
Size

12
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=29179900146482200951393011839024&t=htlp HTTP 301
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29179900146482200951393011839024&actionid=879111&produktid=ratenkredit&dt_url=

Request Chain 47

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429

Request Chain 49

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=29179900146482200951393011839024 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=29179900146482200951393011839024 HTTP 301
https://ad-server.eu/wm/pb/native.png

112 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 20-or-so-tax-preparation-challenges-for-2021-filin Show response
www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/ 8 KB
3 KB 521ms
163ms Document
text/html 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

/ Express

Resource Hash

3c277256b42c586f5f19476ebce11abf573c7a01f4f70681e7302881acb7ac5b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

build-number: 2280
content-encoding: gzip
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=utf-8
date: Fri, 14 Jan 2022 15:10:37 GMT
etag: W/"2095-eNBXcIEDs7L/0ny6F7ohJqENWgE"
vary: Accept-Encoding
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 95ms
50ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d369bd02b4d5c049ddb47d0982f912d558604c4a61b682dbb87f1342ac3a7f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52011
x-xss-protection: 0
server: cafe
etag: 8460435907775193935
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 15:10:38 GMT

GET
H/1.1 200
OK main.00f291007fc7948c83c0.css
www.edocr.com/v/static/ 2 KB
1 KB 112ms
111ms Stylesheet
text/css 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/static/main.00f291007fc7948c83c0.css

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

/ Express

Resource Hash

65e4e63638e9c69fe634cc25b595b20afe3e704f5eb8adf36a551e3c23a12ecf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
etag: W/"814-17e554b2880"
last-modified: Thu, 13 Jan 2022 21:14:56 GMT
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
date: Fri, 14 Jan 2022 15:10:38 GMT
Connection: keep-alive
accept-ranges: bytes
transfer-encoding: chunked
build-number: 2280

GET
H/1.1 200
OK bundle.js Show response
www.edocr.com/v/static/ 2 MB
574 KB 230ms
117ms Script
application/javascript 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/static/bundle.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

/ Express

Resource Hash

0c0af274ff36ebfef2efb3b7d9cee518cfa39b65b4d64bfabe810382fc73d9e7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
etag: W/"20d5e5-17e55584ca0"
last-modified: Thu, 13 Jan 2022 21:29:17 GMT
x-powered-by: Express
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
date: Fri, 14 Jan 2022 15:10:38 GMT
Connection: keep-alive
accept-ranges: bytes
transfer-encoding: chunked
build-number: 2280

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 61ms
15ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 5744
date: Fri, 14 Jan 2022 13:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 14 Jan 2022 15:34:54 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
206 B 25ms
23ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=2025638533&t=pageview&_s=1&dl=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&ul=en-us&de=UTF-8&dt=20%20or%20so%20Tax%20Preparation%20Challenges%20for%202021%20Filings%20%7C%20edocr&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1271297773&gjid=1415255502&cid=1881395037.1642173038&tid=UA-160144-46&_gid=1270449692.1642173038&_r=1&_slc=1&z=1910666539

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.edocr.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.edocr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/ Frame 3A21 11 KB
5 KB 37ms
8ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Fri, 14 Jan 2022 01:57:44 GMT
expires: Fri, 28 Jan 2022 01:57:44 GMT
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
age: 47574
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK wrnje4ow Show response
www.edocr.com/api-user/viewingSession/ 3 KB
2 KB 221ms
221ms XHR
application/json 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/api-user/viewingSession/wrnje4ow?isEmbed=false

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

/ Express

Resource Hash

2f51b5ea9198bf2982f667857005c8550ed774c38421d90f0c42cfbeb3952b86

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
etag: W/"c03-MZuMvlsLDjiv0Do6W/eoruT6dqg"
x-powered-by: Express
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
Connection: keep-alive
transfer-encoding: chunked
build-number: 2280

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201040101/ 282 KB
101 KB 52ms
37ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6933461940627641&plah=www.edocr.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1cb69ec86bd33b94a22e035197e624c229073421bb6084e7a3c7c56d911ca24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103759
x-xss-protection: 0
server: cafe
etag: 12930138881250371498
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 15:10:39 GMT

GET
H/1.1 200
OK restrictions Show response
www.edocr.com/pas/v2/ViewingSessions/ai035OiIxyQAavPMesL-Ug/ 226 B
566 B 537ms
537ms XHR
application/json 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/v2/ViewingSessions/ai035OiIxyQAavPMesL-Ug/restrictions

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

b1ba9fa4ad8fdf667f000a62ef0aebcd3b169d9e70a0e7079072471016139c68

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Gid: bOHzMDAXVsPv63cVBgpuBA
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: application/json
Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
server: nginx
x-powered-by: Express
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
Content-Length: 125
build-number: 2280

GET
H/1.1 200
OK 0 Show response
www.edocr.com/pas/Page/q/ 54 KB
25 KB 499ms
498ms XHR
image/svg+xml 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/0?DocumentID=uai035OiIxyQAavPMesL-Ug&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

ebe11d297f467a1240e7252693f94fce732ab9d7b989fc2f86aaba0a01ae8280

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Accusoft-Gid: A5GQcAfAVwTSJLMWb5fhRg
Accept-Language: de-DE,de;q=0.9
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
content-security-policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2280

GET
DATA 200
OK truncated
/ 1 KB
1 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8657baaa6b95a17c934001c3338f3cdff05bf8ce67ffe25c3b7ab53cd580241

Request headers

Referer
Origin: https://www.edocr.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 213 B
642 B 49ms
16ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.edocr.com&callback=_gfp_s_&client=ca-pub-6933461940627641

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6933461940627641&plah=www.edocr.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

f4ee0487330158d80f5bcceacae1fcadcd06bdfc2792f4f5e9bd664a3fedd23d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 197
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 46ms
17ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.edocr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 46ms
18ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.edocr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EDCD 28 KB
11 KB 158ms
138ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1642173039&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039274&bpp=6&bdt=1247&idt=91&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&correlator=3120942988240&frm=20&pv=2&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MMrJir168Y&p=https%3A//www.edocr.com&dtd=110

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21af7cc79ad4fc6414950257e806c8732ddf9224ad00d68ed96e071916c3d8a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 14 Jan 2022 15:10:39 GMT
server: cafe
content-length: 10874
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 14 Jan 2022 15:10:39 GMT
cache-control: private

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 42ms
23ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220112&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ab91b660573fdf58c8d972f31e254d912af092d75721bd93ee531981639f5712

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8700
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B517 22 KB
9 KB 776ms
772ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1642173039&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039280&bpp=1&bdt=1253&idt=113&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xMyATMZ2vN&p=https%3A//www.edocr.com&dtd=119

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aebb80b8612fcb3fa0fd280b6f68d10fee0e5e6d6ffc0de356223b7301e715e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 14 Jan 2022 15:10:40 GMT
server: cafe
content-length: 9430
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 14 Jan 2022 15:10:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AC24 22 KB
9 KB 127ms
126ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1642173039&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039281&bpp=1&bdt=1253&idt=120&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XqSEYM7tkn&p=https%3A//www.edocr.com&dtd=126

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31d05ba4da42b0fd9dda4cc00f3c54dc31efb8a0bcd1b3902469736ca310751f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 14 Jan 2022 15:10:39 GMT
server: cafe
content-length: 9429
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 14 Jan 2022 15:10:39 GMT
cache-control: private

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 45ms
44ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&tn=HEADER&cls=MuiPaper-root%20MuiAppBar-root%20MuiAppBar-positionFixed%20MuiAppBar-colorPrimary%20jss2%20mui-fixed%20MuiPaper-elevation4&ign=false&pw=1600&ph=1200&x=0&y=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 07EC 0
19 B 17ms
17ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&adk=1812271804&adf=3025194257&lmt=1642173039&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039303&bpp=1&bdt=1276&idt=106&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600%2C300x250&nras=1&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=111

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 14 Jan 2022 15:10:39 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 14 Jan 2022 15:10:39 GMT
cache-control: private

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 75ms
50ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 14 Jan 2022 15:10:39 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6AEF 13 KB
5 KB 30ms
9ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 14 Jan 2022 14:21:28 GMT
expires: Sat, 14 Jan 2023 14:21:28 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 2951
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8FA4 783 B
1 KB 40ms
17ms Document
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

16d8d5183862ab85d184342b6ffaba02f070a4f0417c7cb10d6923fdb1a18233

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oNdmFwY5Qn1aG6aaInSv2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 14 Jan 2022 15:10:39 GMT
date: Fri, 14 Jan 2022 15:10:39 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-oNdmFwY5Qn1aG6aaInSv2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame AC24 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1642173039&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039281&bpp=1&bdt=1253&idt=120&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XqSEYM7tkn&p=https%3A//www.edocr.com&dtd=126

