ff-downloads.boasaude.top Open in urlscan Pro
2a02:4780:1:357:0:9da:6c33:13 Public Scan

Software

sffe /

Resource Hash

346e6776ffc7796ca15034c67c043bad204bb5295a56186d04625aa7b7985748

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122264
x-xss-protection: 0
last-modified: Tue, 25 Jan 2022 09:35:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 25 Mar 2023 11:07:28 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 107 B
734 B 140ms
48ms XHR
application/json 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=ff-downloads.boasaude.top

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/wp-content/cache/min/1/tag/js/gpt.js?ver=1643637337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cb0f703129df58815bf6e1920c389ef3647b51542c70fd5c4112074fbb32340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98
x-xss-protection: 0
expires: Fri, 25 Mar 2022 11:07:28 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 89ms
44ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=1528460935&t=pageview&_s=1&dl=https%3A%2F%2Fff-downloads.boasaude.top%2F&ul=en-us&de=UTF-8&dt=FF%20DOWNLOADS%20-%20Tudo%20sobre%20Free%20Fire!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACUABBAAAAC~&jid=2081357134&gjid=562562573&cid=471317585.1648206448&tid=UA-142523186-16&_gid=83678604.1648206448&_r=1&gtm=2ou3e0&did=dZTNiMT&gdid=dZTNiMT&z=752823660

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ff-downloads.boasaude.top/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
415 B 85ms
84ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=ff-downloads.boasaude.top&callback=_gfp_s_&client=ca-pub-8854001660855218

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8854001660855218&plah=ff-downloads.boasaude.top

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2405bded08ebea5f4a99b9147c3d49d15cdd99131461c1aa00d3c01f4159191d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 200
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 140ms
48ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ff-downloads.boasaude.top

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 146ms
50ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ff-downloads.boasaude.top

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 71ms
71ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fff-downloads.boasaude.top%2F&tn=DIV&cls=cc-window%20cc-banner%20cc-type-info%20cc-theme-block%20cc-bottom%20cc-color-override-1283581779%20&ign=false&pw=1600&ph=1200&x=0&y=1060.8

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A7CF 603 B
68 B 106ms
60ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8854001660855218&output=html&adk=3826760629&adf=1341073466&lmt=1648205932&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fff-downloads.boasaude.top%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648206447599&bpp=9&bdt=795&idt=259&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5222349203216&frm=20&pv=2&ga_vid=471317585.1648206448&ga_sid=1648206448&ga_hid=1528460935&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31065371&oid=2&pvsid=1201692695760148&pem=621&tmod=949022273&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=278

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Mar 2022 11:07:28 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Mar 2022 11:07:28 GMT
cache-control: private

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 21 KB
10 KB 665ms
618ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2526f24b3fd6a8ffc62e4342be05f3f89fa928f5dd5c327945194d4ef0a4b318

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10324
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 53 KB
18 KB 422ms
376ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1201692695760148&correlator=4397434515282262&output=ldjh&impl=fifs&eid=31061815%2C31063822&vrg=2022012501&ptt=17&sc=1&sfv=1-0-38&ecs=20220325&iu_parts=339263271%3A22641433963%2Cadex_boasaude.top&enc_prev_ius=%2F0%2F1&prev_iu_szs=120x240%7C300x600%7C120x600%7C300x700%7C160x600%7C300x1050&cookie=ID%3D2d9268f4377992f9-228e4b3265cd00ea%3AT%3D1648206448%3ART%3D1648206448%3AS%3DALNI_MZ38kaGg0vVN0-Wgmt_4tUMSkL-EQ&bc=31&abxe=1&dt=1648206448009&lmt=1648205932&dlt=1648206446804&idt=1166&frm=20&biw=1600&bih=1200&oid=2&adxs=1092&adys=1269&adks=3248737131&ucis=2&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fff-downloads.boasaude.top%2F&vis=1&stss=1&scr_x=0&scr_y=0&psz=326x240&msz=326x240&ga_vid=471317585.1648206448&ga_sid=1648206448&ga_hid=1528460935&ga_fc=true&fws=4&ohw=326&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aeafe4e7ad38b855a922f457cf80bdfd192adf03a888dd30dbb3622af6643e11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18694
x-xss-protection: 0
google-lineitem-id: 5476438951
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138323017877
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 68 KB
34 KB 927ms
881ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6a2f468d72b604ee49f153ef32f743d5928f37775d893ccadfa36da9ec68054

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34530
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3D16 6 KB
4 KB 167ms
46ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 25 Mar 2022 11:07:28 GMT
expires: Sat, 25 Mar 2023 11:07:28 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 82 KB
28 KB 150ms
48ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/wp-content/cache/min/1/ads1173.js?ver=1643637336

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f764f20f282e807aeccf2d7b42fb4461aeb92a6a0f4ce584ed3499d5f29d0b2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28081
x-xss-protection: 0
server: sffe
etag: "1168 / 714 of 1000 / last-modified: 1648172801"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 25 Mar 2022 11:07:28 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 101ms
53ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220323&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ebf5b6f435b805a9f25ae882beff99e6dfb25b37072d2080ba4efc5452de9c82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10620
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 140ms
53ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:07:29 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C8D4 0
0 74ms
73ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuMDBjsE_EvDq95OUO46CpRVervUbRJ9bixbB2yb1lYOhcZL6wGhNC5NIlPbtgkCNDyvYVlwYo4jVgMI_mjMLba_KNKidWK17RKaJF5oL97t3qfaOsoqXQ0Fq_jZrAG36pl04zhoYkgDvt5edmb3ibYbGoNS-I-QusRdaJ0f9pIA68Nf9_7BS7f1-GKuqsVqUXO4_kvxpFH9XZjabihOOIlSwTQOInr4dx3z01UBFNPtyfYj3Oa0KL71typSzA2fHmnhRaylBJLLb2Vq1vot--fkeKplKkxKEVdh_rgXXwxTeqPLUGMyqPPevQLjO-PCS-eGvDA_lGkcfz2RNQ&sig=Cg0ArKJSzJlPp9lQUP2MEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C8D4 119 KB
36 KB 109ms
61ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:07:29 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9A18 13 KB
5 KB 89ms
39ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 25 Mar 2022 11:05:09 GMT
expires: Sat, 25 Mar 2023 11:05:09 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 140
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame DA5D 783 B
1 KB 142ms
53ms Document
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

bda942da58ee4db64a989de92e9408f01a5a26fb80c867ef8b8a120cdb583ae6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UYNgpmtv6YhdGwRITwl6Zw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 25 Mar 2022 11:07:29 GMT
date: Fri, 25 Mar 2022 11:07:29 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-UYNgpmtv6YhdGwRITwl6Zw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 95ms
48ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ff-downloads.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 95ms
49ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ff-downloads.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 47 KB
17 KB 674ms
673ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1201692695760148&correlator=4397434515282262&output=ldjh&impl=fifs&eid=31061815%2C31063822&vrg=2022012501&ptt=17&sc=1&sfv=1-0-38&ecs=20220325&iu_parts=339263271%3A22641433963%2Cadex_boasaude.top&enc_prev_ius=%2F0%2F1&prev_iu_szs=120x240%7C300x600%7C120x600%7C300x700%7C160x600%7C300x1050&rcs=1&prev_scp=in2w_key%3D304%26in2w_key2%3Dnope%2Coptimization%26in2w_key3%3Dadx392%26in2w_key4%3D--g---%2C--g---%26in2w_key5%3Doptimization%26in2w_key6%3D--gh--qgz%26in2w_key7%3D392%26in2w_key8%3D304%252C305%26in2w_key9%3Doptimization_request%26in2w_key12%3Doptimization%26in2w_key15%3Do0%26in2w_key16%3D9%26in2w_keypm%3Ddiv-gpt-ad-1636061821210-0%26in2w_key9001%3D1&eri=1&cookie=ID%3D2d9268f4377992f9%3AT%3D1648206448%3AS%3DALNI_MYuMT462gFfeODnfglr9mC4lwcdCA&bc=31&abxe=1&dt=1648206448494&lmt=1648205932&dlt=1648206446804&idt=1166&frm=20&biw=1600&bih=1200&oid=2&adxs=989&adys=1269&adks=3248737131&ucis=2&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fff-downloads.boasaude.top%2F&vis=1&stss=1&scr_x=0&scr_y=0&psz=326x240&msz=326x240&ga_vid=471317585.1648206448&ga_sid=1648206448&ga_hid=1528460935&ga_fc=true&fws=4&ohw=326&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78ff7e1a5d4c1c5f1b64e1b4f90cec3849f4d00d4ca32b6a87edbda025d5e40a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16956
x-xss-protection: 0
google-lineitem-id: 5645478603
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138377412805
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js Show response
pagead2.googlesyndication.com/bg/ Frame 9A18 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e3110485bd099564f5c6cf51aa0e7bf1e946149b2dbdc3e65dcdcbae229efc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 08:12:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10524
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13638
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Mar 2023 08:12:05 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C8D4 0
0 122ms
74ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvs-YR4JA30l1fuXYDsP-lcEoLOqatsxRadLP4o5GrlZtd2KbExzzXgYCqJUz1yEDQYM6BFbR7-kEBMLF-d9cnmDve9i4NOgdPGI8To4AAY-2wuuQh4Fv0eCGaBRuTIM9FIk76O4qGs_btxE6QbBfYsdySA_jgav63dwJeCmXMYV3jzbNbZtXyPCs2ug_akXsQxmJU-UoekH0zGNmt_cy-5LdpMsngdxZO3Xn8eSD88hPh9ylUzo8uZ1-vcPKJASWdkO_etAzfdBSBMWLaPWqWHJZCCPIWveDTW-eYS0vDl6kCBj1xh7c4v9O8KXdxJFJyU4XCmYHbn6uz8xKry1A&sig=Cg0ArKJSzFoEwsd18yZzEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 25 Mar 2022 11:07:29 GMT

GET
H3 200 container.html Show response
6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 12F2 6 KB
3 KB 88ms
40ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 25 Mar 2022 11:07:28 GMT
expires: Sat, 25 Mar 2023 11:07:28 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame DA5D 0
0 87ms
86ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220323&jk=1201692695760148&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 9A18 0
9 B 39ms
39ms Image
text/plain 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?pFlHYA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C6C0 624 B
297 B 51ms
50ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDHxKr-AhjGg__EATAB&v=APEucNXbfxiFpX4P-bWrEPCtgrWR_3KXHp8fw8Fnz76j40lvgA8V4xLSqLY3pe2601CCpQ0Ac3w4FHx0PoH2O4i8ZHvi4Y7sO2I_OexmjZMwDXP_POw23Pt_G5X2LWj44rdM7PJzfFErvQ9UmTdTSBIAnVvT25Cx8uD-8UV9bXCLIceFAvDqaeU

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 25 Mar 2022 11:07:29 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FCA5 59 KB
29 KB 86ms
86ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ByFmsBggDkju58IvyUS7EQe4hUvHnNMVAOCaMJDl5c1SbNAKFEwpGrV-dVBIySpXYHW541LgpEP07xj6GjG4-3ohG7F0Gensh9jutYz1XaOuSh9xgNuwxdutFURXrOdri1AC88K7f7NjGgYsRRUhHjiH_rpA&dbm_d=AKAmf-A9itoC8Y97lkNrqhXLL7mMxDyey2LSR50n5t13bxsppVGyXtvSwlAMdB9rJZBt0eUJV13vwSIkWmcfb18uB17lQ7RrG76pL9giXziE1UnXB5ojDxB_BjBnlsBz7Uf9XtpdqJRWNMNVIFxt_7N2OVCfLrBVp2Pzzap27gjL8WMzVV9BoTVnqoOoHIvnNUfI-NHeC7tuUb3nUhsFXCLcXhFCe-R4oagbwVq0sDl7BVWfPxsbfdfC8LxxhuZonWZTBbqOjOfj1LkOyKSuN0xjAbIqbIrygB0MnDBp7ijKImaj_oDzmzyuEm2atDxvaUC1DYKFh2jYjtQ3U8kyyYBjEY3ZDbEj9HVWITFduytPtdnggEClTvgnhZKLg3YHxK1W3qQdZTkAPJRe05mZfZMY5UwBRKv54bpnU3b_D4OnascU31jLuQo97ukwCBgcVTsqzluTz5uOsAAuPa1oc43kvHwPkHYr8wW6YGXNgiCfO8FyBflqMe3HCdQ67Y8hrTLEY6L81W40G8rrNBmRnj4Mz_HWId3E_B1accR1ECpaXE3aZygtr-d2_6oquJdZvYr6K0IO33aLAm_s9ENQzlOq4suxqmM-_VY9UWFyNWhU8yNg4hk4hviI0u78Wb3Bt2ZCnwCfKWl6H8DE-N6OsOE8p-tDk_IR7xJuZ1P8HWa4cRYzO4wytRAKBk24clUs_gDHmwwM5TzBvaijTIl-vxhVto2tg0spiUvoU10ewGBnsy6SKuS8BDzLlPiG4WUZlkf3oYTZ_hCtnBMAYl2Y6r20JRtsbHL_n30jJrfSKTY0WxGNcsSpZQaRAfssCyfxjs4dknH0q4mcLQheF1wVLIdZBdttx3_w1U3v8hM2KJlUxRxBzcT8livSLslGaT-OK9lp95Q9evsr11gTp_RG-vTbBfiv5YfOOEGXDohBqn-aeOLkGnY-F9-Aljc2vOCOd0yNzeEL8Qg7fzDBKMqh0fbdgpSvH90qMZmozCFhzpLCZEVHVZ8REcPCo8rTYwE8In7Oh25EL8f-LMN_nqBnYyZ-tCO_MvhKiliXrxmN91gNfhKhT_RU0gVWfcon2KFyi5WY730lbNrjkeXSbYWCEcx2neaBplspEJ_0QxC5M7Z8JMog2tEl6iSv3X7h5G-0KFJAJXDFB8rla5One1B2a3VTesLMO3xjZpI1SRsh5ss9Lh-LuEkc9QObCsA8CUXzD5Cs2l5NK0yl_7OxzJ710chTfLGC48RC76kSyb9MP4f8JV7lEihRwP68Ts0ukxqaUAi9pAUMOoRIJP8dp2ya0lTmCu0dyIq1UdcnmFuvAnAk0BKL74vRHxhp5b6WrPpy1E0z8FB_3RREAVKr_eFpLi32MZtdLMJzcOb3Siv6CwwhvVc1M59bE1ldDcy-jrr5eojktMryAchJaIHiOBuygvUEUX7DfkY9iz9H3vT_2BGUN_XrKGt8iCYxxFykWGQSYNoUGwYvvmVnlRNb1c29DulvEOrwSDKUI3s_5u5nok8PTDhaEKs4cFanCql5FzPzb33n06oDgooC5YrnU4bZjIFlFsdcdD4z8QEg-NLM2K_xJ2MEvK5YMRdoZQTjUEEYjP97pb3aG9MYzpgPS_3lmqKyOOfME6HfOB3bhWSdQ24x-3xem8yk9cBCF3GqX1TwPA0YNLA7gnbarE6KpOnPSJpgTk_J6-FwFH-fG4OEQ6X6WPAVBQiARP5cZb-PSISsSVIaoyZj_LenE1BE5sLlRCZLaFNhDKproZXtAlRqYKdES2Vyu1_mi8x7NHALSDt6cZH-ZArhAsdil2LeOU8lid1kxyK0kq-p2o-yOs6gXUa2rmTohlGp5sTtMBop6XthnUnZgwt1EtraO6pgn9bPdxiZQ-DPoVHLC8cqTVARvxRBnR1Ha0nnWMLa3UMp8ErBCK3d92PY7cPC5D7ABah12Sjk66gRlrPngUm20JkhSO2rSqsiAAJpHIe-KQgOPtYex3Y4IozZuQmcALmB3ygPWC8kCx2-Pwo6AFcdsOSAQREy2U3NFjMDH9XgSSzU1ZYL4oKPd0XizJ7V_Yd0pQxI2tFmjEF2GkX_opfdsmVE51Xp6rh6dPm6pvJA3ZB2UOz2WzgNQxjqMnijH4hQC-9-bKHuNxI_WPPF_nu5FyJUxbMEtdmXJw3kixIjW-GztxK__PYylPsg1oGNATiIkKpg708PfzwvQSmAc3OZxDj7DsP5Pxl17S3YGDS5rwcpikX6bzL7Saw4VtIR9QDzuGTCTe9rCYpTp2BrzSxWutcURevpqme07wKZnX8jkwYUrT3oSDdy1A7i3wTFqQH93U2NAid4YbR84xj4uSjCf05TFk53xR44YsiEQTJnIYUCOWYo5qrmmgj4-YDE6UoM9oXlWlJ1pNtkbN9eTq_PthTA8Z2xkR1GNd5WsHh2myPVxPMHhGspVClxGNzhqJE9Nj0GUOm2LoE4mVOF8a4fGLHsNX6LMyGmifKgPKmUROAjZqi_hAkcQxka8QRS6sgc0KWmDHo4VPniaSL74NIQlm126xmdfu41KnWOW4S3KuccHD47hH-X4-Q-LOWyX6wL1m4WqwJFfMLAiJFWk1RkMpN4plN1ePTOgZ0G-aIZPvWWcgj6j2AhrWU_33cU0yt866-t5Rw8O1tYnPyZMKVpMnPzWgpx4TvqOn9xqPknUhTpkTfX_sP9FUwYa8g0ktUdRnWt01tznlteMy2INfX09CBhc5VPwFEN4HIRfQg9MWmSBekgTJdPo7GFWl4Di2fF9TkOZxM_HmzYl_6jocGAMHtC-ySaV1yfKTB04Kh1F2Y7HBNEORa4u3IiqkbijY2d3-eRKO2A97fN2TjMqzIdDKB3xwU3CXIM39DfWIclvF604Q5YJFvDIgtu46S1AzdcpAvz2Y_NWyKC50cu5YauQtrB2myY014qjt5IFIn46NXK1p7lH9J6IYpUKKgsJf1TQwH4N7RJcL0qrhe-Hn9l_Kn8g7XR2R2m2ojB3RNqJ_VWgvUAmRGPUJttEzmO4yXUEBF4Ix89L47L98kPa85gwZ7KpGprQn1kdAdOE4Zm6sj7x8L6amu6d4VpaH-kCL-T41ZU6Oh5so9QQ8a3pNlTpmoComSj3iW3moL7wAPx8P2zvzq5PSvYB9QdKP1u&cid=CAASJORomjs525XMnW2XjeTC6z3NP0gJzcDYoVwP9Ic2VuZ4zufO3g&rfl=2%2Chttps%253A%252F%252Fff-downloads.boasaude.top%252F%240

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cbd35640023ff597b1865098d6bce1ee12778a3274a7a594f015030255797916

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30158
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame FCA5 2 KB
1 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:03:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:03:08 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FCA5 119 KB
36 KB 64ms
63ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:07:29 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame FCA5 15 KB
6 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 186
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:04:23 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FCA5 0
0 98ms
47ms Image
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ2trlzpCycsYKyePtBd0jjAX0OGjO7ep1R3NTlPGwT2SYLHJjZNfQRcj8sSwajQ1vhs3JXTcyqm5Uwd_kPQdB4KL2NdA
Requested by: Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FCA5 42 B
63 B 71ms
71ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AxJubVKYr4jTvlGhvUktu772OUVdgTGSp02x5x-mScMOVHdif1coVmBc68aJOtHR5JkHAljKcPhZv9ZScaj9iZ-O-ed5d-F_Dthy_RWCKN_m6upmg

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C6C0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED05zw10qOMStfZlE2XTOcw&google_cver=1

43 B
894 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED05zw10qOMStfZlE2XTOcw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDHxKr-AhjGg__EATAB&v=APEucNXbfxiFpX4P-bWrEPCtgrWR_3KXHp8fw8Fnz76j40lvgA8V4xLSqLY3pe2601CCpQ0Ac3w4FHx0PoH2O4i8ZHvi4Y7sO2I_OexmjZMwDXP_POw23Pt_G5X2LWj44rdM7PJzfFErvQ9UmTdTSBIAnVvT25Cx8uD-8UV9bXCLIceFAvDqaeU
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 25 Mar 2022 11:07:29 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED05zw10qOMStfZlE2XTOcw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C6C0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yj2icYUZx1Ymp6tCO84TvQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1

43 B
894 B

32ms
19ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDHxKr-AhjGg__EATAB&v=APEucNXbfxiFpX4P-bWrEPCtgrWR_3KXHp8fw8Fnz76j40lvgA8V4xLSqLY3pe2601CCpQ0Ac3w4FHx0PoH2O4i8ZHvi4Y7sO2I_OexmjZMwDXP_POw23Pt_G5X2LWj44rdM7PJzfFErvQ9UmTdTSBIAnVvT25Cx8uD-8UV9bXCLIceFAvDqaeU
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 25 Mar 2022 11:07:29 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C6C0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFmx0FxPGNX3FigevDFFVtM&google_cver=1

43 B
1020 B

21ms
7ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFmx0FxPGNX3FigevDFFVtM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDHxKr-AhjGg__EATAB&v=APEucNXbfxiFpX4P-bWrEPCtgrWR_3KXHp8fw8Fnz76j40lvgA8V4xLSqLY3pe2601CCpQ0Ac3w4FHx0PoH2O4i8ZHvi4Y7sO2I_OexmjZMwDXP_POw23Pt_G5X2LWj44rdM7PJzfFErvQ9UmTdTSBIAnVvT25Cx8uD-8UV9bXCLIceFAvDqaeU

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:29 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3396dfca-605d-457e-8c42-f3d73ff4b3e4
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFmx0FxPGNX3FigevDFFVtM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C6C0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNjE1MDMzODUyNjM2NjAyNg%3D%3D

170 B
188 B

51ms
50ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNjE1MDMzODUyNjM2NjAyNg%3D%3D