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:06:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 233
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Jan 2022 15:06:46 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AC24 121 KB
38 KB 320ms
297ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 14 Jan 2022 15:10:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame AC24 15 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 14:58:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Jan 2022 14:58:16 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame AC24 0
0 51ms
51ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CeZUab5LhYdb9GeOgrATyqpnQBsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAulfGhjoOLM-qAMBqgT6AU_QQmjBFhVH4NwaNwG5x_ZYWmN64r0NY1I3ZojlNY12imd_NWaMUXdQmQ7UewVX4dA-B7NYW3NGlMVhuX_DYyud3XxnDpGTNc8-mPS-QqIKCAu_iV6LyY7J2C-a1E9DHnXHnm2_L0VDwb_8uZ3Gw5t6GWjDuw4ewjMLa-vbY3rqXqt1vRTagn8t0EhskXlOQXU1cnxJUsVikeC1NjWyh7RJGAJu9e1ThyDHBcbqpHRnMbgZK3Bl8GHPTHiIHyorQgzny2Eiepcnei807Gv4Gi1HLafXZMf9RNXC19yHpLcYRlz7HgzPr2ce90CAS3L-C16IM6BsPU6ToC-ABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi02OTMzNDYxOTQwNjI3NjQxGAA&sigh=o8GXrRN3XX0&uach_m=[UACH]&cid=CAQSGwCNIrLMBfzWIA-tj7elPj4a-kZXUAdaNKaUpBgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1642173039&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039281&bpp=1&bdt=1253&idt=120&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XqSEYM7tkn&p=https%3A//www.edocr.com&dtd=126
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 14 Jan 2022 15:10:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 14 Jan 2022 15:10:39 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame AC24 0
0 66ms
14ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=UMDUEd2BMKwC-gGdg2ICAgAAABIFyUVIOrE-EG6S4WHfahrYAKVCST5tpAAS&wp=YeGSbwAGftYKixBjAAZVcgpe-ttFtDaEJ-Xldw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
server: Kestrel
server-processing-duration-in-ticks: 236349
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame A07D 161 KB
50 KB 373ms
106ms Document
text/html 2a02:2638:1::11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YeGSbwAGftYKixBjAAZVcgpe-ttFtDaEJ-Xldw&u=%7CuDOJbdwQKOsqCzxgeDETjpafEtPKYtl9VOrPEPoml0M%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy2QKiI0Jg3g86PgOGRgROWFgpFKq1sL1Y1SGqocTupFIbxJuEeiJnLLOKVnlebt8fC-xBaF9JxV9WNzqVvYSu-G2wIr6wSOypY_U_3TzN8NXWKuK1-TzOw986kXNrnq83VF6Vi_7fhNqdFEReTojec4N7XrPivlYoG1HBeWwPu6pqttc9VlHZQou08cKLlj-TUQuv8L53P3DuwU636KQkFDCoVaIl6mKh6TKqHFuBpueqHaLY-3KDuOKxXD1PvJTSK-xZ06Sed0jctF21BkZIKfX9JvbSXHEwT27mYH4Xnbt1OUHDrO_Jd1G_VSOredAGFWmWF1Y6lgaXMwbrUDQbSe4Xkll7aIzkbVri8WuunGW4x8HsCyybvVNO0ys6qRMs4QPm6DXlKXN&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9qYJb5LhYdb9GeOgrATyqpnQBsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAulfGhjoOLM-qAMBqgT9AU_QQmjBFhVH4NwaNwG5x_ZYWmN64r0NY1I3ZojlNY12imd_NWaMUXdQmQ7UewVX4dA-B7NYW3NGlMVhuX_DYyud3XxnDpGTNc8-mPS-QqIKCAu_iV6LyY7J2C-a1E9DHnXHnm2_L0VDwb_8uZ3Gw5t6GWjDuw4ewjMLa-vbY3rqXqt1vRTagn8t0EhskXlOQXU1cnxJUsVikeC1NjWyh7RJGAJu9e1ThyDHBcbqpHRnMbgZK3Bl8GHPTHiIHyorQgzny2Eiepcnei807Gv4Gi1HLafXJsXc1lJNS884OKO7lmFd5gXbpdEU2VgC_7rDraw3LYx0uOQXs5AgRzWABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0QrQQEIpnVXXMthwXhvYRAFJVZCg%26client%3Dca-pub-6933461940627641%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

9c086ce2aa60fd6d8e4cf2279af96dbd0eb33ae3f8f92760aae47f8323ab64e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=9AhOAmnOVl_he4hoAXVYTgsKKrQgoLIWctyBOjBZly3PCA8ufLeCo6RSGLueKR-kz4KkA02Z7AKzAYP_nS8WXsMJT2wG78KHhgtmVPIrAyoI6VwBd_DOdLTATwnLbBa2JMK936xGs-UOQPCwz8BmnQGbRzAejl-Fxd_TIU8P6UF7DNgnOOts_m5rzdqdExeI6EbmvgOkIo5FDoswd5dSZrsk0085oWVZdnPBYzmtjg_3v59QzmYRw0-rj6SFYH1uKLZJFg"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 90936488
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6C4E 0
0 54ms
54ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CNHGQb5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIECT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwOpVB-t1UuhMd7nPaqnItbj339ex_o6bG2bR3AorKUAr9YvGFiUTCABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi02OTMzNDYxOTQwNjI3NjQxGAA&sigh=v0efeflZdtw&uach_m=[UACH]&cid=CAQSGwCNIrLM2-9L5z5dbrySOGZ26Ju2OKP0lVeSqRgB&tpd=AGWhJmtb2YJeobw-mJAD2Bdi7uwCdf-SIEiB5RWXjBO9L1FW8MF0_FEgJEYRBiJlSQgw3jGrAXuVjwYngtXDHAhLvczWjXOnUG5tLMiNeUXMQ2oaOfIOvfNVaeWObcr2zaRqx1Vv9EzxdK6aaWcP_yhBg1JjL2sXZPv2_eCJNPzRwhpZ-j6-2smawZtGEZowaY_R2dK6DmETh30LYbzCw7v6wVBBM_qQYZ-RXeExD5leGpuees9nA7xPEqe8i9yP-9a79GG0rBs3ErE4QCrXM_0z5QkSMM_7J7RN1mRcNZ_OyNuPuLYUIumoBMS8MrZ4gTmPAXWkUfdSFkfzLkqsUHIdwsoe9Cm25PQ_i7jyBNH011RjjZ7wwYmkbso9k21ddTdbMv5d3_jxSZGONUElLVcoNTZwBwFDG674w53oZpszT5q9YSs1PaKdugWtUrvpMwxGpK3uLbjCuZ5LTDh3zZEQAE16EGLZSNYKFMhjE8TsYwgaGdfRcq12ZE_6CmzrTMV4yN-aGX2Q5vZj7BPnvtBvUwCEhWQ0_9STORaIOBXfn8L4K2BQKABMfn90hbAnWYc5sJ6ID03rewjhSNe4Du6g3-GcbGNmOSQqdkMb3-FiLBuNscF8dR5IvnG0wQTixm-2VK0NrJJzYUyuWPYnwfABXc9XKwBVk5qWHNUokCwT0McBnCThjsxVgs8Ugno8OorUaTOBNAbPkhfROsSBQEjPfbbyktJZWCOxJPUNTO0ui4tt-FfGQkg2bVeHGMQZDEarnToNt6flYExfxVODlobmXJCKyCZnHqeS1yF8ZbgbQdVuo-pVXiGsS3-cxbjHs3cfYAo4j27cugZb10XfFKOcLZgIcUZ_FD0Sr9Wc_TLhu_7d1ucIHB4yWC7BnqSYPhtQ4WCOy3NLZN5LsYnrAFrgTAtNo7EcLoFKtpatRJQVEd4RBjakGeeUxzbwhNs4_OwuJ73vWynmFvvPyoUaIVpas5X5s0bCbG3UPKw97Urb06nhskUf5DZ9UBmQ6gqGS90kr-wMsn23eDDXHrNYDst9AwkSshj9sPo-qiQq3iqgWhvvU_jBF2vVe9jMB9zd4L6rIueguek

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1642173039&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039274&bpp=6&bdt=1247&idt=91&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&correlator=3120942988240&frm=20&pv=2&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MMrJir168Y&p=https%3A//www.edocr.com&dtd=110
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 14 Jan 2022 15:10:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 14 Jan 2022 15:10:39 GMT

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 6C4E 3 KB
2 KB 73ms
23ms Script
application/x-javascript 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvT1RNMk16VTVNak10TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzczOTYxMzI2MjYwNjQzODkzMjQvNjYyMjMyNi80NTYyMzA2LzQvVk5HUC1tNkRnUUNLVVAyci1zajItYm0ydzdWRFlWaDFJZFhlZVEtOUpKZy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83Mzk2MTMyNjI2MDY0Mzg5MzI0L3pyaC8wLzg1NS82Ny85OTkvMzIyLzJhMDI6NmVhMDpjNzFiOjovMC4wMDAvMTY0MjE3MzAzOS8xNjQyMTg1NjM5LzQvcHViLTY5MzM0NjE5NDA2Mjc2NDEv/i1p0gNj5QoUKl8bq09yb-CR76Uk&nodeid=501&group=zrh&auctionid=7396132626064389324&shardkey=7396132626064389324&sid=4562306&cid=6622326&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.65&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%26client%3Dca-pub-6933461940627641%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1642173039&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039274&bpp=6&bdt=1247&idt=91&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&correlator=3120942988240&frm=20&pv=2&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MMrJir168Y&p=https%3A//www.edocr.com&dtd=110
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: df10e93bfcb2f8071755df8302f7efef1adb1d7af8f590ffafe37e6923101808

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:39 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1642173039
Last-Modified: Fri, 14 Jan 2022 15:10:39 GMT
Server: MMBD/3.211.0
x-mm-latency: 3 (0)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: zrh-router-x44, zrh-bidder-x57
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Fri, 14 Jan 2022 15:10:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 6C4E 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1642173039&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039274&bpp=6&bdt=1247&idt=91&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&correlator=3120942988240&frm=20&pv=2&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MMrJir168Y&p=https%3A//www.edocr.com&dtd=110