Requested by

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:30 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 220af1e9-faa2-434d-8d20-13fd7c5b0374
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNjE1MDMzODUyNjM2NjAyNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/ Frame FCA5 25 KB
9 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ByFmsBggDkju58IvyUS7EQe4hUvHnNMVAOCaMJDl5c1SbNAKFEwpGrV-dVBIySpXYHW541LgpEP07xj6GjG4-3ohG7F0Gensh9jutYz1XaOuSh9xgNuwxdutFURXrOdri1AC88K7f7NjGgYsRRUhHjiH_rpA&dbm_d=AKAmf-A9itoC8Y97lkNrqhXLL7mMxDyey2LSR50n5t13bxsppVGyXtvSwlAMdB9rJZBt0eUJV13vwSIkWmcfb18uB17lQ7RrG76pL9giXziE1UnXB5ojDxB_BjBnlsBz7Uf9XtpdqJRWNMNVIFxt_7N2OVCfLrBVp2Pzzap27gjL8WMzVV9BoTVnqoOoHIvnNUfI-NHeC7tuUb3nUhsFXCLcXhFCe-R4oagbwVq0sDl7BVWfPxsbfdfC8LxxhuZonWZTBbqOjOfj1LkOyKSuN0xjAbIqbIrygB0MnDBp7ijKImaj_oDzmzyuEm2atDxvaUC1DYKFh2jYjtQ3U8kyyYBjEY3ZDbEj9HVWITFduytPtdnggEClTvgnhZKLg3YHxK1W3qQdZTkAPJRe05mZfZMY5UwBRKv54bpnU3b_D4OnascU31jLuQo97ukwCBgcVTsqzluTz5uOsAAuPa1oc43kvHwPkHYr8wW6YGXNgiCfO8FyBflqMe3HCdQ67Y8hrTLEY6L81W40G8rrNBmRnj4Mz_HWId3E_B1accR1ECpaXE3aZygtr-d2_6oquJdZvYr6K0IO33aLAm_s9ENQzlOq4suxqmM-_VY9UWFyNWhU8yNg4hk4hviI0u78Wb3Bt2ZCnwCfKWl6H8DE-N6OsOE8p-tDk_IR7xJuZ1P8HWa4cRYzO4wytRAKBk24clUs_gDHmwwM5TzBvaijTIl-vxhVto2tg0spiUvoU10ewGBnsy6SKuS8BDzLlPiG4WUZlkf3oYTZ_hCtnBMAYl2Y6r20JRtsbHL_n30jJrfSKTY0WxGNcsSpZQaRAfssCyfxjs4dknH0q4mcLQheF1wVLIdZBdttx3_w1U3v8hM2KJlUxRxBzcT8livSLslGaT-OK9lp95Q9evsr11gTp_RG-vTbBfiv5YfOOEGXDohBqn-aeOLkGnY-F9-Aljc2vOCOd0yNzeEL8Qg7fzDBKMqh0fbdgpSvH90qMZmozCFhzpLCZEVHVZ8REcPCo8rTYwE8In7Oh25EL8f-LMN_nqBnYyZ-tCO_MvhKiliXrxmN91gNfhKhT_RU0gVWfcon2KFyi5WY730lbNrjkeXSbYWCEcx2neaBplspEJ_0QxC5M7Z8JMog2tEl6iSv3X7h5G-0KFJAJXDFB8rla5One1B2a3VTesLMO3xjZpI1SRsh5ss9Lh-LuEkc9QObCsA8CUXzD5Cs2l5NK0yl_7OxzJ710chTfLGC48RC76kSyb9MP4f8JV7lEihRwP68Ts0ukxqaUAi9pAUMOoRIJP8dp2ya0lTmCu0dyIq1UdcnmFuvAnAk0BKL74vRHxhp5b6WrPpy1E0z8FB_3RREAVKr_eFpLi32MZtdLMJzcOb3Siv6CwwhvVc1M59bE1ldDcy-jrr5eojktMryAchJaIHiOBuygvUEUX7DfkY9iz9H3vT_2BGUN_XrKGt8iCYxxFykWGQSYNoUGwYvvmVnlRNb1c29DulvEOrwSDKUI3s_5u5nok8PTDhaEKs4cFanCql5FzPzb33n06oDgooC5YrnU4bZjIFlFsdcdD4z8QEg-NLM2K_xJ2MEvK5YMRdoZQTjUEEYjP97pb3aG9MYzpgPS_3lmqKyOOfME6HfOB3bhWSdQ24x-3xem8yk9cBCF3GqX1TwPA0YNLA7gnbarE6KpOnPSJpgTk_J6-FwFH-fG4OEQ6X6WPAVBQiARP5cZb-PSISsSVIaoyZj_LenE1BE5sLlRCZLaFNhDKproZXtAlRqYKdES2Vyu1_mi8x7NHALSDt6cZH-ZArhAsdil2LeOU8lid1kxyK0kq-p2o-yOs6gXUa2rmTohlGp5sTtMBop6XthnUnZgwt1EtraO6pgn9bPdxiZQ-DPoVHLC8cqTVARvxRBnR1Ha0nnWMLa3UMp8ErBCK3d92PY7cPC5D7ABah12Sjk66gRlrPngUm20JkhSO2rSqsiAAJpHIe-KQgOPtYex3Y4IozZuQmcALmB3ygPWC8kCx2-Pwo6AFcdsOSAQREy2U3NFjMDH9XgSSzU1ZYL4oKPd0XizJ7V_Yd0pQxI2tFmjEF2GkX_opfdsmVE51Xp6rh6dPm6pvJA3ZB2UOz2WzgNQxjqMnijH4hQC-9-bKHuNxI_WPPF_nu5FyJUxbMEtdmXJw3kixIjW-GztxK__PYylPsg1oGNATiIkKpg708PfzwvQSmAc3OZxDj7DsP5Pxl17S3YGDS5rwcpikX6bzL7Saw4VtIR9QDzuGTCTe9rCYpTp2BrzSxWutcURevpqme07wKZnX8jkwYUrT3oSDdy1A7i3wTFqQH93U2NAid4YbR84xj4uSjCf05TFk53xR44YsiEQTJnIYUCOWYo5qrmmgj4-YDE6UoM9oXlWlJ1pNtkbN9eTq_PthTA8Z2xkR1GNd5WsHh2myPVxPMHhGspVClxGNzhqJE9Nj0GUOm2LoE4mVOF8a4fGLHsNX6LMyGmifKgPKmUROAjZqi_hAkcQxka8QRS6sgc0KWmDHo4VPniaSL74NIQlm126xmdfu41KnWOW4S3KuccHD47hH-X4-Q-LOWyX6wL1m4WqwJFfMLAiJFWk1RkMpN4plN1ePTOgZ0G-aIZPvWWcgj6j2AhrWU_33cU0yt866-t5Rw8O1tYnPyZMKVpMnPzWgpx4TvqOn9xqPknUhTpkTfX_sP9FUwYa8g0ktUdRnWt01tznlteMy2INfX09CBhc5VPwFEN4HIRfQg9MWmSBekgTJdPo7GFWl4Di2fF9TkOZxM_HmzYl_6jocGAMHtC-ySaV1yfKTB04Kh1F2Y7HBNEORa4u3IiqkbijY2d3-eRKO2A97fN2TjMqzIdDKB3xwU3CXIM39DfWIclvF604Q5YJFvDIgtu46S1AzdcpAvz2Y_NWyKC50cu5YauQtrB2myY014qjt5IFIn46NXK1p7lH9J6IYpUKKgsJf1TQwH4N7RJcL0qrhe-Hn9l_Kn8g7XR2R2m2ojB3RNqJ_VWgvUAmRGPUJttEzmO4yXUEBF4Ix89L47L98kPa85gwZ7KpGprQn1kdAdOE4Zm6sj7x8L6amu6d4VpaH-kCL-T41ZU6Oh5so9QQ8a3pNlTpmoComSj3iW3moL7wAPx8P2zvzq5PSvYB9QdKP1u&cid=CAASJORomjs525XMnW2XjeTC6z3NP0gJzcDYoVwP9Ic2VuZ4zufO3g&rfl=2%2Chttps%253A%252F%252Fff-downloads.boasaude.top%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:05:46 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/elements/html/ Frame FCA5 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:00:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:00:40 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FCA5 0
61 B 198ms
89ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsviiHhx26AzP0cUl5g_SUfUorsI58McjYd_vFbFsQskczI9p1tZ1w8cmAagDZTTz2NHwHZ6-xysCyZZUftEGznCkwESEekzMlpRdjf0zGiNruDNNm_YjtmeMM0WIUZGPFsoPk4mqnIgzaRbHcNrjF0L-Eef_CfUANRUwCLV-Yl-Lo8L-xOUZa_DLjCFRl36GoVqQ8bEb8XrigU1s4ttloKHIkp5Yfol4lmFP0JM5pvNEeT8mQYfI_1rFc8GBGPjgiuV7iKLeBpuMAH-KyjSmMFJsqIv1m9Lzs5VHSmgXInzIQAH8bIDqR9MXTcvpHvldBNKxGMV1xVhjdMcWO33DQ87-rKpCZfqEuILgTTLYDSFLAfl9tNF8h4UmbYQkvpLGsgVanbnkZu5XSlc3DoQ0pA0umlot4I8htxK3eYEXNB_FhSFSgakzlI6S7UcqQ-m7TyKCIW4w480vtlkjsOKgMobqLtJiTQMDKnw1AsIyHpG3XJ47YsdoiZyTM8q_OK8KHzOaOVocWej4FHBm2pYIEzrersTiMeOHSHbBjp32zQaiJJvjcjI0QAtSIjZJBY2-Uab9w8RYsj_z6HaOK8xd-s_-oPk5FTXcbXZ-Sthuv1hEP_pHu3Y0lx3Plx_LVlURLNM0NQU9Ln4-7aclPvNWrLkuGL0a0tHh8qWy69lajqyqmrlTXwA4d7w4hP4GFMoaI-Ot7OjNQCH1q_qEbPBk1EiQugweNecYXwRHnIJdC38EHfZo8ntLV0uW-IrQL_aStW8g-ZZI2QvNcQLzFjtc8AjpSisaaWWt-tzO_vlxLh44oDN4YPXujnRhNVhmtltoWkPUaI0Q1gFomtm8HIF4pe8NDITQB-hDPARsopK3XzHFVz2Pl7Y6HdnAtcotYfkt9MfkJ5Ru8-faYZQATYQqBSK9lcZK7ZYeNgIKymZ3y8AUhDDEmsdYQjW1wkq40x4jevIHRI6a1BPUw9W72PeY8JunlY9VRy8JakFCDIDqxc3QqZnqLsueh3hSAGXyGwZEc5szlnfR71X2G82Ps-87oYpz44gVx6_A42CRkAbsARtKWCYKx4LP_RyX1igv4MDlAenKffnps1cykqEKst4U3FwocuPhqJpeE-H0pvmUlw--dyE3h8US-rmtQzl-dlmWOn-Ath1XpU5N9ez41NooHHuLYu5xSUMs0SXZeVH8W9mF0l1kwZtHtHn4G3t4jNqv5eZBlmbE6yu8l-nMlMisqtswRtyQzp907Fxj6t-Ki8&sai=AMfl-YR-3A1b55zVkWsL3KBzVd2s4ZJH5oCU8KEn9H2LmRkUOPEVilWQ_m_TxIvcVZAk1zQIzi_uzJ6wbm3U6X4ebESP1yaP3W8xkmOPGLVcKva6YltUm-gDxIwpQPxME-qlLq1Ve97VW41fZOXgWU7h86KPYLne9oOINKEtZLIwpBnomoreHIvxVjC81aqbN59qV_ET3TLbz_5rgdLa_wDp0w&sig=Cg0ArKJSzJ4-g148De4REAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220323.50875&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 25 Mar 2022 11:07:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FCA5 41 KB
15 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 09:34:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91981
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Mar 2023 09:34:28 GMT

GET
H2 200 5324401169770939005
s0.2mdn.net/simgad/ Frame FCA5 35 KB
35 KB 204ms
76ms Image
image/jpeg 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5324401169770939005

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

391df7a0034ee9dd9e2ed067f6003949ddf074ebcac4beb100847dcffc75c9d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 05:00:07 GMT
x-content-type-options: nosniff
age: 22042
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35657
x-xss-protection: 0
last-modified: Thu, 04 Nov 2021 22:49:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Mar 2023 05:00:07 GMT

GET
H3 200 container.html Show response
6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9B72 6 KB
3 KB 47ms
47ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 25 Mar 2022 11:07:28 GMT
expires: Sat, 25 Mar 2023 11:07:28 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6BDD 1 KB
749 B 39ms
38ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 24 Mar 2022 13:26:12 GMT
expires: Fri, 25 Mar 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 78077
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame FCA5 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ae5da17551a9ddfcecabea482b4dd361ea579c5a3a213da93490ee0ab586a69

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 932C 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Mar 2022 09:34:28 GMT
expires: Fri, 24 Mar 2023 09:34:28 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 91981
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C64F 624 B
297 B 51ms
51ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYY466iwwEwAQ&v=APEucNXWC51CMO5bT6opf2Tk2aH_K0s_tSnmm7Xg7TV5xNSYdGaaJWJOv30kBLdBObcoxVxdm4jFCsSE0U9dYJejR-kegwXbZKuj_DWCwwIT_uLHLOsjCP6n7xCh32uUJjiTve2xjXpAtkP-vU54paOXHFciyfzzdnt4fzG2eqNP8yV3tVb3-Oo

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 25 Mar 2022 11:07:29 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/ Frame 9B72 19 KB
8 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/abg_lite_fy2019.js

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 10:55:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 738
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 10:55:11 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/elements/html/ Frame 9B72 6 KB
3 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 10:01:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3971
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2626
x-xss-protection: 0
server: cafe
etag: 8548655983161038638
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 10:01:18 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9B72 0
571 B 92ms
85ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv7_VBXuBSO_0kbBQUiPJhagDhbHW9qYOEoLvfj09f6i9B8MkiA4ONWBL09FaKKEVufWlAKwZEl_r6vYQe5-3_wbVxxhswq2FW1cUnBY3-YNOXy-4bFthmBW90YEAMAWv6ZavQuHMPsJ8LS9-jN-H75A6l5pJ5bTbF2I4ku16MCdlvv1zFmozbiGR3jBa5MB2KhhIpKlFfxXUKZP2Yoar38hzTQbSYEMzd7rLXLEc28-az5_AarT_NI2DMdwlr0ZJD-s45bm-agWCU7x1da4UZfCyyOzsU-jEAq9y53MQXdyet9g0nHAHiVHHTh_HN7W7ubfTV_wLTaDWjdlbJSh2flj-KPycYUKfT0F9FaRTqLHYF5bwUu5Jqr8yK9BOg3-X3WP3_o6aLSd2cxf3qQzMFKXEKpuorrmrpVMZLlWZo7HA3FT8ugT4AsqZz4YB7T4YE9DffY1PfD7h9tfTBNB2RqQky5Og8bpjRTqbZX4mbGCYM7pLcJy66mnzQwNnCZ5Dbp8zeyuYLJ5qyH5ypfFGQnjaRsETbfTyknQsdRS5mrdfd4McIAAa6GoopN1PMNy1TlKPt4PBcBDhVTybLahxhLPwVxm2sdHy6n-h_6q8a2iVXgGNPkudm_zAfGtg06ye2ytpuoLquqyYTReP_JHvjcovLszmX_vjOkLiBHGjHbCu6gUVzIa0dyscbn5nMlPrGPmbulG1gMAUnyjGh6l8rsOwpkJC8gijzqY6CjVQ99ORKgo1mh8UhP1WuGVmcpPZuGp62frUvpB0Yq9Qitm-E7VEFI0U2tiu425zQcoMRJSX5CdHpUnSQXLmU79QrmGlD2vmlm6GNmr1ZTdNvGEiFdPYLBXhdAOD-mT9d9gYG9LRzxsO9O8gsCwXBoRILrS2RlaXYzWRB30TWH9QlRkcLPtUAZwSCZON5pwLpSzi5XvJlvHLP1BnBvJHcR8ZtuVsdOXt1fz_7ieSYXZ6q9wNnt9JWh9OYXxuBgeH8f1zpIMWM-SJrh1Zek4nsuONzLPCXUj6kG6uPdOXyhdw-EVhI5puhm6swOr_0IMdCr_eX3r-TQtJopDOu9kVaDelQVQkiuvUAnhOY__5vmAFuuxRl71UgP8GyphKGTFSSu5cwcu8gnvudI_vrChJsF54RqPXwmUnL74bCFkSpwEcNcj30rPsm6HU67r1EmghpDPz4J_srtsQhu_XQdv5cWCHCHG1iEtumxhztbu6T6nrOLz-tBqqnFiBHREX_BXnvLHevLFqiopwX8BQwRykocoSXKUnUGwsUH6R-E3g&sai=AMfl-YRBAXck9IOlwoSnAcQQXhDMmEEiyrnZF-s3r-kV1E8ndHZtPuf2Ebg31NilIFU3dF1av_OnEvC7dsPvV41Bzu1it8RceQ-_E5xfkpPouCVhyZdu89H24aHKBkqDoNAeURTcmxSOSTzYkGt_vvQ623bcJAAwPU90o_hAHV85-XfBrjOw8Oi4_W-UqMtamRcRKRnFDJ9w76mr7fHJ-C57YRlpxWy5jL1cr6kHcUPt_7PU9eviUo8cvkF3qP5k2q8L3FgMzNQXYhWve1MI14Ls3Tr26zVzb6Xmrj1HznaY3OCQk86sjsxOAY2RFZY11Q&sig=Cg0ArKJSzKbYmW4w7AM0EAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220323.52622&adurl=