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:06:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 233
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Jan 2022 15:06:46 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6C4E 121 KB
37 KB 293ms
292ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 14 Jan 2022 15:10:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 6C4E 15 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 14:58:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Jan 2022 14:58:16 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8FA4 0
0 47ms
47ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220112&jk=3015144523773208&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

GET
H3 200 s22cBc76vWepYNwqq7rK-TaORqePB7gQ6sezXyyrHgA.js Show response
pagead2.googlesyndication.com/bg/ Frame 6AEF 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s22cBc76vWepYNwqq7rK-TaORqePB7gQ6sezXyyrHgA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b36d9c05cefabd67a960dc2aabbacaf9368e46a78f07b810eac7b35f2cab1e00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 08:14:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24941
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13484
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Jan 2023 08:14:58 GMT

GET
H/1.1 200
OK 01qrvgnrrbds Show response
hal9000.redintelligence.net/zone/ Frame 6C4E 10 KB
3 KB 52ms
13ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/01qrvgnrrbds?subid=&gdpr=1&gdpr_consent=li&rnd=7396132626064389324&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeGSbwAHXuUKd-YBNgEkkQ%26mt_aid%3D7396132626064389324%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_cid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D
Requested by: Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: aeb1bb43afdce87f4e486679db3f16e3ad52826cfa791f7ac90b54bde8c90101

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:39 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3368
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 6C4E 49 B
329 B 58ms
22ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=7396132626064389324&node_id=501&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvT1RNMk16VTVNak10TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzczOTYxMzI2MjYwNjQzODkzMjQvNjYyMjMyNi80NTYyMzA2LzQvVk5HUC1tNkRnUUNLVVAyci1zajItYm0ydzdWRFlWaDFJZFhlZVEtOUpKZy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83Mzk2MTMyNjI2MDY0Mzg5MzI0L3pyaC8wLzg1NS82Ny85OTkvMzIyLzJhMDI6NmVhMDpjNzFiOjovMC4wMDAvMTY0MjE3MzAzOS8xNjQyMTg1NjM5LzQvcHViLTY5MzM0NjE5NDA2Mjc2NDEv/i1p0gNj5QoUKl8bq09yb-CR76Uk&nodeid=501&group=zrh&auctionid=7396132626064389324&shardkey=7396132626064389324&sid=4562306&cid=6622326&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.65&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:39 GMT
Server: MMBD/3.211.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x83, zrh-bidder-x57
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 14 Jan 2022 15:10:38 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 6C4E 43 B
404 B 62ms
18ms Image
image/gif 104.79.88.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=7396132626064389324&v3=651871&v4=4562306&v5=6622326&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvT1RNMk16VTVNak10TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzczOTYxMzI2MjYwNjQzODkzMjQvNjYyMjMyNi80NTYyMzA2LzQvVk5HUC1tNkRnUUNLVVAyci1zajItYm0ydzdWRFlWaDFJZFhlZVEtOUpKZy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83Mzk2MTMyNjI2MDY0Mzg5MzI0L3pyaC8wLzg1NS82Ny85OTkvMzIyLzJhMDI6NmVhMDpjNzFiOjovMC4wMDAvMTY0MjE3MzAzOS8xNjQyMTg1NjM5LzQvcHViLTY5MzM0NjE5NDA2Mjc2NDEv/i1p0gNj5QoUKl8bq09yb-CR76Uk&nodeid=501&group=zrh&auctionid=7396132626064389324&shardkey=7396132626064389324&sid=4562306&cid=6622326&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.65&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-79-88-164.deploy.static.akamaitechnologies.com
Software: MT3 4133 baa842e master cdg-pixel-x8 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:39 GMT
Server: MT3 4133 baa842e master cdg-pixel-x8 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 14 Jan 2022 15:10:38 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 6C4E 49 B
329 B 55ms
19ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=7396132626064389324&st=4562306&time=1642173039&nodeid=501
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvT1RNMk16VTVNak10TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzczOTYxMzI2MjYwNjQzODkzMjQvNjYyMjMyNi80NTYyMzA2LzQvVk5HUC1tNkRnUUNLVVAyci1zajItYm0ydzdWRFlWaDFJZFhlZVEtOUpKZy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83Mzk2MTMyNjI2MDY0Mzg5MzI0L3pyaC8wLzg1NS82Ny85OTkvMzIyLzJhMDI6NmVhMDpjNzFiOjovMC4wMDAvMTY0MjE3MzAzOS8xNjQyMTg1NjM5LzQvcHViLTY5MzM0NjE5NDA2Mjc2NDEv/i1p0gNj5QoUKl8bq09yb-CR76Uk&nodeid=501&group=zrh&auctionid=7396132626064389324&shardkey=7396132626064389324&sid=4562306&cid=6622326&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.65&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:39 GMT
Server: MMBD/3.211.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x25, zrh-bidder-x57
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 14 Jan 2022 15:10:38 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6AEF 0
9 B 7ms
6ms Image
text/plain 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?7UxHSA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 56ms
56ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220112&jk=3015144523773208&bg=!6-il6KzNAAaocxMpqHM7ACkAdvg8WlqZJB6K-n64_QTSlFFL5UnV2ZsODwZ8MpX4jjJHgvZMT_PIqgIAAABMUgAAAAJoAQcKAQoeXK9SWpuYYyQ3AMeh4Si2tSxPlsDKF_EJiQMEbU6h47wFl3ovM_NJCHFVl8Fvs4wyroHjVZm6pAZ5A8YqaAmxa_tCZ0B3uMjtKZh0bfvybc8pPqn6azy7zqZXkVYK09sYPmpYCCZ2SCtIVMiVyDcaXddjC_ixNx62iQQZo-z2zV7rZzroouY6ushJmEpDVAM5aRLHsMyQiDcLt_iHYmhQdLgFBaIO1ZhaMwFYx4thYJiJ-quOlwLrEroRVKIMTGkUo1d5qXE7HFNb0g9BziSvNeJm6RE5Gx-zJSUbPA0zuzKvkeAJBkgxKjoEyn5iOxykEO3rF1egck6ZyyYkDEMDBbMgt2-9PW1rFZkCee_PVN73huhQe6ZteTWCn8XZQsfvss1PIN8ydpYcHG8rDnjVWTFHTV1gMmeyh-_7xhc4agoqlp3wsG19KRRTtkEx4uPEcETpjZ0oUTqahtEEB6oo1ph0fbUD3nCj_Rhq3KPW102qdmNd0JyWytalxqB4zUj0hZm1KK36bdViqbSBlMgQ0eofNsMmgxmSGNQk74jj7owAsA-IxOno-q0rjL9Ow98Pa0QvQVRpND2ietwnjuUhVGkYyKoSMlOrA6HxKTbfyKsvAO4OHBy89XdYoBGjJde-xJlHmO2gbqyS4VWKbVBufwBl3QAtm09xp0pgxEUqn06dR8abxR4DlPHkOi4hVM2fWMpVs-Iy0sS3H3PjyDocrQanYfnMOHjzz9-xn_jD3MzZ5I6uEhKR3vzzggrjDrve3X4B1pO3nhpZL4wvUgKRGvFcsAVoBgZJM01b_tSA5OvQNiqmIxjdo850P5gcY0nD6SesXJK_YTB9Cu0sP97N2tgN_Pu9oJ156YbMJFSUaq3mBCtVkN-obP5Bs1DWqSJ7nG3DIb0yZfWU7B2p-SiUbgkNCJjCOXYFkhzqMl3kJ3msV4WIW6-HqlWQKO2aRfXzVwlwgDpRriB-W-vW7WaqudFQqovbnctOOf-KmBvHxZnOLEu3O7hUaXHTVcbpB1NTC3beymBuyZwnV62LnK5qGOiisytGc1S8cupJReh4UFFnvyRE_0bfn6_PaYVnAvoPsbnJpclQ680Y7EBEJmAsJiF3hYI-YDaaN29jdLDX6sHoRnBTyF85Y53c5FvpdMNyRROrAg1sVgNgvgy4HL9NvkLy9hPITaTmnE3umAJssx3Us_TqkA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK request.php Show response
hal900024.redintelligence.net/ Frame 6C4E 4 KB
2 KB 190ms
98ms Script
application/x-javascript 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request.php?zone=01qrvgnrrbds&nw=20&renderingType=javascript&namespace=ec89c7327b&subid=&uid=827f4918013c47bd&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeGSbwAHXuUKd-YBNgEkkQ%26mt_aid%3D7396132626064389324%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_cid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6933461940627641%26output%3Dhtml%26h%3D250%26slotname%3D8628223775%26adk%3D2306401753%26adf%3D1981261236%26pi%3Dt.ma~as.8628223775%26w%3D350%26lmt%3D1642173039%26psa%3D0%26format%3D350x250%26url%3Dhttps%253A%252F%252Fwww.edocr.com%252Fv%252Fwrnje4ow%252Firwinfraunfelter1124%252F20-or-so-tax-preparation-challenges-for-2021-filin%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642173039274%26bpp%3D6%26bdt%3D1247%26idt%3D91%26shv%3Dr20220112%26mjsv%3Dm202201040101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D3120942988240%26frm%3D20%26pv%3D2%26ga_vid%3D1881395037.1642173038%26ga_sid%3D1642173039%26ga_hid%3D2025638533%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-975%26ady%3D474%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D31063752%252C44750774%252C44753738%252C31064070%26oid%3D2%26pvsid%3D3015144523773208%26pem%3D109%26tmod%3D122%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CaeE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DMMrJir168Y%26p%3Dhttps%253A%2F%2Fwww.edocr.com%26dtd%3D110&ancestorOrigins=null&random=422273183058&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/01qrvgnrrbds?subid=&gdpr=1&gdpr_consent=li&rnd=7396132626064389324&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeGSbwAHXuUKd-YBNgEkkQ%26mt_aid%3D7396132626064389324%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_cid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7e1f1bf675a0274f55e2056c029f8fc1c8cbe2539a6fc9f47386a917ac8d0022

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 14 Jan 2022 15:10:39 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 29179900146482200951393011839024
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1266
Expires: Fri, 14 Jan 2022 15:10:39 +0100

GET
DATA 200
OK truncated
/ Frame AC24 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0b515c5078fb45e345843e4b43770392a72c7c6dce4783ba904b09fdfc5ec9c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 7F05
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=29179900146482200951393011839024&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29179900146482200951393011839024&actionid=879111&produktid=ratenkredit&dt_url=

0
629 B

230ms
166ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29179900146482200951393011839024&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=01qrvgnrrbds&nw=20&renderingType=javascript&namespace=ec89c7327b&subid=&uid=827f4918013c47bd&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeGSbwAHXuUKd-YBNgEkkQ%26mt_aid%3D7396132626064389324%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_cid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6933461940627641%26output%3Dhtml%26h%3D250%26slotname%3D8628223775%26adk%3D2306401753%26adf%3D1981261236%26pi%3Dt.ma~as.8628223775%26w%3D350%26lmt%3D1642173039%26psa%3D0%26format%3D350x250%26url%3Dhttps%253A%252F%252Fwww.edocr.com%252Fv%252Fwrnje4ow%252Firwinfraunfelter1124%252F20-or-so-tax-preparation-challenges-for-2021-filin%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642173039274%26bpp%3D6%26bdt%3D1247%26idt%3D91%26shv%3Dr20220112%26mjsv%3Dm202201040101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D3120942988240%26frm%3D20%26pv%3D2%26ga_vid%3D1881395037.1642173038%26ga_sid%3D1642173039%26ga_hid%3D2025638533%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-975%26ady%3D474%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D31063752%252C44750774%252C44753738%252C31064070%26oid%3D2%26pvsid%3D3015144523773208%26pem%3D109%26tmod%3D122%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CaeE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DMMrJir168Y%26p%3Dhttps%253A%2F%2Fwww.edocr.com%26dtd%3D110&ancestorOrigins=null&random=422273183058&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Mannheim, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 14 Jan 2022 04:10:39 GMT
server: Microsoft-IIS/10.0
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Fri, 14 Jan 2022 15:10:39 GMT
content-length: 0

Redirect headers

Server: nginx/1.17.5
Date: Fri, 14 Jan 2022 15:10:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.21
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29179900146482200951393011839024&actionid=879111&produktid=ratenkredit&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: 8AC72686:9704_91EFC182:01BB_61E1926F_B51CC88:297E8
X-IPLB-Instance: 40028
Cache-control: private

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 6C4E 1 KB
2 KB 289ms
143ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3392355&wgcampaignid=99582&viewref=29179900146482200951393011839024&js=1&nw=1
Requested by: Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 8a185fa55e5b3f37e547b30de061bfdfe0940738080da78039be8a2fb407b0b4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 14 Jan 2022 15:10:40 GMT
Last-Modified: Fri, 14 Jan 2022 15:10:40 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1239
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

activityi;dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429 Show response
5994599.fls.doubleclick.net/ Frame 61D9
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429?

391 B
345 B

47ms
27ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429?

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f6.1e100.net

Software

cafe /

Resource Hash

7cf795e6c0d91a407dff9185e30afd2448e15dfe5a2dd863f6bb74c4d930e739

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 14 Jan 2022 15:10:40 GMT
expires: Fri, 14 Jan 2022 15:10:40 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 14 Jan 2022 15:10:39 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900024.redintelligence.net/ Frame 24E1 7 KB
2 KB 42ms
13ms Document
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=01qrvgnrrbds&nw=20&renderingType=javascript&namespace=ec89c7327b&subid=&uid=827f4918013c47bd&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeGSbwAHXuUKd-YBNgEkkQ%26mt_aid%3D7396132626064389324%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_cid%3D748461e1-926f-4801-a330-4c324b3dce20%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCp4z9b5LhYdrxGdGz3gPTnLrIDM-HjptcwIbZgsYCwI23ARABIABglbqJgpgHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBIQCT9BvWCluGk2EFfamX8oPdrhfmDuAa-8gsSmbsItpNiPG0DNTEyCsJ0b9gT1i_fq1cRJFFAWvrkU50oBGv24qEl3P-tpuyHjyMKkj15Eu6tDBLbkjCCj6cCD1uLtcDMSeEvILfm5Ra-4RC2z-mXZSkTZXi7o2ps5BrAjaE2cIgiCiL8kujqCPtwejVwoG8Dud6jt-M8c0c3pTPxEnVp4ZLmHgMF701UWat5V_GjAjUBr89I4e33ZD1dpFELCJX8kFfO41Gnesaz66y0LpF-wMYbVtUGPDgvwHRnwO51JfJfmSIMD2OL4BRMv0f2DpcaPix6lX0N2ADUg1HJNAEvjeVr2DWpWABpCl7O_hmIDO1wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2p6-RCJk9wUmmaHi0Yhv3XoalNUA%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6933461940627641%26output%3Dhtml%26h%3D250%26slotname%3D8628223775%26adk%3D2306401753%26adf%3D1981261236%26pi%3Dt.ma~as.8628223775%26w%3D350%26lmt%3D1642173039%26psa%3D0%26format%3D350x250%26url%3Dhttps%253A%252F%252Fwww.edocr.com%252Fv%252Fwrnje4ow%252Firwinfraunfelter1124%252F20-or-so-tax-preparation-challenges-for-2021-filin%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642173039274%26bpp%3D6%26bdt%3D1247%26idt%3D91%26shv%3Dr20220112%26mjsv%3Dm202201040101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D3120942988240%26frm%3D20%26pv%3D2%26ga_vid%3D1881395037.1642173038%26ga_sid%3D1642173039%26ga_hid%3D2025638533%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-975%26ady%3D474%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D31063752%252C44750774%252C44753738%252C31064070%26oid%3D2%26pvsid%3D3015144523773208%26pem%3D109%26tmod%3D122%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CaeE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DMMrJir168Y%26p%3Dhttps%253A%2F%2Fwww.edocr.com%26dtd%3D110&ancestorOrigins=null&random=422273183058&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 6ef5cb36c6c0db278a57de9de89b8c809f127f4bd169dab1d25258cc1ea1bd27

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Fri, 14 Jan 2022 15:10:39 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 14 Jan 2022 15:10:39 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2048
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 6C4E
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=29179900146482200951393011839024
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=29179900146482200951393011839024
https://ad-server.eu/wm/pb/native.png

68 B
312 B

194ms
32ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1642173039&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039274&bpp=6&bdt=1247&idt=91&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&correlator=3120942988240&frm=20&pv=2&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MMrJir168Y&p=https%3A//www.edocr.com&dtd=110
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:15:50 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Fri, 14 Jan 2022 15:10:40 GMT
Server: nginx/1.19.7
X-IPLB-Request-ID: 8AC72686:9722_91EFC182:01BB_61E19270_B4E73BA:297EA
X-Powered-By: PHP/7.2.34
X-IPLB-Instance: 40028
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 6C4E 43 B
702 B 94ms
42ms Image
image/gif 104.92.94.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=29179900146482200951393011839024&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.94.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-94-3.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 14 Jan 2022 15:10:40 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
DATA 200
OK truncated
/ Frame 6C4E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b706094f3028f980623fc37cade91e256002fcf8d94cbf1709582f40c0150cad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a177819d7d599965fab101515912e55587cd45b5c93f489a44783c9019ad8d35

Request headers

Referer
Origin: https://www.edocr.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H/1.1 200
OK Attributes Show response
www.edocr.com/pas/Document/q/ 41 B
523 B 466ms
466ms XHR
application/json 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/Attributes?DocumentID=uai035OiIxyQAavPMesL-Ug&DesiredPageCountConfidence=50

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

e6d3c35d004dc673dcfde2897afabd8910dc3d8d64fd056913316f23885983d8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Gid: gwiekL0mvo0iETxDh3rtxA
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: application/json
Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:40 GMT
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2280