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 25 Mar 2022 11:07:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9B72 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 09:34:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91981
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Mar 2023 09:34:28 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B72 42 B
63 B 71ms
71ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ALBa9KTvdT3m87lJSNU8Jj-oRNXm3fC2XA-3qSeMQkZKD7USkJV2HPFQvHUxm4DJwofP7kd5qd6AuPhJhAfC61dS_C5Fz8Estt_nNwiAojyV8VIqA

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 9B72 2 KB
1 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:03:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:03:08 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9B72 119 KB
36 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:07:29 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 9B72 15 KB
6 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 186
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:04:23 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9B72 0
0 48ms
48ms Image
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQr-vGYYWOwrj83H5eURITqHoirZwaEjYLPO__WAoaq5x6Uaw3bkHif_jg_kVV8zDDUWFM2xLyMBoA32_3QEz8wgEubOQ
Requested by: Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 200 6615449515810653448
s0.2mdn.net/simgad/ Frame 9B72 20 KB
20 KB 63ms
40ms Image
image/jpeg 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/6615449515810653448

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4b11d0c1d66dc940f21cc2e12cc35dbb2eac0747b071a844209183fce8110f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 09:43:07 GMT
x-content-type-options: nosniff
age: 5062
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20147
x-xss-protection: 0
last-modified: Thu, 24 Feb 2022 17:17:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Mar 2023 09:43:07 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BDD
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFEKP-6ysar7oRC72r0ausI&google_push=AYg5qPJ5qxWx2Kgebp8COdhwOMp5n4etaz7lqklEaHKBmYEhCqsOa6D2kx...

170 B
188 B

50ms
50ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFEKP-6ysar7oRC72r0ausI&google_push=AYg5qPJ5qxWx2Kgebp8COdhwOMp5n4etaz7lqklEaHKBmYEhCqsOa6D2kxW3nmQaU4WIN1u3hrcML2qFd7jhVT1RWhWTnxowD4kKgg

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1648206450.767610,VS0,VE93
x-served-by: cache-hhn4081-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFEKP-6ysar7oRC72r0ausI&google_push=AYg5qPJ5qxWx2Kgebp8COdhwOMp5n4etaz7lqklEaHKBmYEhCqsOa6D2kxW3nmQaU4WIN1u3hrcML2qFd7jhVT1RWhWTnxowD4kKgg
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 6BDD 0
191 B 73ms
19ms Image
text/plain 66.155.71.25
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEBhTpWuS-PisNXqXXQA5Um0&google_cver=1&google_push=AYg5qPKehK6qYM5-i7WVa-aAqJzIWGftjEgREaB6wlZgtxd5pJ6OnSHPMT-OSqWGsOp5qOrRG1Hqhqot7o6upiv5dgyovxu6wk2S
Requested by: Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BDD
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEKzL-PO9nWwd1mFnmrOZeNY&google_cver=1&google_push=AYg5qPIec-Mpme1FRexiOwZn6hngJiO9hU7RrYzc2iFM4da90-7spJF0X9L7JUb5x3y8alskH3UEucR9eqpP4O...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA3ODk5Mjc5NTUyOTc3MTE2Mg%3D%3D&google_push=AYg5qPIec-Mpme1FRexiOwZn6hngJiO9hU7RrYzc2iFM4da90-7spJF0X9L7JUb5x3y8alskH3UEucR9eqpP4OITUT...

170 B
188 B

102ms
54ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA3ODk5Mjc5NTUyOTc3MTE2Mg%3D%3D&google_push=AYg5qPIec-Mpme1FRexiOwZn6hngJiO9hU7RrYzc2iFM4da90-7spJF0X9L7JUb5x3y8alskH3UEucR9eqpP4OITUTBm4_mGPkfCgw

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA3ODk5Mjc5NTUyOTc3MTE2Mg%3D%3D&google_push=AYg5qPIec-Mpme1FRexiOwZn6hngJiO9hU7RrYzc2iFM4da90-7spJF0X9L7JUb5x3y8alskH3UEucR9eqpP4OITUTBm4_mGPkfCgw
Date: Fri, 25 Mar 2022 11:07:29 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BDD
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEM4n63iH7USIis63iF761RE&google_cver=1&google_push=AYg5qPLteu9NtmmbqG9qUGymA3ibSwO7yW2Lf1PB3-pLIpcD9lByaQ_FJcnOSxFak85EjDMvPn63rChOxQC49Pr6R5cW0pi...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEM4n63iH7USIis63iF761RE&google_cver=1&google_push=AYg5qPLteu9NtmmbqG9qUGymA3ibSwO7yW2Lf1PB3-pLIpcD9lByaQ_FJcnOSxFak85EjDMvPn63rChOxQC49Pr6R5cW0...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLteu9NtmmbqG9qUGymA3ibSwO7yW2Lf1PB3-pLIpcD9lByaQ_FJcnOSxFak85EjDMvPn63rChOxQC49Pr6R5cW0piCdB4vAQ

170 B
188 B

51ms
51ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLteu9NtmmbqG9qUGymA3ibSwO7yW2Lf1PB3-pLIpcD9lByaQ_FJcnOSxFak85EjDMvPn63rChOxQC49Pr6R5cW0piCdB4vAQ

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLteu9NtmmbqG9qUGymA3ibSwO7yW2Lf1PB3-pLIpcD9lByaQ_FJcnOSxFak85EjDMvPn63rChOxQC49Pr6R5cW0piCdB4vAQ
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BDD
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEC_DGrRtsrJC4hxa7YFPJ7M&google_cver=1&google_push=AYg5qPK6yk4Rnrme4X81hfn6_mZ0VUiOlVFHZ67yzCKcWJuZ4ffa3OparTvEQ79tDQ5FIRY6sVJ...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE2QktCWE0tMy0yT1hO&google_push=AYg5qPK6yk4Rnrme4X81hfn6_mZ0VUiOlVFHZ67yzCKcWJuZ4ffa3OparTvEQ79tDQ5FIRY6sVJluJszuJjamhBVVFnV-gY3xOk_

170 B
188 B

89ms
56ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE2QktCWE0tMy0yT1hO&google_push=AYg5qPK6yk4Rnrme4X81hfn6_mZ0VUiOlVFHZ67yzCKcWJuZ4ffa3OparTvEQ79tDQ5FIRY6sVJluJszuJjamhBVVFnV-gY3xOk_

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE2QktCWE0tMy0yT1hO&google_push=AYg5qPK6yk4Rnrme4X81hfn6_mZ0VUiOlVFHZ67yzCKcWJuZ4ffa3OparTvEQ79tDQ5FIRY6sVJluJszuJjamhBVVFnV-gY3xOk_
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 6BDD 0
75 B 84ms
17ms Image
text/plain 185.86.139.103
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEFdm-qqsWvOtlw8cF3WbwzQ&google_cver=1&google_push=AYg5qPIYUyEsmrbxHi6HEZWr2o-V99Kbl5gyVyNxsZWMOgJ30zzieBSu4c4rpR4dnuC5Ul0GJwtCwLcsydlPG_LDpodr3N3SQI5q
Requested by: Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.103 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BDD
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESELMpZ4LiZQrYNP8T18lym-Y&google_cver=1&google_push=AYg5qPLtfuJhkHVBSzjFtAg8iOfdIzvvxQaD28r7WEnUdNUw1O7YYK9TzZMn1TUVZhKxo29XSp...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESELMpZ4LiZQrYNP8T18lym-Y&google_cver=1&google_push=AYg5qPLtfuJhkHVBSzjFtAg8iOfdIzvvxQaD28r7WEnUdNUw1O7YYK9TzZMn1TUVZhKxo29XSp...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1CcE5nRGJSRTJ1R3dYTFZQX3dhNDgwLjlWSFByZFJ3cX5B&google_push=AYg5qPLtfuJhkHVBSzjFtAg8iOfdIzvvxQaD28r7WEnUdNUw1O7YYK9Tz...

170 B
188 B

54ms
53ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1CcE5nRGJSRTJ1R3dYTFZQX3dhNDgwLjlWSFByZFJ3cX5B&google_push=AYg5qPLtfuJhkHVBSzjFtAg8iOfdIzvvxQaD28r7WEnUdNUw1O7YYK9TzZMn1TUVZhKxo29XSpOoH1daz1FJ0WBxtT2VJVQZSyzol-I

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1CcE5nRGJSRTJ1R3dYTFZQX3dhNDgwLjlWSFByZFJ3cX5B&google_push=AYg5qPLtfuJhkHVBSzjFtAg8iOfdIzvvxQaD28r7WEnUdNUw1O7YYK9TzZMn1TUVZhKxo29XSpOoH1daz1FJ0WBxtT2VJVQZSyzol-I
date: Fri, 25 Mar 2022 11:07:29 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 6BDD 0
59 B 47ms
46ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jod7zoNFBV7zMq0Bl0OGq-wz_hb4jMVnUgxe8wJ7_mbFY2VU2l5onzUxuVXwTlL6rFkM4H5w

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js Show response
pagead2.googlesyndication.com/bg/ Frame 932C 35 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e3110485bd099564f5c6cf51aa0e7bf1e946149b2dbdc3e65dcdcbae229efc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 08:12:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10524
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13638
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Mar 2023 08:12:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0822 1 KB
749 B 40ms
38ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 24 Mar 2022 13:26:12 GMT
expires: Fri, 25 Mar 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 78077
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C64F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1

43 B
894 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYY466iwwEwAQ&v=APEucNXWC51CMO5bT6opf2Tk2aH_K0s_tSnmm7Xg7TV5xNSYdGaaJWJOv30kBLdBObcoxVxdm4jFCsSE0U9dYJejR-kegwXbZKuj_DWCwwIT_uLHLOsjCP6n7xCh32uUJjiTve2xjXpAtkP-vU54paOXHFciyfzzdnt4fzG2eqNP8yV3tVb3-Oo
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 25 Mar 2022 11:07:29 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C64F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yj2icYUZx1Ymp6tCO84TvQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1

43 B
894 B

16ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYY466iwwEwAQ&v=APEucNXWC51CMO5bT6opf2Tk2aH_K0s_tSnmm7Xg7TV5xNSYdGaaJWJOv30kBLdBObcoxVxdm4jFCsSE0U9dYJejR-kegwXbZKuj_DWCwwIT_uLHLOsjCP6n7xCh32uUJjiTve2xjXpAtkP-vU54paOXHFciyfzzdnt4fzG2eqNP8yV3tVb3-Oo
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 25 Mar 2022 11:07:29 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAByub7GptqOwFvvBZFYRyk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C64F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFN-8IwelAlqUO4rrQpUdso&google_cver=1

43 B
1020 B

9ms
8ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFN-8IwelAlqUO4rrQpUdso&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYY466iwwEwAQ&v=APEucNXWC51CMO5bT6opf2Tk2aH_K0s_tSnmm7Xg7TV5xNSYdGaaJWJOv30kBLdBObcoxVxdm4jFCsSE0U9dYJejR-kegwXbZKuj_DWCwwIT_uLHLOsjCP6n7xCh32uUJjiTve2xjXpAtkP-vU54paOXHFciyfzzdnt4fzG2eqNP8yV3tVb3-Oo

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:29 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: c691b535-852f-47a6-8e9a-aabbed6949e7
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFN-8IwelAlqUO4rrQpUdso&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C64F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNjE1MDMzODUyNjM2NjAyNg%3D%3D

170 B
188 B

60ms
54ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNjE1MDMzODUyNjM2NjAyNg%3D%3D

Requested by

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:29 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: c5dc78de-1c97-4412-88aa-03f57da1053b
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNjE1MDMzODUyNjM2NjAyNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E863 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Mar 2022 09:34:28 GMT
expires: Fri, 24 Mar 2023 09:34:28 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 91981
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 175 KB
64 KB 103ms
55ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7K1FEGD034

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/wp-content/cache/min/1/ads1173.js?ver=1643637336

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b95219067f72d033c73038390c79dc05b5940a3ce0389342dee1679cb40deb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65851
x-xss-protection: 0
expires: Fri, 25 Mar 2022 11:07:29 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9B72 0
23 B 125ms
77ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 9B72 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 902a147e82a4c8e867d8535874bfdbf15491b5a6432a985a3126cee9107f156d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET activeview
pagead2.googlesyndication.com/pcs/ Frame C8D4 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 279F 0
0 75ms
73ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNvrmIQ2jew3zzzW5Vfhu_lsW2XLZlxzC3wAh9RBFIQXmxlAzS-wxvi1Xqv2OB69VxNA8JtGvwCtEeK2SOOgqqMasKE_8_vMUnOOl-oyRjpvbWRHj06pO1OieTjQnPJqtvP9G4xdsPLI9mRW3gXUg-Vlus2Pt9ia_j5kbzPMwLCeOGY74t3YJMKjnXvM2cS4vOAeeQ0FR9okc3PsKuTCkl-3mdM7p7xbD1R2XmFnUvG_V9ILCIZqgImEZgNnfXf_rvntghsDY_2bZXACUEj69moI6Mg0dmlMODdcqT1W_ITa7gQtB9ldOV7YWiFr4cj9rEHwugAoVm-M8kqV0&sig=Cg0ArKJSzMC3MZmRjIoWEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 279F 119 KB
36 KB 62ms
62ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:07:29 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 48ms
48ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ff-downloads.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 50ms
50ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ff-downloads.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
11 KB 291ms
290ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1201692695760148&correlator=4397434515282262&output=ldjh&impl=fifs&eid=31061815%2C31063822&vrg=2022012501&ptt=17&sc=1&sfv=1-0-38&ecs=20220325&iu_parts=339263271%3A22641433963%2Cadex_boasaude.top&enc_prev_ius=%2F0%2F1&prev_iu_szs=120x240|300x600|120x600|300x700|160x600|300x1050&ris=1&rcs=2&prev_scp=in2w_key%3D305%26in2w_key12%3Doptimization%26in2w_key15%3Do0%26in2w_key16%3D1%26in2w_key2%3Dnope%2Coptimization%26in2w_key3%3Dadx392%26in2w_key4%3D--g8gz%26in2w_key5%3Doptimization%26in2w_key6%3D--gh--qgz%26in2w_key7%3D392%26in2w_key8%3D304%2C305%26in2w_key9001%3D2%26in2w_keypm%3Ddiv-gpt-ad-1636061821210-0&eri=1&cookie=ID%3D2d9268f4377992f9%3AT%3D1648206448%3AS%3DALNI_MYuMT462gFfeODnfglr9mC4lwcdCA&bc=31&abxe=1&dt=1648206449233&lmt=1648205932&dlt=1648206446804&idt=1166&frm=20&biw=1600&bih=1200&oid=2&adxs=989&adys=1269&adks=3248737131&ucis=2&ifi=6&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fff-downloads.boasaude.top%2F&vis=1&stss=1&scr_x=0&scr_y=0&psz=326x240&msz=326x240&ga_vid=471317585.1648206448&ga_sid=1648206448&ga_hid=1528460935&ga_fc=true&fws=4&ohw=326&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

591c7fa17f1c71934aadcb4c615ad10cffd53c73f298a53c325709a64bf5492f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10767
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FCA5 0
23 B 78ms
77ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 0822
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEAJuOK1nb4M6HX55lMeQX_8&google_cver=1&google_push=AYg5qPIoy-59Os8IxytLVFZc3uUP62aeVVNcTX6nHdKg_4oHf-Xzw8U6gUWDfhIhpe_1W03X4iAC9E3NZjZECrCl-ZXiUaQGBEGe
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzQ2MzY2MDQ4OTU0MzU2ODcyMA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEAJuOK1nb4M6HX55lMeQX_8&google_cver=1

43 B
398 B

49ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEAJuOK1nb4M6HX55lMeQX_8&google_cver=1
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEAJuOK1nb4M6HX55lMeQX_8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0822
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEJI7-4QS0GGorvRz41_BYWM&google_cver=1&google_push=AYg5qPKS1mQHK5LO7L0j1crCO07kiEWCAw6OGZ-wZb1UeivAzM3PKmUlM9EFygPA1kZ2110nCJu6sZjRAoAlEh8e...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPKS1mQHK5LO7L0j1crCO07kiEWCAw6OGZ-wZb1UeivAzM3PKmUlM9EFygPA1kZ2110nCJu6sZjRAoAlEh8eRaVM9lTbxSizHw

170 B
188 B

51ms
51ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPKS1mQHK5LO7L0j1crCO07kiEWCAw6OGZ-wZb1UeivAzM3PKmUlM9EFygPA1kZ2110nCJu6sZjRAoAlEh8eRaVM9lTbxSizHw

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 25 Mar 2022 11:07:29 GMT
Server: MT3 4267 dd20a5c master cdg-pixel-x30 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPKS1mQHK5LO7L0j1crCO07kiEWCAw6OGZ-wZb1UeivAzM3PKmUlM9EFygPA1kZ2110nCJu6sZjRAoAlEh8eRaVM9lTbxSizHw
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 25 Mar 2022 11:07:28 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0822
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEFVY_9BIT6oBenGFCnybtQk&google_cver=1&google_push=AYg5qPK6R8vHrvAEnl_fE2XPki__2l0SBND_BTm9igMYgqnWQARzWkU7DMvVHDdHSEZrqjw2AhWssyh4...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEFVY_9BIT6oBenGFCnybtQk&google_cver=1&google_push=AYg5qPK6R8vHrvAEnl_fE2XPki__2l0SBND_BTm9igMYgqnWQARzWkU7DMvVHDdHSEZrqjw2AhW...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODU1OTIwNTI0MTgxMTQ0NzE4OA&google_push=AYg5qPK6R8vHrvAEnl_fE2XPki__2l0SBND_BTm9igMYgqnWQARzWkU7DMvVHDdHSEZrqjw2AhWssy...

170 B
188 B

51ms
50ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODU1OTIwNTI0MTgxMTQ0NzE4OA&google_push=AYg5qPK6R8vHrvAEnl_fE2XPki__2l0SBND_BTm9igMYgqnWQARzWkU7DMvVHDdHSEZrqjw2AhWssyh4tMbXzFew1Q_HK3py-ZHPiQ

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODU1OTIwNTI0MTgxMTQ0NzE4OA&google_push=AYg5qPK6R8vHrvAEnl_fE2XPki__2l0SBND_BTm9igMYgqnWQARzWkU7DMvVHDdHSEZrqjw2AhWssyh4tMbXzFew1Q_HK3py-ZHPiQ
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0822
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJV-nuzWatnQ-R5UvVCFd-4&google_cver=1&google_push=AYg5qPJwwNkvSsis9VQGg3Ty7PRwxiOP6nIy3fadt6Ky0QYsv2swIAVHSsq5C51g57Nh62S69vX...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE2QktDMUgtUS1BU1dJ&google_push=AYg5qPJwwNkvSsis9VQGg3Ty7PRwxiOP6nIy3fadt6Ky0QYsv2swIAVHSsq5C51g57Nh62S69vXTe_KvX5HCarMqe3EZh34ADZYz

170 B
188 B

51ms
50ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE2QktDMUgtUS1BU1dJ&google_push=AYg5qPJwwNkvSsis9VQGg3Ty7PRwxiOP6nIy3fadt6Ky0QYsv2swIAVHSsq5C51g57Nh62S69vXTe_KvX5HCarMqe3EZh34ADZYz

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE2QktDMUgtUS1BU1dJ&google_push=AYg5qPJwwNkvSsis9VQGg3Ty7PRwxiOP6nIy3fadt6Ky0QYsv2swIAVHSsq5C51g57Nh62S69vXTe_KvX5HCarMqe3EZh34ADZYz
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 0822
Redirect Chain

https://onetag-sys.com/sync/i,19/?google_gid=CAESEHtxlk-bn4pW0DQgQMRRJOM&google_cver=1&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPLnvFa8GObnvVb74Mqp1q2oPo1zbxjriTaBfjHgvgmxgnnNE24cILEE573gYAfklyOCDe6q48dWZjsu7jjQ3wbFpcnF0A42EA

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0822
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESELJ2P73Y3DwT9FQFGqv4Heo&google_cver=1&google_push=AYg5qPLBDriNtpni4ZkWdSQT6kf4YVLEROHtpQj_ADEhkxs8KOqfrf6PuFnFc9-l5ZYX2a_wmP...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1CcE5nRGJSRTJ1R3dYTFZQX3dhNDgwLjlWSFByZFJ3cX5B&google_push=AYg5qPLBDriNtpni4ZkWdSQT6kf4YVLEROHtpQj_ADEhkxs8KOqfrf6Pu...

170 B
188 B

53ms
51ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1CcE5nRGJSRTJ1R3dYTFZQX3dhNDgwLjlWSFByZFJ3cX5B&google_push=AYg5qPLBDriNtpni4ZkWdSQT6kf4YVLEROHtpQj_ADEhkxs8KOqfrf6PuFnFc9-l5ZYX2a_wmP1lvPTeS7uKwkxf4I5sr2ixsrsDRng

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1CcE5nRGJSRTJ1R3dYTFZQX3dhNDgwLjlWSFByZFJ3cX5B&google_push=AYg5qPLBDriNtpni4ZkWdSQT6kf4YVLEROHtpQj_ADEhkxs8KOqfrf6PuFnFc9-l5ZYX2a_wmP1lvPTeS7uKwkxf4I5sr2ixsrsDRng
date: Fri, 25 Mar 2022 11:07:29 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 0822 43 B
65 B 99ms
50ms Image
image/gif 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEJDMTqfkBG0LPkZtPfHwIQ0&google_cver=1&google_push=AYg5qPKKLTASIfZCLhMNkQ_iLe9aGBM8HSCu6pYL-3esfaxHxMrMnPZUF-mP6wuzEmay0-MtnCEbTZvUQyupZmJox9j851yA0iCrVaI

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 26 Mar 2022 11:07:29 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0822 0
12 B 49ms
48ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K8hb_4v2qtKXaQF-abqIyROCwT4OwU5J4vfYdXg9Z6Oj0DZlU7Ik5d-9H5_b3F1ML7UJpwz0g

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js Show response
pagead2.googlesyndication.com/bg/ Frame E863 35 KB
13 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e3110485bd099564f5c6cf51aa0e7bf1e946149b2dbdc3e65dcdcbae229efc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 08:12:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10524
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13638
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Mar 2023 08:12:05 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 279F 0
0 76ms
75ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvh_vabqUjRmeCBze9RVFglvuM5EkHLRkW_R5m1fNxYxHmbbQwWKaah6GBEHvmHhou8BuVa7AiOwIMmJZrVQgfqZG3ORtT1x78layNMHxsEju3o_f8L7RX4GPxFxPziWrbj92BIvpAFa7uCmtUNiiSwxogeNGczFVaan3KlPbd0xyjzHWbTRqug1jd9ONo4He_2HkVCNApixhVgEf2qSRe7zJzW-wJmoEEmB_CXZuRnbW4-qyJ39-JwJizuKJLc8GFl4ZOj4GWbaYqeZ2OueTtIepX-gCnmClaeC3PnZtdQMqYk2NoDhuVoNwM7rPmGmFgjb5WoP-VFoB9UeSPgjQ&sig=Cg0ArKJSzB1xHm_s8caaEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 25 Mar 2022 11:07:29 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 52ms
52ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-181670863-2&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-142523186-16

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ef07f03ccdea64c15e7b203d5997bdfb2a0632a3a9ca29a0c8fd6ceb7fd0935