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame A07D 2 KB
1 KB 45ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YeGSbwAGftYKixBjAAZVcgpe-ttFtDaEJ-Xldw&u=%7CuDOJbdwQKOsqCzxgeDETjpafEtPKYtl9VOrPEPoml0M%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy2QKiI0Jg3g86PgOGRgROWFgpFKq1sL1Y1SGqocTupFIbxJuEeiJnLLOKVnlebt8fC-xBaF9JxV9WNzqVvYSu-G2wIr6wSOypY_U_3TzN8NXWKuK1-TzOw986kXNrnq83VF6Vi_7fhNqdFEReTojec4N7XrPivlYoG1HBeWwPu6pqttc9VlHZQou08cKLlj-TUQuv8L53P3DuwU636KQkFDCoVaIl6mKh6TKqHFuBpueqHaLY-3KDuOKxXD1PvJTSK-xZ06Sed0jctF21BkZIKfX9JvbSXHEwT27mYH4Xnbt1OUHDrO_Jd1G_VSOredAGFWmWF1Y6lgaXMwbrUDQbSe4Xkll7aIzkbVri8WuunGW4x8HsCyybvVNO0ys6qRMs4QPm6DXlKXN&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9qYJb5LhYdb9GeOgrATyqpnQBsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAulfGhjoOLM-qAMBqgT9AU_QQmjBFhVH4NwaNwG5x_ZYWmN64r0NY1I3ZojlNY12imd_NWaMUXdQmQ7UewVX4dA-B7NYW3NGlMVhuX_DYyud3XxnDpGTNc8-mPS-QqIKCAu_iV6LyY7J2C-a1E9DHnXHnm2_L0VDwb_8uZ3Gw5t6GWjDuw4ewjMLa-vbY3rqXqt1vRTagn8t0EhskXlOQXU1cnxJUsVikeC1NjWyh7RJGAJu9e1ThyDHBcbqpHRnMbgZK3Bl8GHPTHiIHyorQgzny2Eiepcnei807Gv4Gi1HLafXJsXc1lJNS884OKO7lmFd5gXbpdEU2VgC_7rDraw3LYx0uOQXs5AgRzWABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0QrQQEIpnVXXMthwXhvYRAFJVZCg%26client%3Dca-pub-6933461940627641%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame A07D 2 KB
1 KB 52ms
21ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame A07D 308 B
636 B 37ms
36ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame A07D 507 B
835 B 31ms
31ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/m/delivery/ Frame A07D 43 B
347 B 300ms
17ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=XzaaNidT-CWD74bROCY9dPLPwmhokgeFmXGIXTTwOC2GRU5aoN82Rj5TC6R_HFHejJORQSJLVuCnoOCLFJOMdgL1H6kLnNCgGopq3APw4uaHqU60s09vIJgTSkQF5H_XpF-wHqWcoibrqiNjFMI_3ZpZyEkQi2palJa3oxSvdNwzMWObSanuV1BKwbnNxpFcvwiTFU26uVDNv0EcBnIGffwIZfMVswzuP2KKPO3MlwUOuidzeLPdPdYWz_39TtIIMU_8HNrV0gGxpUgoWWdH7983jMVdDdSwTqwG7T7-VeurjG2H8glzuqgNiL5UdpWFkKN2eaHZmfvZLYU3V0MZbutZimFTmMHkaToBr0aEZajwBXxLFFP0K0i6FmXvch1aTsH5sSO0kr3gv9T7cObm1rG6s9I7FepR0A1jfYSNAwJaTfBjstpRvkdPRPXXRb4_q6j1fw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:39 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3483183
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 24E1 4 KB
1 KB 77ms
15ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ad246d47536dacf0256646042ec184678bfc630fcb638d9199bd66cf8cb5e457

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 13:42:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 14 Jan 2022 15:10:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 14 Jan 2022 15:10:40 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 24E1 16 KB
16 KB 76ms
16ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a3e9a510794f1cf07a5e5d7dc400058d853e895d6071183ac47b6350c4be10b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:40 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16246
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 24E1 17 KB
17 KB 62ms
14ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 814f1b5b03821a84eb33335cee9dea8c2e6424b5e1efef2ed8e14697fc8bc2bd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:40 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16857
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 24E1 15 KB
16 KB 62ms
13ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52113/creativesup/paninicomics-banner-2021-1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 859d9e5033725311451b184fe8a1ff3ae7c6ae4ea047030e75d97bc95342b05f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:40 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15707
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame A07D 12 KB
5 KB 79ms
22ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3693928
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MU9HgaVUvcbQOwIzvlAn9NrYU%2BBe1czqFAZZwBvM8ryGALvy1eJ9rbbjnEOCPTFQtPTe6I1vhYauI8e7ClLBHkSYgELUyOtOUSs9e1rETIOKH26%2B3g7sFk5JLti8vfNwo58kE%2FW%2F2z%2FqRX8v0hGCccZj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6cd7cadd0ed14e38-FRA
x-cache-tag: abcd1234
expires: Wed, 04 Jan 2023 15:10:40 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame A07D 12 KB
6 KB 18ms
18ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A07D 15 KB
16 KB 252ms
28ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=76&m=0&partner=90357&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F90357%2F211115%2F33300702bd0247d48074e3362ef06108_screenshot_2021-11-08_at_12.17.08.png&v=3&w=596&s=miC8Zn4JRxHUESZaRtP_qXtO

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

b09b4568e6d05c7d8721203cf78dd283559194f22f72159d381b4e0a12c81641

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 16:05:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 255897
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=29622704
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 15757
expires: Tue, 20 Dec 2022 12:37:27 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A07D 66 KB
66 KB 248ms
24ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1167546-_x600-nocrop.jpg&v=3&w=400&s=BSa_CYNiehYpKpTcNn2jt3hT&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

44bc4a17199ec4f353892cda3cdb02d401ba5fc9562aae091a1bf1f2fbf9151e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 14:22:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 262066
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29824953
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 67224
expires: Thu, 22 Dec 2022 19:05:26 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A07D 28 KB
28 KB 259ms
37ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1894046-_x600-nocrop.jpg&v=3&w=400&s=6GDXLyk3Y4EF33qvXzqRshUa&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

1b54f06ee9e4049c5fc1f7b8888163f25e87b2039953974ce0a86d31c9f89cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 16:06:19 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 255859
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29818678
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 28208
expires: Thu, 22 Dec 2022 19:04:19 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame A07D 0
127 B 74ms
17ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=9AhOAmnOVl_he4hoAXVYTgsKKrQgoLIWctyBOjBZly3PCA8ufLeCo6RSGLueKR-kz4KkA02Z7AKzAYP_nS8WXsMJT2wG78KHhgtmVPIrAyoI6VwBd_DOdLTATwnLbBa2JMK936xGs-UOQPCwz8BmnQGbRzAejl-Fxd_TIU8P6UF7DNgnOOts_m5rzdqdExeI6EbmvgOkIo5FDoswd5dSZrsk0085oWVZdnPBYzmtjg_3v59QzmYRw0-rj6SFYH1uKLZJFg&sds=2&rev=80076&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame A07D 2 KB
1 KB 18ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame A07D 2 KB
1 KB 18ms
18ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H3 200 dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429
adservice.google.com/ddm/fls/z/ Frame 61D9 42 B
63 B 68ms
50ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJKT1KXDsfUCFU7OGwodeb0OEw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6808633029938.429?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900024.redintelligence.net/ Frame 24E1 0
150 B 38ms
15ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/viewability?s=29179900146482200951393011839024&a=57f3c63c&vb=m
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/request_content.php?s=29179900146482200951393011839024&a=79143783
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 15:10:40 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v18/ Frame 24E1 13 KB
13 KB 36ms
12ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72dbd696f7961daf9049faacc868865d959f3d126f40d5271f48d5d9a0ccc652

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900024.redintelligence.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 21:39:33 GMT
x-content-type-options: nosniff
age: 322267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13072
x-xss-protection: 0
last-modified: Wed, 10 Nov 2021 18:17:36 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 10 Jan 2023 21:39:33 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v18/ Frame 24E1 13 KB
13 KB 32ms
8ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

428f1eb7935944229430ac0fdce0033f05d9b8c1c020b87c681dd7a78ab4dd19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900024.redintelligence.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 14:56:27 GMT
x-content-type-options: nosniff
age: 173653
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13080
x-xss-protection: 0
last-modified: Wed, 10 Nov 2021 18:10:26 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 12 Jan 2023 14:56:27 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame B517 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1642173039&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039280&bpp=1&bdt=1253&idt=113&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xMyATMZ2vN&p=https%3A//www.edocr.com&dtd=119

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:06:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 234
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Jan 2022 15:06:46 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B517 121 KB
37 KB 96ms
80ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 14 Jan 2022 15:10:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame B517 15 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 14:58:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Jan 2022 14:58:16 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame A07D 2 KB
507 B 34ms
18ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

089822305b9af8e8bf8797060fa68e6d18068b4fd7e8938f30b125ab6f61a2b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 13:49:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 14 Jan 2022 15:10:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 14 Jan 2022 15:10:40 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B517 0
0 59ms
58ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CPxTMb5LhYZ76Ho2y7wL9zLyABsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAsi3KyDvNrM-qAMBqgT6AU_QzX6l_AeNys96vynXkfRjfY4kreZnROsPD0S5Y1nJ2NhZLYQmr1ZqVXYf6UInZPISnYjeTxgAeRPXRNifMD9Dz9Yq-whEdhW7Ab0p9Xt8RUitgri8JA89d3SdylNAV8v_RM6B9-sgES5SQhYr-c4ERDewN8NfIMrWAw7ExxGFRyweK5lEUIpPUoKqO2U_9f2KyMx3u-7A1gU8BwYrjkyYJeLjqOweKB2Fn3L2KHoRoqI-NrS0im7H9PmRSZQiLX0kxwAloz9YQYnW8KBctkRaJ38rmhzjHwyVWzgVEyJoNlf83PuPi-P5YaUfoRXAxSWMI9FoBttrs5SABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi02OTMzNDYxOTQwNjI3NjQxGAA&sigh=6ouu2P38k-8&uach_m=[UACH]&cid=CAQSGwCNIrLM9djPAe9yoEDGGjt91bG8saDXwDLCJhgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1642173039&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039280&bpp=1&bdt=1253&idt=113&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=3120942988240&frm=20&pv=1&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xMyATMZ2vN&p=https%3A//www.edocr.com&dtd=119
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 14 Jan 2022 15:10:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame B517 0
0 136ms
25ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=UMDUEZi6MHjYBJ2DYgICAAAAayHmQ6TL8MYQbpLhYZ2YJwZlsV3QGGwnABI&wp=YeGSbwAHvR4KW9kNAA8mfW9UTiakvKi_cCV1vQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:39 GMT
server: Kestrel
server-processing-duration-in-ticks: 275401
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame ADFA 176 KB
52 KB 134ms
134ms Document
text/html 2a02:2638:1::11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YeGSbwAHvR4KW9kNAA8mfW9UTiakvKi_cCV1vQ&u=%7CuDOJbdwQKOubmwVe6o8Kyndbo%2BvOVZgsgFqa9IASYtM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_ArHr9DlvVwUA0Lh10Pk2WlfeyBMX_as4AVFYMbMe0Cm1ZebXXvkDDWgG2x364uPFj0_-eVko8FvBPEjWZglhP49yFKeAFA3XoT7DPBg4qHdruifTUE6vUqvwV17N_YdfIEkF0UYM1_Nx0mriIpceZQsJ9XGh1wriu15ABdYq-wN619F-YLwvdyvXVzdbG1Jn6DruC49xrwyrdqeIBByT1E1lOMAC-r3_sauDFh0INFBs2Epl1iNxqbNgOJs_1J5A674NNaTCZw8igBTu6pfLmaNgJGagHtfVF0mbW2SCGQVwIWyInCw6Jm7wpE4tuXJdXNBd33BUrEvlZXCkrxOf5bp8qCZM9kikjolWQbxx61XNW1k3nsJ_wj-2PFan4TeRrjc9FoTf3trsqv5kC13dX6y-HCAExIsPAoDE5DL6zgt0v4n3W0v84PpauRwUzLQV6&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9Lsbb5LhYZ76Ho2y7wL9zLyABsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAsi3KyDvNrM-qAMBqgT9AU_QzX6l_AeNys96vynXkfRjfY4kreZnROsPD0S5Y1nJ2NhZLYQmr1ZqVXYf6UInZPISnYjeTxgAeRPXRNifMD9Dz9Yq-whEdhW7Ab0p9Xt8RUitgri8JA89d3SdylNAV8v_RM6B9-sgES5SQhYr-c4ERDewN8NfIMrWAw7ExxGFRyweK5lEUIpPUoKqO2U_9f2KyMx3u-7A1gU8BwYrjkyYJeLjqOweKB2Fn3L2KHoRoqI-NrS0im7H9PmRSZQiLX0kxwAloz9YQYnW8KBctkRaJ38r2B7CjYsaxyuqjzbL5mpaJPKbgVXzT72dFd39Y9czPf1wg3HvoCvIbXiABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1aGAJFik9lh-vrUljLKjME-WBZOg%26client%3Dca-pub-6933461940627641%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

bfbc4617f2afccb7fe5c69ffb9939ae529ca7e79fec94bb85ee138db0b9b4399

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=R0XJq2nOVl_he4hoqFsX2Ff--CL0Pn4LAMQPLrURCxwRv8A8xpulHF8TdnNhl7zJX8Yf_oOqkz8bNupI6ymB2GuMEkhOZ9Cc_AdkVsiLNwbr0djSafXDfjkVNjTD2shcKiB4rMXPy3TW5GCjo5vqyiagu2z5ahFNg-KTJXJMO9w351e5FG5PNFm79a3BI_h_E4PX65yL4g5_mrbg8_JC5CDEQXn9N_sExcXWDghBIw69ckmjEU5K4u6-gE0Kkb2cLKAA7g"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 106405586
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6C4E 51 KB
51 KB 96ms
12ms Script
application/javascript 18.66.248.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3392355&wgcampaignid=99582&viewref=29179900146482200951393011839024&js=1&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-39.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

x-amz-version-id: wvDglZsFnxZ0eZ1mUErJkFMo1VNidWYJ
via: 1.1 6fadd80db8a3a154b0b68f055a91920c.cloudfront.net (CloudFront)
last-modified: Tue, 09 Nov 2021 11:05:10 GMT
server: AmazonS3
age: 38220
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Fri, 14 Jan 2022 04:33:40 GMT
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: H3tEnYgpQR9RUWYCmcJ7-uWhyu2TuBtKnvVeaiEqJWvZrzoDG5Vn3g==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 6C4E 160 B
618 B 111ms
37ms Image
image/jpeg 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=12280300141779600757591011839029&wglinkid=3392355
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1642173039&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fwrnje4ow%2Firwinfraunfelter1124%2F20-or-so-tax-preparation-challenges-for-2021-filin&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642173039274&bpp=6&bdt=1247&idt=91&shv=r20220112&mjsv=m202201040101&ptt=9&saldr=aa&abxe=1&correlator=3120942988240&frm=20&pv=2&ga_vid=1881395037.1642173038&ga_sid=1642173039&ga_hid=2025638533&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753738%2C31064070&oid=2&pvsid=3015144523773208&pem=109&tmod=122&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MMrJir168Y&p=https%3A//www.edocr.com&dtd=110
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 6b71d2bd27010cbb01e505314423d9c903230bf4182019eb1ca8016bd2b624a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 14 Jan 2022 15:10:40 GMT
Last-Modified: Fri, 14 Jan 2022 15:10:40 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/jpeg
Content-Length: 160
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame A07D 44 KB
44 KB 35ms
13ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 21:17:17 GMT
x-content-type-options: nosniff
age: 323603
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45416
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 10 Jan 2023 21:17:17 GMT

GET
H3 200 jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame A07D 46 KB
46 KB 32ms
11ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 14:03:04 GMT
x-content-type-options: nosniff
age: 263256
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46988
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:11 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 11 Jan 2023 14:03:04 GMT

GET
DATA 200
OK truncated
/ Frame B517 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe7f6dcaada61b62c1c420098ed25dae2c1b043b2f8eff209db4c88dace6208b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame ADFA 2 KB
1 KB 20ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YeGSbwAHvR4KW9kNAA8mfW9UTiakvKi_cCV1vQ&u=%7CuDOJbdwQKOubmwVe6o8Kyndbo%2BvOVZgsgFqa9IASYtM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_ArHr9DlvVwUA0Lh10Pk2WlfeyBMX_as4AVFYMbMe0Cm1ZebXXvkDDWgG2x364uPFj0_-eVko8FvBPEjWZglhP49yFKeAFA3XoT7DPBg4qHdruifTUE6vUqvwV17N_YdfIEkF0UYM1_Nx0mriIpceZQsJ9XGh1wriu15ABdYq-wN619F-YLwvdyvXVzdbG1Jn6DruC49xrwyrdqeIBByT1E1lOMAC-r3_sauDFh0INFBs2Epl1iNxqbNgOJs_1J5A674NNaTCZw8igBTu6pfLmaNgJGagHtfVF0mbW2SCGQVwIWyInCw6Jm7wpE4tuXJdXNBd33BUrEvlZXCkrxOf5bp8qCZM9kikjolWQbxx61XNW1k3nsJ_wj-2PFan4TeRrjc9FoTf3trsqv5kC13dX6y-HCAExIsPAoDE5DL6zgt0v4n3W0v84PpauRwUzLQV6&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9Lsbb5LhYZ76Ho2y7wL9zLyABsme0rFc1Z2R93DAjbcBEAEgAGCVuomCmAeCARdjYS1wdWItNjkzMzQ2MTk0MDYyNzY0MaAB1bbS6gPIAQmpAsi3KyDvNrM-qAMBqgT9AU_QzX6l_AeNys96vynXkfRjfY4kreZnROsPD0S5Y1nJ2NhZLYQmr1ZqVXYf6UInZPISnYjeTxgAeRPXRNifMD9Dz9Yq-whEdhW7Ab0p9Xt8RUitgri8JA89d3SdylNAV8v_RM6B9-sgES5SQhYr-c4ERDewN8NfIMrWAw7ExxGFRyweK5lEUIpPUoKqO2U_9f2KyMx3u-7A1gU8BwYrjkyYJeLjqOweKB2Fn3L2KHoRoqI-NrS0im7H9PmRSZQiLX0kxwAloz9YQYnW8KBctkRaJ38r2B7CjYsaxyuqjzbL5mpaJPKbgVXzT72dFd39Y9czPf1wg3HvoCvIbXiABu254_fxrPujjgGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1aGAJFik9lh-vrUljLKjME-WBZOg%26client%3Dca-pub-6933461940627641%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame ADFA 2 KB
1 KB 20ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame ADFA 308 B
636 B 17ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame ADFA 507 B
835 B 18ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/m/delivery/ Frame ADFA 43 B
347 B 18ms
18ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=nW6LE-a-UZssVwwrr_Oa2K-MK0kMUcvFvZp_NaoD9H3CtZ0buT6RyWeCQfy4y-hXG272EYH8700R4Q8EhcT2d5tcViwCnUtk5uWNtd1YGKwYs_6UgOKtiKYL42od1Oz8B5p4xfvgunUYBiladwtA_huDAKn_qYQcuT3f0oAuJaFytgDUDK7yqyL0f-_FIUrqt8FT002U4EGRX0V4NROtVPjQABq7qWSu8Rzlv1KOCpKZ1fXgUJKEZaIuqna2TWxeYJRZYN4_YAPWV_TQdD2pEhoiQFn1vQN7oU7iyXFzhtkb2tUeNkn1pACh6Z9USoBMyd6BQma-TdvWs4I1AYtDPL-BAC2S5M2sLK1to4BrjY1uYjDmUnIRcQJ7P-4RVEAoVvjny3CymXL_EiIeGHcEWjnKKoT8cbl5tevth-ILO8_-K_DqT8_ZXA66acvaxAzFxn-ktA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:40 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2984813
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame ADFA 12 KB
5 KB 31ms
18ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3693928
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zcsb3Dtvh5UetkqsfeSe%2FqXXRr8xsff3ooqEBqvqAtfxCAKcyftHcg1TAyr1kbka%2FNbG%2FAGMXJyLZZKAtp7stFhseOSklddRaAfG%2B0liMOKW%2FO2Emi6rgwj9%2FkfzCHX%2F0fqcPZmJ10LDoOLsJ4%2FW2gWO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6cd7cade7d662b29-FRA
x-cache-tag: abcd1234
expires: Wed, 04 Jan 2023 15:10:40 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame ADFA 12 KB
6 KB 18ms
17ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame ADFA 14 KB
15 KB 17ms
16ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=110&m=0&partner=90357&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F90357%2F211115%2F33300702bd0247d48074e3362ef06108_screenshot_2021-11-08_at_12.17.08.png&v=3&w=236&s=1oVSLl0DBIESGjQ2iydm9RVx

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

771b7bab4b257fa716af4267a8daf406193561781111b0968a37e95f14218f9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 12:24:23 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 269176
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=29635983
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 14577
expires: Tue, 20 Dec 2022 12:37:27 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame ADFA 66 KB
66 KB 21ms
20ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1167546-_x600-nocrop.jpg&v=3&w=800&s=KoUUKAWq2H4WAfcVueGNhS0k&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

44bc4a17199ec4f353892cda3cdb02d401ba5fc9562aae091a1bf1f2fbf9151e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 16:05:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 255898
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29818784
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 67224
expires: Thu, 22 Dec 2022 19:05:26 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame ADFA 32 KB
32 KB 28ms
27ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1857000-_x600-nocrop.jpg&v=3&w=800&s=71xL0C-VyVMXHoUBLQJNRc-K&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

992884a6d38b42fe1c8de229d54f0d6e49461ea6c340fe5622daa69075484c98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 12:46:10 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 267870
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29837705
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 32272
expires: Thu, 22 Dec 2022 21:01:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame ADFA 69 KB
69 KB 32ms
31ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1165318-_x600-nocrop.jpg&v=3&w=800&s=LzlBB40wIezU9oSbleSOY3Pn&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

260152ce49fdbda7b0f1e2f69d61ce39ba49de9a161971192cdf63af15207dbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 16:05:55 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 255884
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29818692
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 70472
expires: Thu, 22 Dec 2022 19:04:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame ADFA 36 KB
36 KB 29ms
29ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1167921-_x600-nocrop.jpg&v=3&w=800&s=9FLOwOeqLzNLRaspzbZM1uzM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0beafc5b9034b1c07d55ea2130782321336ae51296e1496f3667badf303c58de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 16:05:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 255897
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29818814
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 36836
expires: Thu, 22 Dec 2022 19:05:57 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame ADFA 0
127 B 17ms
17ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=R0XJq2nOVl_he4hoqFsX2Ff--CL0Pn4LAMQPLrURCxwRv8A8xpulHF8TdnNhl7zJX8Yf_oOqkz8bNupI6ymB2GuMEkhOZ9Cc_AdkVsiLNwbr0djSafXDfjkVNjTD2shcKiB4rMXPy3TW5GCjo5vqyiagu2z5ahFNg-KTJXJMO9w351e5FG5PNFm79a3BI_h_E4PX65yL4g5_mrbg8_JC5CDEQXn9N_sExcXWDghBIw69ckmjEU5K4u6-gE0Kkb2cLKAA7g&sds=2&rev=80076&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:39 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame ADFA 2 KB
1 KB 20ms
20ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame ADFA 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:10:40 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Jan 2023 15:10:40 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame ADFA 2 KB
507 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

089822305b9af8e8bf8797060fa68e6d18068b4fd7e8938f30b125ab6f61a2b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 13:57:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 14 Jan 2022 15:10:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 14 Jan 2022 15:10:40 GMT

GET
H3 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame ADFA 44 KB
44 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 21:17:17 GMT
x-content-type-options: nosniff
age: 323603
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45416
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 10 Jan 2023 21:17:17 GMT

GET
H3 200 jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame ADFA 46 KB
46 KB 11ms
11ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 14:03:04 GMT
x-content-type-options: nosniff
age: 263256
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46988
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:11 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 11 Jan 2023 14:03:04 GMT

GET
H/1.1 200
OK 1 Show response
www.edocr.com/pas/Page/q/ 41 KB
20 KB 612ms
612ms XHR
image/svg+xml 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/1?DocumentID=uai035OiIxyQAavPMesL-Ug&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

d235bda23bdb333559b69a3f00b9b977a241e5a046365703c34d45c0f131c255

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Accusoft-Gid: g1xNAW5OXNi2mm5UO4AXsg
Accept-Language: de-DE,de;q=0.9
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:41 GMT
content-security-policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2280

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AC24 42 B
64 B 43ms
43ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssXSg9snF4njtRABcEB7vzCxsmGvHxAFYnsy_tXrHLFnp6oJ5I6yGghMnKv7dDRfZtloe0CbveB0tqjRD2ey0no&sig=Cg0ArKJSzIxyoybyWeiqEAE&id=lidar2&mcvt=1043&p=0,0,250,300&mtos=1043,1043,1043,1043,1043&tos=1043,0,0,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=402904232&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642173039408&rpt=498&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/0-0/ 142 KB
29 KB 379ms
379ms XHR
application/json 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/0-0/Text?DocumentID=uai035OiIxyQAavPMesL-Ug

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

b8cd0f151455686c0892982b0f4c0a602cdc7f1d8e1bd855223805ee4ada606a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: XHGALDeOyo0jvC7t26xeQg
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
accept: application/json
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:41 GMT
content-security-policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2280

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 6C4E 16 B
232 B 107ms
107ms Fetch
application/json 34.242.207.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.242.207.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-242-207-34.eu-west-1.compute.amazonaws.com

Software

nginx / PHP/7.4.25

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 14 Jan 2022 15:10:41 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.25
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 126ms
30ms Preflight 34.242.207.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.242.207.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-242-207-34.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 14 Jan 2022 15:10:41 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

POST
H2 200 all
csm.eu.criteo.net/ Frame A07D 0
127 B 16ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:40 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B517 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuF8GS74Li7bjSZ5HJldpA1f3lG5Bddn3tBvhSsywRfB2-77byJEa9e1HbAwJJgyyLqXYjhRgd-d1a6cIzvqopn&sig=Cg0ArKJSzKUAgjpZK7GpEAE&id=lidar2&mcvt=1000&p=0,0,600,120&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=937441900&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642173039400&rpt=931&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 15:10:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c39b8da49b4b191f00365068d8401cc38c6747b58dbb1a7f5aab9601504e201f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 all
csm.eu.criteo.net/ Frame ADFA 0
127 B 22ms
21ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:40 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/1-1/ 110 KB
23 KB 449ms
448ms XHR
application/json 54.225.57.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/1-1/Text?DocumentID=uai035OiIxyQAavPMesL-Ug

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.57.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-225-57-142.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

8d803c96979c155be2a74257a2fc6641a9c60dfe2e55a53890155b9e182ced03

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: lvlPiU6fuMtA8rFl7XPhZw
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
accept: application/json
Referer: https://www.edocr.com/v/wrnje4ow/irwinfraunfelter1124/20-or-so-tax-preparation-challenges-for-2021-filin
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 14 Jan 2022 15:10:42 GMT
content-security-policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2280

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A07D 66 KB
66 KB 15ms
14ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1167546-_x600-nocrop.jpg&v=3&w=400&s=BSa_CYNiehYpKpTcNn2jt3hT&b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

44bc4a17199ec4f353892cda3cdb02d401ba5fc9562aae091a1bf1f2fbf9151e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 14:22:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 262069
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29824953
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 67224
expires: Thu, 22 Dec 2022 19:05:26 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame ADFA 66 KB
66 KB 14ms
14ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=90357&q=80&r=2&u=https%3A%2F%2Fcdn.reisenaktuell.com%2Fimages%2F1167546-_x600-nocrop.jpg&v=3&w=800&s=KoUUKAWq2H4WAfcVueGNhS0k&b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

44bc4a17199ec4f353892cda3cdb02d401ba5fc9562aae091a1bf1f2fbf9151e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 16:05:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 255901
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=29818784
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 67224
expires: Thu, 22 Dec 2022 19:05:26 GMT

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.edocr.com/	1970-01-20 17:40:45	Name: _ga Value: GA1.2.1881395037.1642173038
.edocr.com/	1970-01-20 00:10:59	Name: _gid Value: GA1.2.1270449692.1642173038
.edocr.com/	1970-01-20 00:09:33	Name: _gat Value: 1
.edocr.com/	1970-01-20 09:31:09	Name: __gads Value: ID=54f308b64fb5ec67-226016fb1ecd001f:T=1642173039:RT=1642173039:S=ALNI_MZoIct42Jf9owT-S7coGCsMP4x0nA
.doubleclick.net/	1970-01-20 09:31:09	Name: IDE Value: AHWqTUmRPkJnkEBwB0kaWQpimo4OmjNDH7ORQxxQJH7kQfEvnlUMomv3ZS2QMy1jf6Q
.mathtag.com/	1970-01-20 08:55:09	Name: uuid Value: 748461e1-926f-4801-a330-4c324b3dce20
.awin1.com/	1970-01-20 00:19:37	Name: awpv14098 Value: 296283\|1642173040\|22997790-754c-11ec-b837-2239dbd29a89
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 379097:2519595
.medialead.de/	1970-01-20 08:55:09	Name: trscj Value: MTY0MjE3MzA0MHxMM1J5WTJzdlpYQjJMMlU1T1dGaFkyVTVOR1UyWlRVNE56TTRPREZrTXpRd01EazVNMlV4WlRkbFAzTjFZbWxrUFRJNU1UYzVPVEF3TVRRMk5EZ3lNakF3T1RVeE16a3pNREV4T0RNNU1ESTBKblE5YUhSc2NBPT18YUhSMGNITTZMeTluYjI5bmJHVmhaSE11Wnk1a2IzVmliR1ZqYkdsamF5NXVaWFF2
.doubleclick.net/	1970-01-20 00:09:33	Name: test_cookie Value: CheckForPermission
pb.media01.eu/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: jim0wsfcrn3mrtv4lc02paxm
pb.media01.eu/	1970-01-20 17:40:45	Name: DTU Value: D6FC6515CEEF6952746E6F795EA448F4

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none'

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
ad-server.eu
ads.eu.criteo.com
adservice.google.com
adservice.google.de
analytics.webgains.io
api.webgains.io
cat.nl.eu.criteo.com
cdnjs.cloudflare.com
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal900024.redintelligence.net
medialead.de
pagead2.googlesyndication.com
partner.googleadservices.com
pb.media01.eu
pix.eu.criteo.net
pixel.mathtag.com
pv.medialead.de
rtb.fr.eu.criteo.com
rtb.nl.eu.criteo.com
static.criteo.net
tags.mathtag.com
tpc.googlesyndication.com
track.webgains.com
www.awin1.com
www.edocr.com
www.google-analytics.com
www.google.com
www.googletagservices.com
104.79.88.164
104.92.94.3
138.201.63.149
138.201.84.252
142.250.186.134
142.250.186.162
145.239.193.130
178.250.0.162
178.250.2.135
178.250.2.148
18.66.248.39
185.29.132.242
2606:4700::6810:125e
2a00:1450:4001:803::2003
2a00:1450:4001:809::200e
2a00:1450:4001:80e::2004
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2001
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:812::200a
2a00:1450:4001:82a::2002
2a00:1450:4001:831::2002
2a02:2638:1::11
2a02:2638:1::2
2a02:2638:1::3
2a02:2638::2
34.242.207.34
46.236.13.147
54.225.57.142
54.76.176.197
88.198.250.30
94.23.99.218
043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da
089822305b9af8e8bf8797060fa68e6d18068b4fd7e8938f30b125ab6f61a2b9
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0beafc5b9034b1c07d55ea2130782321336ae51296e1496f3667badf303c58de
0c0af274ff36ebfef2efb3b7d9cee518cfa39b65b4d64bfabe810382fc73d9e7
144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8
16d8d5183862ab85d184342b6ffaba02f070a4f0417c7cb10d6923fdb1a18233
1b54f06ee9e4049c5fc1f7b8888163f25e87b2039953974ce0a86d31c9f89cf7
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3
21af7cc79ad4fc6414950257e806c8732ddf9224ad00d68ed96e071916c3d8a0
260152ce49fdbda7b0f1e2f69d61ce39ba49de9a161971192cdf63af15207dbf
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f51b5ea9198bf2982f667857005c8550ed774c38421d90f0c42cfbeb3952b86
31d05ba4da42b0fd9dda4cc00f3c54dc31efb8a0bcd1b3902469736ca310751f
3c277256b42c586f5f19476ebce11abf573c7a01f4f70681e7302881acb7ac5b
425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c
428f1eb7935944229430ac0fdce0033f05d9b8c1c020b87c681dd7a78ab4dd19
44bc4a17199ec4f353892cda3cdb02d401ba5fc9562aae091a1bf1f2fbf9151e
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
65e4e63638e9c69fe634cc25b595b20afe3e704f5eb8adf36a551e3c23a12ecf
6b71d2bd27010cbb01e505314423d9c903230bf4182019eb1ca8016bd2b624a0
6ef5cb36c6c0db278a57de9de89b8c809f127f4bd169dab1d25258cc1ea1bd27
72dbd696f7961daf9049faacc868865d959f3d126f40d5271f48d5d9a0ccc652
771b7bab4b257fa716af4267a8daf406193561781111b0968a37e95f14218f9e
7cf795e6c0d91a407dff9185e30afd2448e15dfe5a2dd863f6bb74c4d930e739
7e1f1bf675a0274f55e2056c029f8fc1c8cbe2539a6fc9f47386a917ac8d0022
814f1b5b03821a84eb33335cee9dea8c2e6424b5e1efef2ed8e14697fc8bc2bd
83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79
859d9e5033725311451b184fe8a1ff3ae7c6ae4ea047030e75d97bc95342b05f
8a185fa55e5b3f37e547b30de061bfdfe0940738080da78039be8a2fb407b0b4
8d369bd02b4d5c049ddb47d0982f912d558604c4a61b682dbb87f1342ac3a7f5
8d803c96979c155be2a74257a2fc6641a9c60dfe2e55a53890155b9e182ced03
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd
992884a6d38b42fe1c8de229d54f0d6e49461ea6c340fe5622daa69075484c98
9c086ce2aa60fd6d8e4cf2279af96dbd0eb33ae3f8f92760aae47f8323ab64e3
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0b515c5078fb45e345843e4b43770392a72c7c6dce4783ba904b09fdfc5ec9c
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a177819d7d599965fab101515912e55587cd45b5c93f489a44783c9019ad8d35
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a3e9a510794f1cf07a5e5d7dc400058d853e895d6071183ac47b6350c4be10b3
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
ab91b660573fdf58c8d972f31e254d912af092d75721bd93ee531981639f5712
ad246d47536dacf0256646042ec184678bfc630fcb638d9199bd66cf8cb5e457
aeb1bb43afdce87f4e486679db3f16e3ad52826cfa791f7ac90b54bde8c90101
aebb80b8612fcb3fa0fd280b6f68d10fee0e5e6d6ffc0de356223b7301e715e7
b09b4568e6d05c7d8721203cf78dd283559194f22f72159d381b4e0a12c81641
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1ba9fa4ad8fdf667f000a62ef0aebcd3b169d9e70a0e7079072471016139c68
b1cb69ec86bd33b94a22e035197e624c229073421bb6084e7a3c7c56d911ca24
b36d9c05cefabd67a960dc2aabbacaf9368e46a78f07b810eac7b35f2cab1e00
b706094f3028f980623fc37cade91e256002fcf8d94cbf1709582f40c0150cad
b8657baaa6b95a17c934001c3338f3cdff05bf8ce67ffe25c3b7ab53cd580241
b8cd0f151455686c0892982b0f4c0a602cdc7f1d8e1bd855223805ee4ada606a
bfbc4617f2afccb7fe5c69ffb9939ae529ca7e79fec94bb85ee138db0b9b4399
c39b8da49b4b191f00365068d8401cc38c6747b58dbb1a7f5aab9601504e201f
c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
d235bda23bdb333559b69a3f00b9b977a241e5a046365703c34d45c0f131c255
df10e93bfcb2f8071755df8302f7efef1adb1d7af8f590ffafe37e6923101808
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6d3c35d004dc673dcfde2897afabd8910dc3d8d64fd056913316f23885983d8
ebe11d297f467a1240e7252693f94fce732ab9d7b989fc2f86aaba0a01ae8280
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4ee0487330158d80f5bcceacae1fcadcd06bdfc2792f4f5e9bd664a3fedd23d
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
fe7f6dcaada61b62c1c420098ed25dae2c1b043b2f8eff209db4c88dace6208b

www.edocr.com Open in urlscan Pro 54.225.57.142 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

112 Requests

99 %HTTPS

45 %IPv6

21 Domains

33 Subdomains

32 IPs

5 Countries

1989 kBTransfer

4725 kBSize

12 Cookies

0 Outgoing links

Redirected requests

112 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.edocr.com Open in urlscan Pro
54.225.57.142 Public Scan

Screenshot
Live screenshot

Full Image

112
Requests

99 %
HTTPS

45 %
IPv6

21
Domains

33
Subdomains

32
IPs

5
Countries

1989 kB
Transfer

4725 kB
Size

12
Cookies

112 HTTP transactions
6 data transactions