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37579
x-xss-protection: 0
last-modified: Fri, 25 Mar 2022 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 25 Mar 2022 11:07:30 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220323&jk=1201692695760148&bg=!oqGloeXNAAbzJazn0yU7ACkAdvg8Wqcb0s7DOdFxFgDcAz8YQZ_mv_kkz5r47KLphBa6H7tFNtrI6AIAAABaUgAAAAFoAQcKACinBpx7DL1zd2RNBwmjx-LXM1gXcSBUA4ZgHE5T3HM1ekuTCwN9DtMtmQLroz7X4d4kl2pwzyql7DPoSFmv1j1FF6OpxIlcEcQWqWA029NANHhVYteaFr7zpqCYNxCpo2nTHzUdV4d2VAtDR2HzpVUe6VufyDzsWW8IhNC4wI1v9oxQ6tWcMiArWVFyLS4nUUVbIhvRdIOteGjUrOEtoWrNoWBzNSQyogf2LBwdcNe-J5Nmco8H8ywmVLQRx15yboAC3PbI4ZhQuhSabGJoo2aErJyre0-KLzETiyZ1LCmqs_PADCO1wUbwWWheing12EByCXkwlXaxrh-D4x3oZF7hbUV2H8loLyT_u-61DGiS0uyg0qhW_uzIC5hk6FZcD3QEnlKM7ZlqgTXv1DqFIeHYJkXVff5a8KJiIjY89PwVio6EjlDFnOZ30AaCjlBrumWGsfH5j1t3TbFW2PKZN9X5yN0v-H7okXj8UixjtWORLZTCc3H8mso4iq1ldU2hR2EZg0vZaYmI7vAOKBBcU177k-jCEW-_SWibfQ5-6PFcsM7oN6pzKfBM0_OVMb2C8tGPGPjuiE_d8TRPJEI6F0j_aFmcH8Uzy_MbngWNAOljfoxiZGvOdtDaqK-55BW6OZbJycLLnNTU17RbaEEAZ80FRN2GTYBff1zjBbmnyJ7mXQwy0reS-k9z73LgnZUxcsBKU2sDEDPamnF30kcyb746Qqzzr3FaaAjSYbW6v94zmdmmiKpsT8ZR6oVhNWVNYNQgnlj5rPtrWLas-AYexpEQJUeSLYtiQEVPakz8FC4wb7Bgqiej2DpfSCn_rMIUE0-Ak7xFIJUQk_teWO5LR0HYzP-_1kgJ1_e34bZonv86LCbXBGebAReRIIPV1OA3v-Q-6re81ZNNrEJzzjGxk2KI1uQM_NzUjk9kdZQMJaOK0xn7bOb4kMDyFSsKxKmSQVVyKcFlaBzfSZUQwp2Y0ToSQ3nM3zpQhijR2vnWiUVsHwiIXxnnZw2pN3wN5odAZvaxr_L4n0cKB9D6LngWxCWrcmUlhyPA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 45ms
45ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1528460935&t=pageview&_s=1&dl=https%3A%2F%2Fff-downloads.boasaude.top%2F&ul=en-us&de=UTF-8&dt=FF%20DOWNLOADS%20-%20Tudo%20sobre%20Free%20Fire!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDACUABBAAAAC~&jid=1896880451&gjid=1255009337&cid=471317585.1648206448&tid=UA-181670863-2&_gid=83678604.1648206448&_r=1&gtm=2ou3e0&did=dZTNiMT&gdid=dZTNiMT&z=1110582628

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ff-downloads.boasaude.top/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-181670863-2&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 5560
date: Fri, 25 Mar 2022 09:34:50 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 25 Mar 2022 11:34:50 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 45ms
44ms Ping
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-7K1FEGD034&gtm=2oe3e0&_p=1528460935&sr=1600x1200&gdid=dZTNiMT&ul=en-us&cid=471317585.1648206448&_s=1&dl=https%3A%2F%2Fff-downloads.boasaude.top%2F&dt=FF%20DOWNLOADS%20-%20Tudo%20sobre%20Free%20Fire!&sid=1648206449&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7K1FEGD034
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 932C 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BeMrncaI9YvvXH6CDjuwPtYmDkAgAAAAAOAHgBAI&bg=!nZ6lntrNAAbzJazn0yU7ACkAdvg8WtWPefUcLIRAoh1n6-dWuvdFmjlEXCiQKziGA8wI1pt0cZC4mwIAAAEDUgAAAAFoAQeZA4v13UR9G1o2kg5dd-B_l7eUzU4Nz1Oo_OHXMhClgLkO59sCpw-KJyurAI5Dz3BsWyEa6Gd-0VHJja8P28sAYcUlQc0v9FrYn2mvFKdHPWLsJ4tu_pRN8oUbd0JUtBMwe0c6B6-7UAmQ6RigLsM_GslfQntNccWiFdxvdBG_noQrEN0dJ_1Rqhv1sCckH0Fy7m774KAOmbKTjN-X9ol4YJKxnmBqxWK9ZmLcAH3aMlwd4RWQ6wGnySVAFjQy5FjJBNkcllB9oVE4o52kQFE_nkz9MkSqtOKACdqdGJ3n06dnWHtFbfG8wMMZVBUpHnCSYG32YoR0Kn1iX_FpSc_fDclLqBLpeaxckLk44XINaEDARIvhGcVoixAQqQP5sTk2ZAR5dIhjEVG5OmXAVsRQpC0Nsf4LAFH23syxbLCPh1UUB1Hrfy46F2EcFSyVcxVTvNQqrRK8redvPpTyL0neCc01BcGp5qeFgX84Cr9qMjUvjSCxFpuzpVVWujsnAum2S6wd3v_bKIiouxs--Y5SxRfWxD6fTIjV-7lyxOxG-yQrATMBxndw7MmnMSPYQfTRiq-d7rYDeoxRNLxXxQonP4VRMBB010bYDIEIEhznVGte2q0Nuge6BFrYaVll9NkaWVhwMZ9GHcvm6oM-KoT-Wd-Rn-IvmzI_omscauqIf0MhjIIozy3qJCyTirKi1XKH3WY97w0M1Gkq_rHvZ_mYg3TBKFu6gw0C3oxthqSx9lawadcsStP9mlmECkLwpoUked-W9xl-Phd7YydE1dDUmAZWxwhGWmuf4aIcOLZV1Hm8zNWFQ4LRkbDQB4BBoMobEPaGewH1lNpbPYyUbQ-FszKV0QFM8RamEvztrZTc9rDlvHBbxe5t5yFZa9o4MerSORx3_IeHheYzDQXBGJMrxLQo0FhmPuzpjDZ1LXpZyJI9I8d2uDNr701jXvjpCdIKXk_89fhUU3ppvpw10xPVG419nj3cilf-nJO8gGuZ9LchtGP4G15xC77hoBSp1IEFADcxemkhj2KNSQ9FKj3hMQ5Nem1JGKaNK9thEs_TBvb2OMyGjngBVAKYcFzmrabKy1CL18XTscPjKvg5HntLReQvR56Vq2YChZ0-ZSoT2fFrDuI2Ih1bifgWUe6mVFIaXsD-L777H1hnnxgScUqzouvfeO23MZGbRgGDQbqwPygpVwSLyVklt511KQDD

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
446 B 62ms
19ms XHR
text/plain 2a00:1450:400c:c0a::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-181670863-2&cid=471317585.1648206448&jid=1896880451&gjid=1255009337&_gid=83678604.1648206448&_u=aGDACUABBAAAAC~&z=1497118661

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0a::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ff-downloads.boasaude.top/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 25 Mar 2022 11:07:30 GMT
content-type: text/plain
access-control-allow-origin: https://ff-downloads.boasaude.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E863 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BtuIycaI9YviwEo6i7_UPkP-g0AUAAAAAOAHgBAI&bg=!f3ylfDjNAAbzJazn0yU7ACkAdvg8WrO-tc5aCBa7u55lwD1AeQhiIbhdrE-mS7H7uTGirD7YBpj1TQIAAACUUgAAAAloAQcKAFz5l-3Lk8mPb70AnDPepVnThiL2iw18blGxooGcphiSsvSBAIturk7vg2EcNnTykeRxIvDParAYp67QZNYdRJDZInZkKvkvhLvm8THa1GUk_U0gzWoJfaMP9rX0TJkDOtugwn2JfJBlrPQ6raf9uDUx0e7Yugj5IEw5u_wFH2HJjcN5b80FhCDE2yyC25aVzztd-jKfZFnzPPnIeY82-od-kyRWyc66T3J4KEscz24N3zl11JNimKeKDPIdnd1x2ovwwGBelknSZWiUHtHyXjEUfkgblB9n1fR8WcXviyJEWdsCbUPYTZr4lckDQQfgqUyiwFTzr72u7CwY8cDTuH60J9EgDIrG63QyGVnNdeAzAhPhB0NwChx6tydf-XUI0xrOwemtNF9xMT37ptmxsQp3nMzJQYYatJConblvKj6ljpdSg-ojWXQbyDvpYo_4qLHpK_igJlYu1TQthEa-ykEVcGodPWwW_g8kthYKZH81Vexy2-dmzuL1L_v_qMx_XXmnbTI7Ouv95XFsodZdVod6FBN9FNLk1giy048a_35NagmpvkG0f65LBDiHPHgnVRO5X-ksIS_uUIbVbJBhi94plixVbs6gsL2BDGuzqLVPrEmvBi2ktKIspHMM5drY-1P38PBjBUYjYIwju56LGTcRg6CsEPHAkaY8Im0MaJFjl2_WhaTMVsjSDgqKZY5iMGWaffO0IeKX5P_HUn89bvMDQZWyCjy1J5Afd1D_pvoa0fakQYEIFkrI5qdzxDHUfktugulZFQBbytFC-NqGK5XLVrMJT8c7R8SR5JSuB38XQ2HdSGGFM407x2T-5BG8GmlSJjJw901vgs_69wc2fO8aPNJvbZMsTkitclTSxJlAU6cO4kdoptV_d9PhB6CnHTpZLn8u7kdEUhoVUVdl27y81qyfOS8C22id3vHvj45V6Cb526t0E5zULwMiRvK-oBfpUxdhi6nASf1MUs7wkRgn0JRPJfPdznHcXdT_c3QD2eI6mMOOCaFjvhI-3j30Pm1hLtfEhrcfBPUEE_aEEb6bcnjNZWc_TCDBGJU7n8cYIA9DIYYCzKPSuBB8TrRlGDT1VPIju8QbC-LGB0J4ECZqz28yBM5QqJvsQd070f8-2IS2mJYvYx5NDsv3qn0b9QK5zINnEhcwi8TlRa2M_eTMCTfjKwZL_rQVF4Y08uRrcI_qNLgTp044WeTswfYHooP8TrNZkOVCv0Y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 279F 0
0

GET
H3 200 container.html Show response
6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C8F1 6 KB
3 KB 40ms
40ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ff-downloads.boasaude.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 25 Mar 2022 11:07:28 GMT
expires: Sat, 25 Mar 2023 11:07:28 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C8F1 0
0 82ms
81ms Fetch
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CBdJCcaI9YtnFOeSU7_UP6oWswATJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM0MjMwODU1NDUyOTYyMzGgAdW20uoDyAEJqQKzwIec94GyPuACAKgDAaoE9gFP0GnJnB1W5gx4cVeoKTm3xDUPzSbmCqhluCn9nTE6hgqN8t9je8xjAdVKZb-Bfbpp6WJ7075jygDgvDTI6MTdy8wKKXDHrka6L4pO_hYLcrVhR-np0zrMbrnyUpULxA1_PcU7v8V_vwWj2ereanWESY2aWw-4itWCNypb9VulDeWUPZ-BBhmiuMGsGOKQ2RIUYxr76JIdEARRhd8JzY8Y5ptWesAEpaRB6mGTFVlIrC60goU4HTir5Ys7jEA7O7qWwqGCA0CjkVZ27vHN0GGNK9dfIIpPZ6HPRJ2t6CcaUABDqhFF0tkpKfctfqW_Ver4HyL-4MjgBAGABvutheTY94zEVqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTM0MjMwODU1NDUyOTYyMzEY__kd&sigh=rWtFkYJAVUU&uach_m=[UACH]&cid=CAQSOwCNIrLMhlUWFI8yVXGslebNZUoVpQRC8q_ynFM4du5ZuKjwS7NzT2h9Hv0CIG9AIfiEXf9m5sdHpEXzGAE
Requested by: Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame C8F1 0
0 45ms
15ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=UrvbEo-lBKwC2ASdg2ICAgAAAAXVJdSfmFyX6c2aqxBxoj1iPyqAIml59To0yeQAEg&wp=Yj2icQAOYtkIu8pkAAsC6p8bKZv8sQXXOtfdag

Requested by

Host: ff-downloads.boasaude.top
URL: https://ff-downloads.boasaude.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
server: Kestrel
server-processing-duration-in-ticks: 281006
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame B0EB 35 KB
14 KB 62ms
27ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yj2icQAOYtkIu8pkAAsC6p8bKZv8sQXXOtfdag&u=%7CiUXkeGqdXxm96LW3tbsTHGBHeggiLpnC9xF%2Br%2BS9ubw%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD9qFQZVNz0gdGGhB191eAyn_QVhHrVzTWBeT0mGZn15eCXf-fvdhSrbH6qnB6IrOpBeXBsxzh1xJ13ujga0rNsJ7NHBYgHRvzU70_6sTrCTqCASbtZd-U8mTz1VLJrje9uyX6V1iCWr0CwC5BDvvN1BAWjHI5l-283aCi9vjUfeenpiVyi0dVHLD1f3baQR1b7yapks2QJO2x57tVN5YPz29YT5UcOTf4G23YRMdM7lOWE_tQkfKr9rJVWgSYVxn5cq_Y4gP19QZbrS7OK3hM2uRr-HeTG2NktLj9QukpfRQvnNnrAp7ADTYCMu_c36ITARUI9UWoU_bBWLgUCJFa2CMeccGBhXcm3oMX1O9Md-uFSo6AV2yy99ropnKk3JRODkoyFhW4pXIpMf3re7aUOSKhaanAU7LrJojdEYX8rtx9JjACmZM_sVSNBWI5AHp5w&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC0mdccaI9YtnFOeSU7_UP6oWswATJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM0MjMwODU1NDUyOTYyMzGgAdW20uoDyAEJqQKzwIec94GyPuACAKgDAaoE-QFP0GnJnB1W5gx4cVeoKTm3xDUPzSbmCqhluCn9nTE6hgqN8t9je8xjAdVKZb-Bfbpp6WJ7075jygDgvDTI6MTdy8wKKXDHrka6L4pO_hYLcrVhR-np0zrMbrnyUpULxA1_PcU7v8V_vwWj2ereanWESY2aWw-4itWCNypb9VulDeWUPZ-BBhmiuMGsGOKQ2RIUYxr76JIdEARRhd8JzY8Y5ptWesAEpaRB6mGTFVlIrC60goU4HTir5Ys7jEA7O7qWwqGCA0CjkVZ27vHN0GGNadV-sg3A-7Jw2IkOOBq8qAlXoKdP_MGrnT8Q2FcAS8bgmoh683eR6RzgBAGABvutheTY94zEVqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3Jxs0e_RPjUYaVdjVrmwk1D8hWuw%26client%3Dca-pub-3423085545296231%26adurl%3D

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

c00390a355b853442742b0665bb6538d250333032ee95f26ebc6dbc474197bb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

date: Fri, 25 Mar 2022 11:07:29 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=0ZAGlGA8qyzm1nhl2Bx9pT8kvhixYTqWWwNTR6z6-PD0jISV8gctqS-kp2GrMMm21trc0BvTQ8PiWhhn7NDNtxazB31PkDGiPqphdboteDLhgqb5-_a0MuddU3fbO43PeEG3eH4_vmLW9VbDYmn0cOLW2nObwj7fEnm0R5jOL_T_ptVBvKjANX3eLid6YSck-75xviI1g8nG2CFxezKOlA68QZ2WVyBn5IEx91qV6BRS-un6qKUnzTzFmwbwLKKEmeRZww"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 4613107
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame C8F1 2 KB
1 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:03:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:03:08 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 563D 1 KB
749 B 39ms
38ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 24 Mar 2022 13:26:12 GMT
expires: Fri, 25 Mar 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 78078
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C8F1 119 KB
36 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:07:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame C8F1 15 KB
6 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:04:23 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C8F1 0
0 47ms
46ms Image
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQnbUulAy3ttRWr2dcivo6YuJ1foRYDAGYCCCCm7fz2vdqAPQ4fyMguozewcuVchSR2uV3pc43i4NhS6i5Dn6rnxRbZhw
Requested by: Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame C8F1 22 KB
7 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 14:05:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75738
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 24 Mar 2023 14:05:12 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 563D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDQflItvH_CUSfN9STXmGT0&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDQflItvH_CUSfN9STXmGT0&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=TlRDcTZmb3YxTnhITjA1&google_gid=CAESEDQflItvH_CUSfN9STXmGT0&google_cver=1&google_push=AYg5qPIIzkN_tcU0NVinRiXQJYn2NcHKDIHwYSExttaimzu...

170 B
188 B

50ms
50ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=TlRDcTZmb3YxTnhITjA1&google_gid=CAESEDQflItvH_CUSfN9STXmGT0&google_cver=1&google_push=AYg5qPIIzkN_tcU0NVinRiXQJYn2NcHKDIHwYSExttaimzuiPKjPE4DJvJ5xYCnHdiHSx2jtk_I1VjLJ_ZwQNNE0btrOYk-JR5ramw

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 11:07:30 GMT
Server: PingMatch/v2.0.30-713-gdae83a2#rel-ec2-master i-0ae965e2f8a6b4310@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=TlRDcTZmb3YxTnhITjA1&google_gid=CAESEDQflItvH_CUSfN9STXmGT0&google_cver=1&google_push=AYg5qPIIzkN_tcU0NVinRiXQJYn2NcHKDIHwYSExttaimzuiPKjPE4DJvJ5xYCnHdiHSx2jtk_I1VjLJ_ZwQNNE0btrOYk-JR5ramw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 563D
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEB6nlGWvwyaAahPEfdGXLv0&google_cver=1&google_push=AYg5qPLps9BSDjU81bh9KycnNof6OU_NX4jYHRvtI4R_5-UOsfZbGLl0hiShe6fPmQ-3xxN5RALBK0wgLYikQ9m2sfAvNfvECt47
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=25E4CBD7356B4B8E8FB9A9F43BF99EFD&google_push=AYg5qPLps9BSDjU81bh9KycnNof6OU_NX4jYHRvtI4R_5-UOsfZbGLl0hiShe6fPmQ-3xxN5RALBK0wgLYikQ9m...

170 B
188 B

53ms
52ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=25E4CBD7356B4B8E8FB9A9F43BF99EFD&google_push=AYg5qPLps9BSDjU81bh9KycnNof6OU_NX4jYHRvtI4R_5-UOsfZbGLl0hiShe6fPmQ-3xxN5RALBK0wgLYikQ9m2sfAvNfvECt47

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=25E4CBD7356B4B8E8FB9A9F43BF99EFD&google_push=AYg5qPLps9BSDjU81bh9KycnNof6OU_NX4jYHRvtI4R_5-UOsfZbGLl0hiShe6fPmQ-3xxN5RALBK0wgLYikQ9m2sfAvNfvECt47
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 24 Mar 2022 11:07:30 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 563D 0
173 B 60ms
22ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEJbgA8V8jgy8sTvmiYc1A1E&google_cver=1&google_push=AYg5qPLRkz0CQvKtobvUvU2jRyfeIFQg5C-DGp_YFg-lEhuQbjvHEVG_SSgIETDLbWJZlYerj-WM7XHz-RFTTQRDwSi7N4J1WGMaOw
Requested by: Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 563D 0
12 B 49ms
49ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jmbwr7P_0Ex8-Fs7ZSvZMgQBipEcDI2e3iJjAup7YI5A

Requested by

Host: 6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com
URL: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f134.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame B0EB 2 KB
1 KB 69ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yj2icQAOYtkIu8pkAAsC6p8bKZv8sQXXOtfdag&u=%7CiUXkeGqdXxm96LW3tbsTHGBHeggiLpnC9xF%2Br%2BS9ubw%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD9qFQZVNz0gdGGhB191eAyn_QVhHrVzTWBeT0mGZn15eCXf-fvdhSrbH6qnB6IrOpBeXBsxzh1xJ13ujga0rNsJ7NHBYgHRvzU70_6sTrCTqCASbtZd-U8mTz1VLJrje9uyX6V1iCWr0CwC5BDvvN1BAWjHI5l-283aCi9vjUfeenpiVyi0dVHLD1f3baQR1b7yapks2QJO2x57tVN5YPz29YT5UcOTf4G23YRMdM7lOWE_tQkfKr9rJVWgSYVxn5cq_Y4gP19QZbrS7OK3hM2uRr-HeTG2NktLj9QukpfRQvnNnrAp7ADTYCMu_c36ITARUI9UWoU_bBWLgUCJFa2CMeccGBhXcm3oMX1O9Md-uFSo6AV2yy99ropnKk3JRODkoyFhW4pXIpMf3re7aUOSKhaanAU7LrJojdEYX8rtx9JjACmZM_sVSNBWI5AHp5w&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC0mdccaI9YtnFOeSU7_UP6oWswATJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM0MjMwODU1NDUyOTYyMzGgAdW20uoDyAEJqQKzwIec94GyPuACAKgDAaoE-QFP0GnJnB1W5gx4cVeoKTm3xDUPzSbmCqhluCn9nTE6hgqN8t9je8xjAdVKZb-Bfbpp6WJ7075jygDgvDTI6MTdy8wKKXDHrka6L4pO_hYLcrVhR-np0zrMbrnyUpULxA1_PcU7v8V_vwWj2ereanWESY2aWw-4itWCNypb9VulDeWUPZ-BBhmiuMGsGOKQ2RIUYxr76JIdEARRhd8JzY8Y5ptWesAEpaRB6mGTFVlIrC60goU4HTir5Ys7jEA7O7qWwqGCA0CjkVZ27vHN0GGNadV-sg3A-7Jw2IkOOBq8qAlXoKdP_MGrnT8Q2FcAS8bgmoh683eR6RzgBAGABvutheTY94zEVqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3Jxs0e_RPjUYaVdjVrmwk1D8hWuw%26client%3Dca-pub-3423085545296231%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 20 Mar 2023 11:07:30 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame B0EB 2 KB
1 KB 66ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 20 Mar 2023 11:07:30 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame B0EB 308 B
637 B 40ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 20 Mar 2023 11:07:30 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame B0EB 507 B
835 B 41ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Mon, 20 Mar 2023 11:07:30 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/m/delivery/ Frame B0EB 43 B
348 B 75ms
20ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=d8gaXT_QH_kqhkVFye3c68fQGlQ9Zg3vMtX5XHXX7M47DqjtQrutN71HavLx3jkANTQ-BAwUL_7OkoYle2MMQvrMVEajIlBRsOspJNIwYQKEIhp027UzdBiqEypwkFZjGvy1o8jL5LgwjvO5VtOdFELWHXNp74NCxxTpdZRJTCa7uF8XCxwjP-SldM_ZcLn_2cbsi-HVeqpD3y2UttiM18edsgtKBQya63LzOL4GzeAU2WpNWsTmdqcYHXBN0CzeXsb1soy9sZ7QBaQ1WSXZusZBQWkVEcOOAVsllN9oTj-Sg0PjX8HQcnFRE6gFByPN-x9G-XAZQAmTKGsMB4IYicNXpHnj_9DxVQvXrr3aap7mjMAkVqpKDEWMCnpuqrO2BUPinO54iC86m-0IPbF8sg47qvD1auCcaUg21gHuiZLIqFTjo0C7B8BAKEDnzvkrnIpDAw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3168265
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame B0EB 11 KB
5 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

503a1dd70b8b9c286875f5f7de72bce93c664b79f3fcfeefa1150d2384df33a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 10:36:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1869
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5008
x-xss-protection: 0
last-modified: Thu, 24 Feb 2022 18:23:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:36:21 GMT

GET
DATA 200
OK truncated
/ Frame C8F1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d185c52b0681a4caaff8e8161d9faf391624762c20eb26b1fc7bda2d8a68c2a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 impl_v85.js Show response
www.googletagservices.com/dcm/ Frame B0EB 42 KB
17 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v85.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7337a38ce3a732e5243bd354ad12d96b4d5512e283a8dd70d129b730d7a5d3d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 09:36:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5469
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17382
x-xss-protection: 0
last-modified: Mon, 21 Feb 2022 17:13:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Mar 2023 09:36:21 GMT

GET
H2 200 B27349770.329898462;dc_ver=85.248;dc_eid=40004000;sz=300x600;u_sd=1;gdpr=1;dc_adk=1516185465;ord=ayhq3h;click2=https%3A%2F%2Fcat.nl.eu.criteo.com%2Fm%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3DZ9hclD_Q... Show response
ad.doubleclick.net/ddm/adi/N1111979.2621703CRITEOGMBH/ Frame 8951 54 KB
26 KB 194ms
89ms Document
text/html 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1111979.2621703CRITEOGMBH/B27349770.329898462;dc_ver=85.248;dc_eid=40004000;sz=300x600;u_sd=1;gdpr=1;dc_adk=1516185465;ord=ayhq3h;click2=https%3A%2F%2Fcat.nl.eu.criteo.com%2Fm%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3DZ9hclD_QH_kqhkVFye3c68fQGlQ9Zg3vMtX5XHXX7M47DqjtQrutN71HavLx3jkANTQ-BAwUL_7OkoYle2MMQvrMVEajIlBRsOspJNIwYQKEIhp027UzdBiqEypwkFZjGvy1o8jL5LgwjvO5VtOdFELWHXPqvt9Ln7m5jXN9b7CQr2fT1xqA8w1VVnVefXIQ440U4AvuqExvajNQz61-OTzi4QvZe1flZHwWL2zUjxvgHLqjLW-Iy-Lxk6Qvst2Tr8OPihFuhnrABl95ktZz1VVjWCNPm1h9Mau4Ohb3V47sQsDyCeaeuFpMLtx50I_tsPxWwNn2y2hJgkJuM6eA4ikub9h4pRvloR9zFfCmQGg6Wg5xYpTH9PjckUobgu1Vo_kt8l6nXSBUnRrpbKLQ1trGKuU1gpYT8wvq4B8c8ycsqIjubF0botLC-HHY-ObaUljouQ%26maxdest%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.;dc_rfl=2,https%3A%2F%2Fff-downloads.boasaude.top$2,https%3A%2F%2F6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=OZImCRJAmp;gcsr=m;sttr=58;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

beaa5a23af0334e914975a2e7038d6a757fa3cd91d85c6280bd780dd3961ee50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 25 Mar 2022 11:07:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 26255
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 all
csm.eu.criteo.net/ Frame B0EB 0
128 B 54ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=0ZAGlGA8qyzm1nhl2Bx9pT8kvhixYTqWWwNTR6z6-PD0jISV8gctqS-kp2GrMMm21trc0BvTQ8PiWhhn7NDNtxazB31PkDGiPqphdboteDLhgqb5-_a0MuddU3fbO43PeEG3eH4_vmLW9VbDYmn0cOLW2nObwj7fEnm0R5jOL_T_ptVBvKjANX3eLid6YSck-75xviI1g8nG2CFxezKOlA68QZ2WVyBn5IEx91qV6BRS-un6qKUnzTzFmwbwLKKEmeRZww&sds=2&rev=80956&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 25 Mar 2022 11:07:29 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame B0EB 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 20 Mar 2023 11:07:30 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame B0EB 2 KB
1 KB 25ms
25ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 20 Mar 2023 11:07:30 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/elements/html/ Frame 8951 8 KB
3 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220323/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1111979.2621703CRITEOGMBH/B27349770.329898462;dc_ver=85.248;dc_eid=40004000;sz=300x600;u_sd=1;gdpr=1;dc_adk=1516185465;ord=ayhq3h;click2=https%3A%2F%2Fcat.nl.eu.criteo.com%2Fm%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3DZ9hclD_QH_kqhkVFye3c68fQGlQ9Zg3vMtX5XHXX7M47DqjtQrutN71HavLx3jkANTQ-BAwUL_7OkoYle2MMQvrMVEajIlBRsOspJNIwYQKEIhp027UzdBiqEypwkFZjGvy1o8jL5LgwjvO5VtOdFELWHXPqvt9Ln7m5jXN9b7CQr2fT1xqA8w1VVnVefXIQ440U4AvuqExvajNQz61-OTzi4QvZe1flZHwWL2zUjxvgHLqjLW-Iy-Lxk6Qvst2Tr8OPihFuhnrABl95ktZz1VVjWCNPm1h9Mau4Ohb3V47sQsDyCeaeuFpMLtx50I_tsPxWwNn2y2hJgkJuM6eA4ikub9h4pRvloR9zFfCmQGg6Wg5xYpTH9PjckUobgu1Vo_kt8l6nXSBUnRrpbKLQ1trGKuU1gpYT8wvq4B8c8ycsqIjubF0botLC-HHY-ObaUljouQ%26maxdest%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.;dc_rfl=2,https%3A%2F%2Fff-downloads.boasaude.top$2,https%3A%2F%2F6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=OZImCRJAmp;gcsr=m;sttr=58;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:00:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 410
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 11:00:40 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 8951 106 KB
37 KB 85ms
39ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Origin: https://ad.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 14:41:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73547
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Mar 2022 14:41:43 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8951 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 09:34:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91982
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Mar 2023 09:34:28 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B2EB 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Mar 2022 09:34:28 GMT
expires: Fri, 24 Mar 2023 09:34:28 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 91982
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js Show response
pagead2.googlesyndication.com/bg/ Frame B2EB 35 KB
13 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/njEQSFvQmVZPXGz1GqDnvx6UYUmy29w-ZdzcuuIp78M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e3110485bd099564f5c6cf51aa0e7bf1e946149b2dbdc3e65dcdcbae229efc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 08:12:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10525
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13638
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Mar 2023 08:12:05 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8951 119 KB
36 KB 70ms
69ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 11:07:30 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/18383760247202400809/ Frame B4DB 12 KB
4 KB 40ms
40ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18383760247202400809/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89185a56ed43d1f5a29cd321f870d405c303ffef207a717801f66972593a6440

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 4255
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Thu, 24 Mar 2022 10:27:48 GMT
expires: Fri, 24 Mar 2023 10:27:48 GMT
cache-control: public, max-age=31536000
age: 88782
last-modified: Wed, 02 Mar 2022 11:44:36 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8951 0
23 B 74ms
73ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstbTwuy3U7-RdQpwdhKYe9FGLMA9d9r3abwTZSPLPTzSy6lzLI7piuLH5xkNaNmINy78DZX0wu6NfTF9rJuhGlgIlr5xjizYCIrv7W2JG6e8RBRVgyTC9KOTB6IqC_hTMU9eWoljmwvvM_PQ2MGfQHxTymqErEYEtvngA&sig=Cg0ArKJSzI_SJUA79d6GEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=128&cbvp=1&cstd=125&cisv=r20220323.96479&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-63-35-20-93.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame 8951
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5608569&d_src=158980&d_adsrc=&d_creative=167300203&d_placement=329898462&d_campaign=27349770&d_bust=1533702019&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5608569&d_src=158980&d_adsrc=&d_creative=167300203&d_placement=329898462&d_campaign=27349770&d_bust=1533702019&gdpr=&gdp...

42 B
967 B

36ms
35ms

Image
image/gif

63.35.20.93
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5608569&d_src=158980&d_adsrc=&d_creative=167300203&d_placement=329898462&d_campaign=27349770&d_bust=1533702019&gdpr=&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

63.35.20.93 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0860a7bc2.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Qjl+zNA2TZ8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v030-01115f9c3.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: i5+y5IQ7Q9g=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5608569&d_src=158980&d_adsrc=&d_creative=167300203&d_placement=329898462&d_campaign=27349770&d_bust=1533702019&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 8951 43 B
1 KB 66ms
14ms Image
image/gif 213.202.235.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=8&extPu=sky-dcm&extLi=27349770&extPm=329898462&extCr=167300203&subid=ADGapID_026_800138_543100532-503708817&rnd=1533702019&gdpr=&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.10 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Fr, 25 Mrz 2022 11:07:30 GMT
Server: Microsoft-IIS/8.5
Date: Fri, 25 Mar 2022 11:07:30 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://ad.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9B72 42 B
64 B 80ms
80ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvQC4JkZmU0RRTR0C31_bpJIo_zr1GucLI-wx7G0TRKv7JYx65h8iHoVtRIqE2DVGWzQp62zCfkIE4LKLzub9j51Uusvmjt-bZJ-jB7BWsKeWUtiU-2Yg&sai=AMfl-YTGoROEH-6KkTzjTG3CL_hy76jEJ-Cky2FYkqSjRkd60-kwdlVAXbWyJYeefJPQpFYQdRpvOkOE_ELrEqZPPaZ1gabOM5L_unFtjzUyUvRH-VemrLXfdVqRVe8&sig=Cg0ArKJSzGVHVJhjv5zqEAE&cid=CAASJORo3NDpCN2wZPS5NxoCGNTYT5dF4iDaqaOcY2odtxelPofjiA&id=lidar2&mcvt=1014&p=1150,640,1200,960&mtos=1014,1014,1014,1014,1014&tos=1014,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2890984277&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648206448967&rpt=189&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame B4DB 236 KB
63 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18383760247202400809/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18383760247202400809/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:07:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Mar 2022 11:07:30 GMT

GET
H3 200 index.js Show response
s0.2mdn.net/sadbundle/18383760247202400809/ Frame B4DB 116 KB
22 KB 41ms
40ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18383760247202400809/index.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18383760247202400809/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c5b1617967ab7086634102a41d7bfe7580acd58e506d4ac2ed82deebe5c78c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18383760247202400809/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 01:52:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33293
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22186
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 11:44:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Mar 2023 01:52:37 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FCA5 42 B
64 B 78ms
78ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv-4pjdYULbLNq4KrY9v0Lv_BoT4DPOPyvZVy_JkOK4Cm9WpbfHeMgjj3FAQvDL9RyJbvcjJrFkNy0Fx9t3EX0u_aq8JhAS3T92wBPxp8j8oAfkMCmIGg&sai=AMfl-YTuFm2-1ooBvybS_FzdF3_pIXg7k47zwDwfgXXwU3yH-jFjeR80d3TFSU_6_k3q34Nt1LBBfzHcz3gyM3r_y8XI65dUB50RdARqEEJ0-Ca8IgFOLqTlRhgp_60&sig=Cg0ArKJSzK8ZG5E81MyzEAE&cid=CAASJORomjs525XMnW2XjeTC6z3NP0gJzcDYoVwP9Ic2VuZ4zufO3g&id=lidar2&mcvt=1000&p=194,632,444,932&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1412801661&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648206448831&rpt=408&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6e237f528c233d21ffe1cd032f0a02bd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B2EB 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BsxUYcqI9YvfsJdr43wPZyouQCQAAAAA4AeAEAg&bg=!UlGlURXNAAbzJazn0yU7ACkAdvg8Wp1-mRDaAqXDen1oWp6_AMZHU25lQaHjHQA7wl5Ut439j9yROQIAAACFUgAAAAFoAQcKACeCq46k7ooMl_qaqTFc49fBGCsOzpxlU7SCoTXNBJkMJwW6s0S_O1eZA1cwEhrRihcxnsjQzLqvsXVZlbzYQ2VHvqDOookD9nF36OaVZYBv1eY23WdH_xdwVAaW_mwVZqo1ZrrKninQ0Eebx6RsZFsFwtbmy89jje1YKvoOO0jWtqfPif_V0wE475TEI0ZwCqO4PfXQq526qTGVeG_69kmoZVkdhdzanOorlqg0Og-Y0rtfZhIEDR3jiZGFwUqtCJk6oC8V1hQrTxA3jiFQhywEDBpjtc63zrE-fMWwg5jWWhX-5h_ThEafa-EpT2MgXyH01ZVlfO8UEhSzk24U39pBOwXl3nTLqaHr58BUkpod_UBVlNmCLIuK36nu3dFN77FNBuiqayLSTZnSFGMMpGR7-1PmEZniiC9fTr0sBxh9lYnxtv-4ZpYsoz7q5W7dZwqeLarSXiOqn_LZoIogYVvnjirYfqF5P-rxeUoq_hIDB_miREPZyDVbBC0hjw_aY0QMKJMhzNtqrsgVPgCQQrEfEzdvlN1Ar8yB8U9nKiwfG6Bjo9YcIJ4ADvYaqWYgYGoiSYfMd71lbSvzkUHHyUci_7Z4m-L6miUebxItyiM6OOxnaCi04JYjm4ANeprf15ygE-1s5GaGLwFpfAw1gEnk6CQ1uI9w2wvfopC7Zs-5L86lgJRVzz4esl2Y0FWky0DKUqKIKLDXgarDXrOesDwRjFSlJ4iwFcx8QK8Bd_9HefWfyMxOigq5PnlZ8qPMhZp_r1ZAIpv6RMHQwDMeOw-yX8g8n3WPIHsFHB4wRVHtfZ_D147CVAnT2ikKZ6Bup5Q7IhwjnAhXcW55MAA3zJvp1KR06KlpRsXF3Zk-DP4ezG9rEquqgWAhqxR8iflzM-JTgxuM78ft8tScFIOG0vafzPnuMvf0upMf0bmMlnwNYIi9dzOfdpL1axmTeg-35MgdQcxu0MaUJV3hvYLAUO-Xrqg8l44C1yjJDcVsk7ub49XrxwaA2NBh3sVRC_3Ax6G-VXlVVMK9-8HsoPKD4aT882p0PvFhTe4GYashbNBzYBCXnuKTSiNnZCLyKHjoje_owla59W-KongxgkIdLUMPZ6Z4LDmn5jX9h1AygEuWZWx6pfRvW1SNPeuS1j7w7Ia7Deie6t5vEaSFDre5VBtn5do9oDJk11XpAzKiOIkTFUs

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 11:07:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8951 0
23 B 74ms
74ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstbTwuy3U7-RdQpwdhKYe9FGLMA9d9r3abwTZSPLPTzSy6lzLI7piuLH5xkNaNmINy78DZX0wu6NfTF9rJuhGlgIlr5xjizYCIrv7W2JG6e8RBRVgyTC9KOTB6IqC_hTMU9eWoljmwvvM_PQ2MGfQHxTymqErEYEtvngA&sig=Cg0ArKJSzI_SJUA79d6GEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=314&vt=11&dtpt=186&dett=3&cstd=125&cisv=r20220323.96479&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS