www.123greetings.com Open in urlscan Pro
184.72.244.154 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.jpada.com/cgi-bin/click.pl?cid=nl040874202206&lid=232092&uid=202812725
Effective URL:
https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium...
Submission: On August 24 via api (August 24th 2022, 9:09:21 pm UTC) from BE — Scanned from DE

Summary HTTP 524 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 73 IPs in 9 countries across 52 domains to perform 524 HTTP transactions. The main IP is 184.72.244.154, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.123greetings.com. The Cisco Umbrella rank of the primary domain is 355681.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 1st 2022. Valid for: a year.

This is the only time www.123greetings.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	99.86.4.71 99.86.4.71	16509 (AMAZON-02) (AMAZON-02)
1 2	184.72.244.154 184.72.244.154	14618 (AMAZON-AES) (AMAZON-AES)
51	8.238.176.252 8.238.176.252	3356 (LEVEL3) (LEVEL3)
3	2a04:4e42:41::84 2a04:4e42:41::84	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:801::2016	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f00... 2a03:2880:f007:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
47	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2008	15169 (GOOGLE) (GOOGLE)
13	34.240.212.15 34.240.212.15	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f10... 2a03:2880:f107:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 3	54.243.255.136 54.243.255.136	14618 (AMAZON-AES) (AMAZON-AES)
17	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	8.241.45.124 8.241.45.124	3356 (LEVEL3) (LEVEL3)
2	2001:4860:480... 2001:4860:4802:32::178	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
13	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
1	54.231.224.232 54.231.224.232	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
62	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	151.101.128.84 151.101.128.84	54113 (FASTLY) (FASTLY)
9	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
3 13	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
11	2600:9000:205... 2600:9000:2057:a600:1c:38a0:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
49	2a00:1450:400... 2a00:1450:4001:811::2006	15169 (GOOGLE) (GOOGLE)
8	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638:1::4 2a02:2638:1::4	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	2600:9000:225... 2600:9000:2250:7a00:8:9ed9:9c40:93a1	16509 (AMAZON-02) (AMAZON-02)
11	52.36.72.203 52.36.72.203	16509 (AMAZON-02) (AMAZON-02)
11 39	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
6 10	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 8	37.252.172.250 37.252.172.250	29990 (ASN-APPNEX) (ASN-APPNEX)
2 4	34.254.17.167 34.254.17.167	16509 (AMAZON-02) (AMAZON-02)
4	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
5	23.35.237.56 23.35.237.56	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	2606:4700:440... 2606:4700:4400::6812:230b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2a05:d018:d29... 2a05:d018:d29:3605:a43d:cfec:dc69:3aee	16509 (AMAZON-02) (AMAZON-02)
4 4	37.157.4.28 37.157.4.28	198622 (ADFORM) (ADFORM)
2 2	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 3	51.89.9.254 51.89.9.254	16276 (OVH) (OVH)
2	185.86.139.94 185.86.139.94	201081 (SMARTADSE...) (SMARTADSERVER)
8	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.2.148 178.250.2.148	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
14	2600:9000:223... 2600:9000:223e:fc00:3:748e:7940:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2600:9000:223... 2600:9000:223f:6600:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2620:116:800d... 2620:116:800d:21:ef75:8280:f209:5ba1	16509 (AMAZON-02) (AMAZON-02)
1	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
2	198.47.127.19 198.47.127.19	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb	16509 (AMAZON-02) (AMAZON-02)
1 2	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
2 2	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1	34.96.105.8 34.96.105.8	15169 (GOOGLE) (GOOGLE)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
4 4	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
1 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
13	2600:1f18:1ac... 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	178.250.2.135 178.250.2.135	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.0.162 178.250.0.162	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2 3	216.52.2.30 216.52.2.30	30282 (AS-INAPCD...) (AS-INAPCDN-OCY)
2 2	2600:9000:223... 2600:9000:223f:200:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:595::2c79	() ()
11	2a02:26f0:350... 2a02:26f0:3500:58c::2c79	() ()
6	35.173.69.21 35.173.69.21	() ()
2	18.206.3.164 18.206.3.164	() ()
1	129.159.70.95 129.159.70.95	() ()
1	23.35.236.201 23.35.236.201	() ()
4	18.156.195.47 18.156.195.47	() ()
2	52.28.203.152 52.28.203.152	() ()
2	104.18.18.126 104.18.18.126	() ()
6	18.195.44.243 18.195.44.243	() ()
1	13.38.220.224 13.38.220.224	() ()
524	73

1 99.86.4.71 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-71.fra6.r.cloudfront.net

www.jpada.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.72.244.154 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: www.123greetings.com

www.123greetings.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

51 8.238.176.252 (United States)

ASN3356 (LEVEL3, US)

c.123g.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.123g.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:41::84 (Vienna, Austria)

ASN54113 (FASTLY, US)

assets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f007:8:face:b00c:0:1 (Vienna, Austria)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

47 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 34.240.212.15 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com

s.gk.123greetings.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f107:83:face:b00c:0:25de (Vienna, Austria)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.243.255.136 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-243-255-136.compute-1.amazonaws.com

trkn.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.241.45.124 (United States)

ASN3356 (LEVEL3, US)

x.123g.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.231.224.232 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

62 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.128.84 (United States)

ASN54113 (FASTLY, US)

log.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:2057:a600:1c:38a0:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.avantisvideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn1.avantisvideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

49 2a00:1450:4001:811::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::4 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2250:7a00:8:9ed9:9c40:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.avantisvideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.36.72.203 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-36-72-203.us-west-2.compute.amazonaws.com

events1.avantisvideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 142.250.186.130 (United States) 11 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.18.19.126 (None, ) 6 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 37.252.172.250 (Frankfurt am Main, Germany) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.254.17.167 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-17-167.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.35.237.56 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-56.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::6812:230b (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d018:d29:3605:a43d:cfec:dc69:3aee (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.157.4.28 (Denmark) 4 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.139 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 51.89.9.254 (London, United Kingdom) 1 redirects

ASN16276 (OVH, FR)
PTR: ip254.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.86.139.94 (France)

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.148 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2600:9000:223e:fc00:3:748e:7940:93a1 (United States)

ASN16509 (AMAZON-02, US)

avm.avantisvideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:223f:6600:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:ef75:8280:f209:5ba1 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.47.127.19 (United States)

ASN3257 (GTT-BACKBONE GTT, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.29.132.245 (United Kingdom) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.105.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Waldshut-Tiengen, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 76.223.111.18 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 178.250.2.135 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.am5.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.162 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.52.2.30 (United States) 2 redirects

ASN30282 (AS-INAPCDN-OCY, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223f:200:1b:5138:8a40:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:595::2c79 (None, )

ASN- ()

play.aniview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a02:26f0:3500:58c::2c79 (None, )

ASN- ()

player.aniview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.173.69.21 (None, )

ASN- ()

track1.aniview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.206.3.164 (None, )

ASN- ()

go1.aniview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 129.159.70.95 (None, )

ASN- ()

sync.technoratimedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.236.201 (None, )

ASN- ()

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.156.195.47 (None, )

ASN- ()

web.ssp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c2shb.pubgw.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.28.203.152 (None, )

ASN- ()

c2shb.pubgw.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.18.126 (None, )

ASN- ()

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.195.44.243 (None, )

ASN- ()

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.38.220.224 (None, )

ASN- ()

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
115	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 123 tpc.googlesyndication.com — Cisco Umbrella Rank: 159 fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com	1 MB
75	doubleclick.net 11 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 52 stats.g.doubleclick.net — Cisco Umbrella Rank: 108 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 218 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 303 cm.g.doubleclick.net — Cisco Umbrella Rank: 214	436 KB
52	123g.us c.123g.us — Cisco Umbrella Rank: 427586 i.123g.us — Cisco Umbrella Rank: 214572 x.123g.us — Cisco Umbrella Rank: 685912	5 MB
49	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 280	463 KB
40	avantisvideo.com cdn.avantisvideo.com — Cisco Umbrella Rank: 21948 static.avantisvideo.com — Cisco Umbrella Rank: 22575 events1.avantisvideo.com — Cisco Umbrella Rank: 21661 cdn1.avantisvideo.com — Cisco Umbrella Rank: 26692 avm.avantisvideo.com — Cisco Umbrella Rank: 22564	310 KB
21	adsafeprotected.com 2 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 763 static.adsafeprotected.com — Cisco Umbrella Rank: 589 dt.adsafeprotected.com — Cisco Umbrella Rank: 526	188 KB
20	aniview.com play.aniview.com player.aniview.com track1.aniview.com go1.aniview.com sync.aniview.com Failed	485 KB
20	criteo.net static.criteo.net — Cisco Umbrella Rank: 655 pix.eu.criteo.net — Cisco Umbrella Rank: 7955 csm.eu.criteo.net — Cisco Umbrella Rank: 8150	169 KB
18	google.com 3 redirects apis.google.com — Cisco Umbrella Rank: 134 adservice.google.com — Cisco Umbrella Rank: 88 www.google.com — Cisco Umbrella Rank: 9	73 KB
15	123greetings.com 1 redirects www.123greetings.com — Cisco Umbrella Rank: 355681 s.gk.123greetings.com — Cisco Umbrella Rank: 562564	66 KB
12	casalemedia.com 6 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 525 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 456 htlb.casalemedia.com	10 KB
12	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 194	502 KB
10	yahoo.com 3 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 488 ups.analytics.yahoo.com — Cisco Umbrella Rank: 278 web.ssp.yahoo.com c2shb.pubgw.yahoo.com	4 KB
8	rubiconproject.com 2 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 327 prebid-server.rubiconproject.com	3 KB
8	adnxs.com 4 redirects ib.adnxs.com — Cisco Umbrella Rank: 230	8 KB
6	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 361	126 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	69 KB
5	teads.tv sync.teads.tv — Cisco Umbrella Rank: 1030	860 B
5	openx.net us-u.openx.net — Cisco Umbrella Rank: 399 rtb.openx.net — Cisco Umbrella Rank: 1517	897 B
4	3lift.com 4 redirects eb2.3lift.com — Cisco Umbrella Rank: 418	2 KB
4	pubmatic.com image6.pubmatic.com — Cisco Umbrella Rank: 634 ads.pubmatic.com hbopenbid.pubmatic.com	6 KB
4	adform.net 4 redirects c1.adform.net — Cisco Umbrella Rank: 612	2 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 54	3 KB
4	pinterest.com assets.pinterest.com — Cisco Umbrella Rank: 2685 log.pinterest.com — Cisco Umbrella Rank: 3654	20 KB
3	lijit.com 2 redirects ap.lijit.com — Cisco Umbrella Rank: 654	1 KB
3	onetag-sys.com 1 redirects onetag-sys.com — Cisco Umbrella Rank: 746	1 KB
3	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 816 s.tribalfusion.com — Cisco Umbrella Rank: 2148	2 KB
3	criteo.com rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 13652 ads.eu.criteo.com — Cisco Umbrella Rank: 7878 cat.nl.eu.criteo.com — Cisco Umbrella Rank: 10157	59 KB
3	google.de adservice.google.de — Cisco Umbrella Rank: 8811	1 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 45 region1.google-analytics.com — Cisco Umbrella Rank: 3094	20 KB
3	trkn.us 1 redirects trkn.us — Cisco Umbrella Rank: 1994	3 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 111	2 KB
2	smaato.net 2 redirects s.ad.smaato.net — Cisco Umbrella Rank: 740	879 B
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 476	2 KB
2	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 792 r.turn.com — Cisco Umbrella Rank: 3005	869 B
2	smartadserver.com ssbsync.smartadserver.com — Cisco Umbrella Rank: 939	150 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	115 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 158	88 KB
2	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 133	8 KB
1	technoratimedia.com sync.technoratimedia.com
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 13782	552 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 371	265 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 219	5 KB
1	adition.com 1 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1558	583 B
1	blismedia.com tr.blismedia.com — Cisco Umbrella Rank: 2742	173 B
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 1414	296 B
1	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 1072	463 B
1	amazonaws.com s3.amazonaws.com	413 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 882	649 B
1	jpada.com 1 redirects www.jpada.com	376 B
0	tremorhub.com Failed p4dt2-ha1hf.ads.tremorhub.com Failed
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
524	52

	Domain	Requested by
62	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com www.123greetings.com fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com cdn.ampproject.org
49	s0.2mdn.net	www.123greetings.com tpc.googlesyndication.com fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com s0.2mdn.net
44	pagead2.googlesyndication.com	www.123greetings.com pagead2.googlesyndication.com tpc.googlesyndication.com fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
39	cm.g.doubleclick.net	11 redirects googleads.g.doubleclick.net fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
27	c.123g.us	www.123greetings.com c.123g.us
24	i.123g.us	www.123greetings.com
15	googleads.g.doubleclick.net	pagead2.googlesyndication.com fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com www.123greetings.com
14	avm.avantisvideo.com	cdn1.avantisvideo.com cdn.avantisvideo.com
13	dt.adsafeprotected.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
13	www.google.com	3 redirects tpc.googlesyndication.com www.123greetings.com fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
13	s.gk.123greetings.com	c.123g.us s.gk.123greetings.com
12	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.123greetings.com
12	www.googletagservices.com	googleads.g.doubleclick.net c.123g.us securepubads.g.doubleclick.net fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
11	player.aniview.com	cdn.avantisvideo.com player.aniview.com
11	events1.avantisvideo.com
10	pix.eu.criteo.net	ads.eu.criteo.com
9	cdn.avantisvideo.com	securepubads.g.doubleclick.net cdn.avantisvideo.com
9	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
8	static.criteo.net	ads.eu.criteo.com
8	ib.adnxs.com	4 redirects googleads.g.doubleclick.net player.aniview.com
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
8	googleads4.g.doubleclick.net	www.123greetings.com
6	prebid-server.rubiconproject.com	player.aniview.com
6	track1.aniview.com
6	cdn.ampproject.org	securepubads.g.doubleclick.net
5	sync.teads.tv	googleads.g.doubleclick.net fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
4	c2shb.pubgw.yahoo.com	player.aniview.com
4	eb2.3lift.com	4 redirects
4	static.adsafeprotected.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
4	c1.adform.net	4 redirects
4	us-u.openx.net	googleads.g.doubleclick.net
4	fw.adsafeprotected.com	2 redirects www.123greetings.com
4	static.avantisvideo.com	cdn.avantisvideo.com
4	fonts.googleapis.com	googleads.g.doubleclick.net securepubads.g.doubleclick.net tpc.googlesyndication.com
3	ap.lijit.com	2 redirects player.aniview.com
3	onetag-sys.com	1 redirects player.aniview.com
3	fonts.gstatic.com	fonts.googleapis.com
3	www.gstatic.com	googleads.g.doubleclick.net
3	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
3	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
3	trkn.us	1 redirects www.123greetings.com
3	www.facebook.com	connect.facebook.net
3	assets.pinterest.com	www.123greetings.com assets.pinterest.com
2	htlb.casalemedia.com	player.aniview.com
2	web.ssp.yahoo.com	player.aniview.com
2	go1.aniview.com	player.aniview.com
2	s.ad.smaato.net	2 redirects
2	csm.eu.criteo.net	ads.eu.criteo.com
2	ups.analytics.yahoo.com	1 redirects player.aniview.com
2	sync.mathtag.com	2 redirects
2	ssum-sec.casalemedia.com	2 redirects
2	image6.pubmatic.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com ads.pubmatic.com
2	ssbsync.smartadserver.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
2	pixel.rubiconproject.com	2 redirects
2	pr-bh.ybp.yahoo.com	2 redirects
2	a.tribalfusion.com	1 redirects fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
2	cdn1.avantisvideo.com	cdn.avantisvideo.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.googletagmanager.com	www.123greetings.com
2	apis.google.com	www.123greetings.com apis.google.com
2	connect.facebook.net	www.123greetings.com connect.facebook.net
2	i.ytimg.com	www.123greetings.com
2	www.123greetings.com	1 redirects
1	hbopenbid.pubmatic.com	player.aniview.com
1	ads.pubmatic.com	player.aniview.com
1	sync.technoratimedia.com	player.aniview.com
1	play.aniview.com	cdn.avantisvideo.com
1	ads.travelaudience.com	1 redirects
1	match.adsrvr.org	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
1	cdnjs.cloudflare.com	ads.eu.criteo.com
1	dsp.adfarm1.adition.com	1 redirects
1	tr.blismedia.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
1	r.turn.com
1	ad.turn.com	1 redirects
1	ag.innovid.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
1	rtb.openx.net	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
1	cms.quantserve.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
1	cat.nl.eu.criteo.com	ads.eu.criteo.com
1	s.tribalfusion.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
1	ads.eu.criteo.com	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
1	rtb.fr.eu.criteo.com	www.123greetings.com
1	log.pinterest.com	www.123greetings.com
1	s3.amazonaws.com	c.123g.us
1	stats.g.doubleclick.net	www.google-analytics.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	region1.google-analytics.com	www.googletagmanager.com
1	x.123g.us	c.123g.us
1	www.jpada.com	1 redirects
0	p4dt2-ha1hf.ads.tremorhub.com Failed	player.aniview.com
0	sync.aniview.com Failed	player.aniview.com
0	googlecm.hit.gemius.pl Failed	fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
524	91

This site contains links to these domains. Also see Links.

Domain
studio.123greetings.com
itunes.apple.com
play.google.com
nl.123greetings.com
www.addthis.com
info.123greetings.com
blog.123greetings.com
widgets.123greetings.com
help.123greetings.com

Subject Issuer	Validity	Valid
*.123greetings.com Go Daddy Secure Certificate Authority - G2	`2022-03-01` - `2023-04-02`	a year	crt.sh
*.123g.us Go Daddy Secure Certificate Authority - G2	`2022-08-13` - `2023-08-11`	a year	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-28` - `2023-08-08`	a year	crt.sh
edgestatic.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-06-03` - `2022-09-01`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
gk.123greetings.com R3	`2022-07-19` - `2022-10-17`	3 months	crt.sh
trkn.us Go Daddy Secure Certificate Authority - G2	`2022-01-19` - `2023-02-20`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
s3.amazonaws.com Amazon	`2022-04-01` - `2023-03-30`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.avantisvideo.com Amazon	`2021-11-24` - `2022-12-22`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-07-22` - `2022-10-19`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-03` - `2022-11-05`	3 months	crt.sh
fw.adsafeprotected.com Amazon	`2022-04-28` - `2023-05-27`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
teads.tv R3	`2022-08-17` - `2022-11-15`	3 months	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-25` - `2023-01-25`	a year	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-06-21` - `2022-09-23`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-02` - `2022-11-01`	3 months	crt.sh
static.adsafeprotected.com Amazon	`2022-08-06` - `2023-09-04`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-14`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh
tr.blismedia.com GTS CA 1D4	`2022-08-18` - `2022-11-16`	3 months	crt.sh
dt.adsafeprotected.com Amazon	`2022-04-10` - `2023-05-08`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-21` - `2022-11-23`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.aniview.com DigiCert SHA2 Secure Server CA	`2021-12-30` - `2023-01-03`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2022-06-27` - `2023-06-05`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-06-07` - `2022-11-30`	6 months	crt.sh
*.technoratimedia.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-09-17` - `2022-10-05`	a year	crt.sh
web.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-08-02` - `2023-01-25`	6 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.onetag-sys.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-10` - `2023-01-03`	a year	crt.sh

This page contains 58 frames:

Primary Page: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Frame ID: CD6CA676D6690FE956A91D065FECB9A0
Requests: 152 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20190131/zrt_lookup.html
Frame ID: AD4C868E1CA2BDCEC2BAD4761308D2DF
Requests: 1 HTTP requests in this frame

Frame: https://c.123g.us/js2/silence.mp3
Frame ID: 7998348960C0D0D56C0D94D0FB07456D
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/v5.0/plugins/like.php?action=like&app_id=6268317308&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1e5b3f42a869b4%26domain%3Dwww.123greetings.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.123greetings.com%252Ff1f8f8c0d71a684%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html&layout=button_count&locale=en_US&ref=fb_lk_cd_1&sdk=joey&share=true&show_faces=false
Frame ID: C4A3C2F29D42CA3F82B056CB68613269
Requests: 1 HTTP requests in this frame

Frame: blob://https://www.123greetings.com/b59f571f-0c6c-4793-ad60-7ac426ead975
Frame ID: 23AC3530B6CCC50503A54071B4082515
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8275302107693664&output=html&adk=1812271804&adf=3025194257&lmt=1661375354&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1661375354402&bpp=2&bdt=506&idt=198&shv=r20220822&mjsv=m202208170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=900641229910&frm=20&pv=2&ga_vid=943555116.1661375355&ga_sid=1661375355&ga_hid=503475776&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44769306%2C31068738%2C31060566%2C31068920&oid=2&pvsid=2522243484088040&tmod=399966414&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=213
Frame ID: 0FD256FD2B9F129EEBAF842D797A9EF8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1
Frame ID: AB4913876CC20D1609AFAF6F2E4D8032
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500
Frame ID: A7FF640A0EAF4290CD0560D58AC0961A
Requests: 7 HTTP requests in this frame

Frame: https://www.facebook.com/v5.0/plugins/comments.php?app_id=6268317308&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df33006eb3961258%26domain%3Dwww.123greetings.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.123greetings.com%252Ff1f8f8c0d71a684%26relation%3Dparent.parent&container_width=0&height=100&href=http%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html&locale=en_US&order_by=reverse_time&sdk=joey&version=v5.0&width=600
Frame ID: 58338D662A4D6B8C1F95E7A57AEFC0BD
Requests: 1 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 6CB60A0031F48A217FCB81F23C0AA0F9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 4962B54890C9B5A642EA012776BCF27A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: FF991625D5AD8AB60603D8676E65D856
Requests: 2 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 2315041DFD5380A4A5E3EB0944984245
Requests: 24 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 4293582FD75F7DDE47F2052652054A3F
Requests: 14 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A86725D2E261E809BEC69BA09DCF03E7
Requests: 10 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 72260D54999CD9F11CB99E98F46ECD26
Requests: 23 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 79E815748A1F6C822BEAB38FDC8C81D6
Requests: 13 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 511CF71A3CEE2CD95DA7F07B59FE599C
Requests: 9 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs
Frame ID: D73F37A0CA45863C35F2F65720FE1E42
Requests: 20 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: CA976C790DCCF76284767552E7E9F35E
Requests: 8 HTTP requests in this frame

Frame: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 96985D33DA738152CE5B8CE9FFE804F0
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssB3QufT_0hSAVjLUWQbvucD4hLqdABGoGvGfou9b7sJPAY-qJN6SwEuIcALegTP_3qhSfQUn3GF_8G0Kjp_kXfjoSiP0jWc7DYHvdGKpXmttwmTO0v2PgjQzWWbok3z5XBoijEBt-S_OMJGjXTl_XM69qW5OL4BbOwamkAa8rtliGbCcdg1uCuxd_cwK5xb-8y1R5MdHTx9mJgQQl8sRojOlNjkZzL5NIz990TQ3A6uaefqpwng7rtjWmUsBITf--zTbRsKFn3_x99NWjW5U2R0cOVo5SRRPDTr38oBcEuFhmeEGzF-f99D2inyAke5o10xFocf7cd66WDA0De2QdzbGExHBY&sai=AMfl-YQF2wvnInGRF3Y8xN4iiWy_Qv5-MK9P3nsrM0T5veUvPq7c2KUUAoDxLQmV1ZFLYMLWPE9xWqTzDapE54mi7Uo0zCRLfKIbXGAyjh42NHKD3MQalDNMR-LSRKWpMg&sig=Cg0ArKJSzHj8IripgL6vEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 5724FE8234B7158CF7603932EABA3B47
Requests: 14 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvsRyhyyjmESF5JpzhDA7DTZV3bOGi2eXwbpcDVTGIqMgYEjy_GXvR1mwPimy9PBy0C39eyXvHzYau6gukyu0nlO_D3upyesvj1-s0hXrzFDiXE24FY5SerF1R25HhB2vwMggqiNRYi2MW540SRg_pRhdzhU_nI_1cX0S_abIuvSLwGtjtDa7izlfSfFCagnm2W4wdWXf3NvfkdSSNtkE0Z5BW_KPoE_r3W5wpukULUqOrizf33PiregtEv_PM4H1ulKYW5a2MSTS9Mi3jkSXDBKr0OJNrH6udr-d9tivMKzDhjuwd4SZD6MK1N04B71sbkEVoIoBCtoP1stnTIx8ZeR542FRgGekSLvfgGtnk&sai=AMfl-YR3mn2IXliwpqwIbnQuB41bgQ-N4B02Qx9olXjTaFCqbJoaDoXeUiExnIyWJntcZv-4HSd9YJsqMSPPY_RLDO1WIdDeAnyRQM3UCxMv5bZ7tAidvpu9Z1fZVq6HhQ&sig=Cg0ArKJSzMHq1cppFTpLEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 008C587D0005DFB7845EE0587738A7FD
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGLz8tdEBMAE&v=APEucNVSzuHcI2x6JCIkJgwC3s__RU9NmOcpO961F3LsQanFplKJxWTaEParp_bVJfej0dS9q-ufAsS2egJc00609tbi5e-6cJqP5zdy_pNBnIcBAgyTzGl0BJRivqg-1xOOl2fYRNEdFML0Q4jYxgL983LouYDkqWcl-dzQUHdNWP1ToH7EBrc
Frame ID: D4EDD5A90F6B72C3733983BD3CC206C1
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKaz1ZIDELinj5QDGMeJoNEBMAE&v=APEucNUvHAp1hDi7W9MTRRjqa5fKLMiHbbalLMPlubrts3_n3DqZlWXOmxx_sX0cF4mvkreTuCO3u1fd-WjxZKmsj2kiKEW5S7Z-ZjEnXabHXszGLlekMZf7mtGdJwiad2K3-w0OJgImhNebGQF6IV7spXzIjTk7QScsP2eSMsp6pvymPMJgn24
Frame ID: 5FED597970EFCD8AFC5F5E6B148C0B2E
Requests: 5 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YwaTewAMhCQH_ZKbAAwEskkWxLYgKefFm_wKWw&u=%7CIONJyjsMzQ7cJ4645g06%2BSk73yDFMajVImWv%2BtGARNo%3D%7C&c1=VEd5MTeK-DVtvwpxQwkatQ5fNcsqqVzrn0bJRZSWEljoMqTy8nHmy-ZCx2l8r38z-Y5KeOqAmeGKc9dh3PNWVQn404KTD77vBGTZgYRjMPz_4aEs-vs_puyZCUHkvYKSVwTCnzCDODg6XLOk626p9iBtC1r959XS3Hg7uD7iAHvZB6OzfWHBbUfUeSHrmM3ONdl8KMIlWYpjAHABIF5kpJfapFeADPxXb1pDl3KIzh1aScSWn1eMeBFjJ0knhSj7lKSmWQBU9pj2OUugSgGyh4-zC5bPwt_OgYoR7kFxfzNxBIofigG1RyNTmQQbidtTSklo2E3Bs-1BjCvsj5a0uxnYYPT-5h-t5uKVBseTmCyXjwRgm6xnoiqYzuHDraoSjp2r9ygujrslXLh9K5mFGKYJOnnwLS00f6wbiCle2lpOLFGtnq72DgfIqWEpKomrikzmNmLtZdlH28pIUixLiUM7-2lHcnBprIZ1Mq8KkZ0&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfFcqe5MGY6SIMpul9u8PsomwmAbJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ2Mjc1MTc2ODAyNDk2NzCgAdW20uoDyAEJqQLvqpI6m8SwPuACAKgDAaoEtgJP0H4Gn8AGHt7CZ_CqcRsrrRUJ8Co3WhuPP4yDAuGVtWejo3UqD9B7QIAtm6UZQqyuZ4WP2Aiu7gHroATtCBJpCwJVWOYbh8qj73xhWbic_QHURG_CNBNHrlA-7AjjagpKd1x-JLUx7UZRPAtY1x5g2tpleUnIVNMzus9CYWyqinA1B-K3Z08YIKD1mtJzn6roZHfK1JP-H2DIXgUdOywPzcNQoDQqE7KDnmK9kMLYql8_Zc0hHZ9T5nRythLIGFbuAAD9-B7EVji2jL4PK3mBIQHmisbK_PspL8r__SCh2GvMeuNr14jn81l9fJ39wTssfYgNS1NmEsGNFI2ECYzqROPIluHXI2ruCAlFvyYukqOUxKdVXMEe6DX_Eemxrh6lNJF7MghCxB7uW-dY10wbakNrKSat4AQBgAaLvozdwK6T2toBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2zD1xNWfm405kdZ8fBYDLdhPfXJQ%26client%3Dca-pub-4627517680249670%26adurl%3D
Frame ID: 788CED2D218A4C842B3D9D401FA81AF1
Requests: 23 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5DC6862B389B3DC00EC23D886ECB40DA
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNH7tdEBMAE&v=APEucNVXHWIljw5ahBHYzwjqCiOpDnYeD0f4PPdam-2edxeCGLoKRf6rQrNotrXNoQcr2Ohl08ljGC7jW-qoTrqd6kFgUOv7Efzf8xivtd053QF3r0wT85BdMWPLFVJEx1pmV7qQGf342wupPOp1vvKJ-ADdM8sJpuZaccl58DxsXRRAihN5qf8
Frame ID: 67EA72BC4E6A339DE3ECBB0F9F0A4D5D
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJWG2AEQ0ryZ9AMY6_bW0QEwAQ&v=APEucNVXmeHpKifDgtVDueHIrYJAIdqJeOArrFwiDix5JfNm3vgYk4y1hLKBUX6040kwUQ8wfWkCx74gMgwrqdOIleSIVrB34qedfOGf_TCgYGL__fL6U-TjNj12M9cuGN6u2cDeAkdPoxZl_sMB-Gq38zUklskyYkPfM50B7DJHnFQvwKRTNgo
Frame ID: F642E278C30BCE564A582988FCBF359A
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html
Frame ID: 96D90FA08EDEF1619708D4B43347B515
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html
Frame ID: FC8FB602BB0C9B79777A2345616DECD0
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html
Frame ID: 417E4FB58D68A4F9A09B5921D7696F85
Requests: 8 HTTP requests in this frame

Frame: https://cdn1.avantisvideo.com/connect/u_d.html
Frame ID: 8E80067EF692DC3ED03D410189EAA072
Requests: 2 HTTP requests in this frame

Frame: https://cdn1.avantisvideo.com/connect/u_d.html
Frame ID: 0B6BE910FE921097E217C7B605B4E1AE
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 1D1245900078B10359F9218C4393FCCB
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 899A81947A96E33147E644E9E257AC11
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 54EC31EA3553521E3E93E509F3D2DD35
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 14BA1A609508D485497DFABDF6108D4A
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: F9FC4C7B6A855DFA2E90FD182D0D7BE9
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B52005EF1D9FA081398F1396CD9B6DFF
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 66A1BAB1AE1FA1E388C2255A09FEE0C1
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 93F64148E16C458D0227D74DCB6A4EBE
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 2E61284841499F22F220493DC7837682
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 534816E9720FECA8A5D24CC22CE75D5E
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
Frame ID: 0A8505F25463FECCFF9689E27CBFF552
Requests: 21 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 06AD4E4E2B2D9C372EC23D992EA54704
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
Frame ID: FB5EE250EA6FB08D6B212D2989421BB1
Requests: 22 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B6CAEB496B116E44BAB723179BFFB99F
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 21388E279E7F6450B48233572F31B786
Requests: 3 HTTP requests in this frame

Frame: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Frame ID: E5E152D103A71363F70D9D63DBE199BD
Requests: 5 HTTP requests in this frame

Frame: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Frame ID: A51D23FA86EFB58E54B1B56E8C2CD34D
Requests: 5 HTTP requests in this frame

Frame: https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=55&key=4924864200398375348
Frame ID: A9026FFA5629C8BFB073E2EB37F7456C
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/pixel?us_privacy=1---&gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D18%26key%3D%24UID
Frame ID: B8B7FA5C1C4A91FC9D2FD8904B028725
Requests: 1 HTTP requests in this frame

Frame: https://ups.analytics.yahoo.com/ups/58543/occ?gdpr=1&gdpr_consent=
Frame ID: B26BFC4151AEDB9074601B4EB1398FBC
Requests: 1 HTTP requests in this frame

Frame: https://sync.technoratimedia.com/services?srv=cs&pid=70&uid=1661375360368-929089296316-007184-009-006119&cb=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D3%26key%3D%5BUSER_ID%5D
Frame ID: 6791CF18466F887AFFFF47990B2C00EE
Requests: 1 HTTP requests in this frame

Frame: https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=200&key=OPTOUT
Frame ID: 22B9BEDC28E061A06A9A4DD893E71ECE
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=160993&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D1%26key%3D
Frame ID: E3ED8302F12CF5D4C1628A0C5E776F7E
Requests: 2 HTTP requests in this frame

Frame: https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=56&pid=59c9148628a0612da3689288&key=ae49bf5f-f9d5-42ce-a952-cd45d1548c84
Frame ID: 04495E3446F7E4D6A85751C6074BFEB7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Being With You Makes Me Waffley Happy. Free Waffle Day eCards | 123 Greetings

Page URL History Show full URLs

https://www.jpada.com/cgi-bin/click.pl?cid=nl040874202206&lid=232092&uid=202812725 HTTP 302
https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_so... Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Pinterest (Widgets) Expand

Overall confidence: 100%
Detected patterns

//assets\.pinterest\.com/js/pinit\.js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

SWFObject (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swfobject.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

524
Requests

90 %
HTTPS

47 %
IPv6

52
Domains

91
Subdomains

73
IPs

9
Countries

9167 kB
Transfer

17447 kB
Size

37
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://studio.123greetings.com/
Title: Studio

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/in/app/123greetings/id718873921?mt=8

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.g123

Search URL Search Domain Scan URL

URL: https://nl.123greetings.com/
Title: Newsletter

Search URL Search Domain Scan URL

URL: https://nl.123greetings.com/blog/
Title: Editor Bob's Blog

Search URL Search Domain Scan URL

URL: https://www.addthis.com/bookmark.php

Search URL Search Domain Scan URL

URL: https://info.123greetings.com/company/pressroom/
Title: Press Room

Search URL Search Domain Scan URL

URL: https://blog.123greetings.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://widgets.123greetings.com/
Title: Widgets

Search URL Search Domain Scan URL

URL: https://nl.123greetings.com/tell-a-friend
Title: Recommend Us

Search URL Search Domain Scan URL

URL: https://help.123greetings.com/
Title: Help

Search URL Search Domain Scan URL

URL: https://help.123greetings.com/contact_us.html
Title: Contact Us

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.jpada.com/cgi-bin/click.pl?cid=nl040874202206&lid=232092&uid=202812725 HTTP 302
https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://www.123greetings.com/usr-bin/view_sent.pl?type=VW&cardid=347889 HTTP 302
https://c.123g.us/images/zero.gif

Request Chain 79

https://trkn.us/info/?sid=1efbd474-f6d6-4c7a-ab0e-0a28232c817d&ord=6054198110.337199&ref=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&dvis=visible HTTP 302
https://trkn.us/info/?sid=1efbd474-f6d6-4c7a-ab0e-0a28232c817d&ord=6054198110.337199&ref=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&dvis=visible&ip=80.255.10.202&cuidchk=1

Request Chain 220

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

Request Chain 221

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

Request Chain 222

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1

Request Chain 223

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D

Request Chain 224

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

Request Chain 225

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

Request Chain 226

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1

Request Chain 227

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D

Request Chain 232

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1

Request Chain 234

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1

Request Chain 236

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1

Request Chain 238

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1

Request Chain 276

https://a.tribalfusion.com/i.match?p=b6&u=CAESEK-hhlK_OJBxZBM13jRdZfM&google_cver=1&google_push=AehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEK-hhlK_OJBxZBM13jRdZfM&google_cver=1&google_push=AehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 277

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIFo-jDO72qd18O6eGfsFeQ&google_cver=1&google_push=AehlK4CdG8e1opYc2OZkU1AtsrVfEWhToLJze_0tOFtsNg8o5TEo-_fHfv6BGv_XFG_sZAUCJnQC0QTKkXvijiAiPYWtj3mdX2YJ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4CdG8e1opYc2OZkU1AtsrVfEWhToLJze_0tOFtsNg8o5TEo-_fHfv6BGv_XFG_sZAUCJnQC0QTKkXvijiAiPYWtj3mdX2YJ&google_hm=NzQxMDE2NTkxNjIzNTAxOTcwMw%3D%3D

Request Chain 278

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pqP86pwDwNAzLWizFRiXS6Af5OU HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pqP86pwDwNAzLWizFRiXS6Af5OU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pqP86pwDwNAzLWizFRiXS6Af5OU

Request Chain 279

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEL4R9wXI2EtWoej5bETECXk&google_cver=1&google_push=AehlK4CNTx-UeSp7m1zW5-5uNIBgJFJ9JqHiNZ_owzF5z7nOWv8RKWf13F2F47GjRYz6kxuwoZwIg0TckrndGp-mKCmuyu97GNzr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRN0stMVAtMkFLTg==&google_push=AehlK4CNTx-UeSp7m1zW5-5uNIBgJFJ9JqHiNZ_owzF5z7nOWv8RKWf13F2F47GjRYz6kxuwoZwIg0TckrndGp-mKCmuyu97GNzr

Request Chain 280

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEAKtXDy9ffxOsfj4HvcADG8&google_cver=1&google_push=AehlK4AfLX6ns1gQPMDZNx5QJFm8CCrJ_ePqjWYoNLYcpAKNjKHBtuJcZ_e7cWigRITecIxsZh2rsDB_wVTuCDJER8Z-IHsBSEek HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AehlK4AfLX6ns1gQPMDZNx5QJFm8CCrJ_ePqjWYoNLYcpAKNjKHBtuJcZ_e7cWigRITecIxsZh2rsDB_wVTuCDJER8Z-IHsBSEek

Request Chain 298

https://fw.adsafeprotected.com/rfw/st/1141311/65046770/4.js?ias_dspID=3&ias_campId=1008628059&ias_pubId=pub-4627517680249670&ias_chanId=1&ias_placementId=17989214151&bidurl=https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gddbRv07qW-scVQj1K0HkZ&adContainerId=brand_safety_fZMGY7KXAeeO9u8P-dOjyAo&cbFunctionName=goog_wrapCb_fZMGY7KXAeeO9u8P-dOjyAo&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fwww.123greetings.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Ffada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Ffada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:da6541a0-7316-3f96-b625-2eb5f24be1cd,c:mff41x,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-7957db8f47-rqwp4,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,mu:10000,br:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h*.1141311-65046770%7C1h1%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1h*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:svg.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:27,oid:03a7ead1-23f1-11ed-b2c9-c2a89ab71e68,v:19.8.344,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4.js

Request Chain 300

https://fw.adsafeprotected.com/rfw/st/1141311/65046779/4.js?ias_dspID=3&ias_campId=1008628059&ias_pubId=pub-4627517680249670&ias_chanId=1&ias_placementId=17989214151&bidurl=https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gdkS8BIy-Y50tjdI1xtXVb&adContainerId=brand_safety_fJMGY5PmO8ms9u8Pws-CyAs&cbFunctionName=goog_wrapCb_fJMGY5PmO8ms9u8Pws-CyAs&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fwww.123greetings.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Ffada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Ffada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:79e680a6-b2cc-df4f-f367-c2be50febad2,c:mff42n,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-7957db8f47-twhjn,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,mu:10000,br:c,an:n,oam:0,mtim:2,mot:0,app:0,maw:0,fm:tfsRGO8+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e*.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h1%7C1h2%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1e*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:svg.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:24,oid:03a7eac8-23f1-11ed-b662-3ebe6e59666b,v:19.8.344,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4.js

Request Chain 306

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEL4R9wXI2EtWoej5bETECXk&google_cver=1&google_push=AehlK4D7hPlGa0M4-JPRDssVeQUbXLbTqeRN3fdhTHyz9t4ltWINGVa6xPejoOtKJM9zmJIEYSEbAnOt8BDxOfZf2WprL9hyveTf HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRRlgtMVMtQzRIRg==&google_push=AehlK4D7hPlGa0M4-JPRDssVeQUbXLbTqeRN3fdhTHyz9t4ltWINGVa6xPejoOtKJM9zmJIEYSEbAnOt8BDxOfZf2WprL9hyveTf

Request Chain 307

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_cver=1&google_push=AehlK4DEde1SMH7MWt_ynnmMlZx3u5qZib28ZMWK6FRwxG1UN1SaU0M8iUVueFyJP3G26haB5zh-vtyOfe8NoqLCR-M_FAIDOCev HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DEde1SMH7MWt_ynnmMlZx3u5qZib28ZMWK6FRwxG1UN1SaU0M8iUVueFyJP3G26haB5zh-vtyOfe8NoqLCR-M_FAIDOCev

Request Chain 317

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEPGRNJlanIV1MGiff8G4DS8&google_cver=1&google_push=AehlK4DY_G_5I8IxcW7kNMVMfe_vE3zvTvuGkWiGVGijS5qTB40wH9vNUTrQd8SZnK21qBq1lt82cXxsSJHA5d0i52xUaOqn190K HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ0NTkzNzI3MDk3MjI3ODQ5Nw==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPGRNJlanIV1MGiff8G4DS8&google_cver=1

Request Chain 318

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESECztc-uTX6X0_AA-MID2_z8&google_cver=1&google_push=AehlK4C5Cnk0XzkrM0sovq_DZCvTTrwICxMESo15ICMWUXo4C2hp4J6g4zUX4aKdMlaitxCC1KqhiMm5SrwKqPekAFauNKevegJG HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4C5Cnk0XzkrM0sovq_DZCvTTrwICxMESo15ICMWUXo4C2hp4J6g4zUX4aKdMlaitxCC1KqhiMm5SrwKqPekAFauNKevegJG

Request Chain 320

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEIR46vHE2DcF5HLMpjZ_M7o&google_cver=1&google_push=AehlK4DdrL2w06E2v3tyM6WyZoCnvoH0H3l7d3_6EOAnhElOx2jpdniLS7iFsxH08-_26bULwMI4P1zEJvOu4YjB74TXKNozf9Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzEzNTU1MjgyNDcxNjU1NjQzMQ%3D%3D&google_push=AehlK4DdrL2w06E2v3tyM6WyZoCnvoH0H3l7d3_6EOAnhElOx2jpdniLS7iFsxH08-_26bULwMI4P1zEJvOu4YjB74TXKNozf9Y

Request Chain 321

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4BJvpE-m3rCG-48kWuwAl5e42Rc8MeRYwG-JMrg0xtwwXYngTukqjSW5Uwh9AvzSG4mzFn38esEH5iVHFSLFzbjMlxPgyoD HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4BJvpE-m3rCG-48kWuwAl5e42Rc8MeRYwG-JMrg0xtwwXYngTukqjSW5Uwh9AvzSG4mzFn38esEH5iVHFSLFzbjMlxPgyoD

Request Chain 322

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFyjv75Z8taZcXZ8J_SavFE&google_cver=1&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86aVva9oer1siCaNqqL_hJbvr4-17OBViWULNEBgUV6rlx HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86aVva9oer1siCaNqqL_hJbvr4-17OBViWULNEBgUV6rlx&google_gid=CAESEFyjv75Z8taZcXZ8J_SavFE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86aVva9oer1siCaNqqL_hJbvr4-17OBViWULNEBgUV6rlx

Request Chain 323

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEKEuyiGDc2W6nAgwKdeULKw&google_cver=1&google_push=AehlK4Dq81GpIgigb_WrV9cG3o3yr0S7sNZxGe4prr-e4fRr344XSjty2Pkew_1VpZGF9cEJfuy_k_l3W7S55LV4B-0PnmyNzPbu HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Wb3BobmVaRTJ1R0Nud3R4RTM2YVdjNGdobXZXSmZLen5B&google_push=AehlK4Dq81GpIgigb_WrV9cG3o3yr0S7sNZxGe4prr-e4fRr344XSjty2Pkew_1VpZGF9cEJfuy_k_l3W7S55LV4B-0PnmyNzPbu

Request Chain 354

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 356

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 357

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 366

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESECztc-uTX6X0_AA-MID2_z8&google_cver=1&google_push=AehlK4CUwdMf9wFJFqJ_5QZ_JXiKkl0cxE88LZetEVO_V8ooND8WS_XG_Yuloly5crAhQk3Ism9fiTJOQYB2GvBYVbTTTWwyY_VX HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=IdFjBpN9SgCkV1trz_5yjg&google_push=AehlK4CUwdMf9wFJFqJ_5QZ_JXiKkl0cxE88LZetEVO_V8ooND8WS_XG_Yuloly5crAhQk3Ism9fiTJOQYB2GvBYVbTTTWwyY_VX

Request Chain 367

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIFo-jDO72qd18O6eGfsFeQ&google_cver=1&google_push=AehlK4Bayit15JfK6UbR8ubhtI_dl4kmPnmhevHHp4zIbxr46h0ZlVo_1jCW5ZcXJIaMR6U2Va2hbI7Q_T0PzwiWQ_NWyzstBsXj1w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4Bayit15JfK6UbR8ubhtI_dl4kmPnmhevHHp4zIbxr46h0ZlVo_1jCW5ZcXJIaMR6U2Va2hbI7Q_T0PzwiWQ_NWyzstBsXj1w&google_hm=NzQxMDE2NTkxNjIzNTAxOTcwMw%3D%3D

Request Chain 368

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPc91A0PCYK1fl5tuIsItGk&google_cver=1&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJOw-qG8RKB_if0g HTTP 307
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPc91A0PCYK1fl5tuIsItGk&google_cver=1&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJOw-qG8RKB_if0g&sovrn_retry=true HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJOw-qG8RKB_if0g&google_hm=FM41uGZHwDPZMbehRCq5Zbcl

Request Chain 369

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEMpvplr0vRy5P3Tx4xPDCZQ&google_cver=1&google_push=AehlK4CLJwf0l_QPPDghvzOZhh8Ai0XlRy08_Ue68KOHXjDZvFisvxFqtdERpRJzWtucWS7C7cwDhTHh3E2EK7uPEFqpykFLy2lsLA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4CLJwf0l_QPPDghvzOZhh8Ai0XlRy08_Ue68KOHXjDZvFisvxFqtdERpRJzWtucWS7C7cwDhTHh3E2EK7uPEFqpykFLy2lsLA

Request Chain 370

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFyjv75Z8taZcXZ8J_SavFE&google_cver=1&google_push=AehlK4DGRCaXRGc_-564Yq2LEFjtdXyUwAC3GYHBTOGgnrwqFX0WTuIIfHTTz4jxm2EZ7WjSiBbr251UEEeuTpqWJbGQfbdv4fkcCQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4DGRCaXRGc_-564Yq2LEFjtdXyUwAC3GYHBTOGgnrwqFX0WTuIIfHTTz4jxm2EZ7WjSiBbr251UEEeuTpqWJbGQfbdv4fkcCQ

Request Chain 396

https://ads.travelaudience.com/google_pixel?google_gid=CAESENCVdE7-Dd_-EgW__0hhUUw&google_cver=1&google_push=AehlK4AjSOXWrcz7SSFofJLKA6JMnCWSJdMeZAbwPcavvqsSjp7j1XztkLr43awo6gmX11LDQfwvPQIkW7auyHQFVA8m7jixZ1U HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=OconkSDuSLq9z6aG1lwq5Q2&google_push=AehlK4AjSOXWrcz7SSFofJLKA6JMnCWSJdMeZAbwPcavvqsSjp7j1XztkLr43awo6gmX11LDQfwvPQIkW7auyHQFVA8m7jixZ1U

Request Chain 397

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4CYeZ2sHsphsxb3kJSiQ5moXV_IGnShyWmQsziL2GbIh1MFGqhlssKh-CEGoLwja3rby0nuvmF8u4Sy_ww7i_Q-rvvanPk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4CYeZ2sHsphsxb3kJSiQ5moXV_IGnShyWmQsziL2GbIh1MFGqhlssKh-CEGoLwja3rby0nuvmF8u4Sy_ww7i_Q-rvvanPk

Request Chain 398

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_cver=1&google_push=AehlK4DlKpNeLAdgTMl1n8gAlgbS67UAnPb9UsN6IMopRpYpmYal2kczycl2pkeDgM_PoQbQN2O5uGO-m6MpRVg8frpAtcNEjFc HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DlKpNeLAdgTMl1n8gAlgbS67UAnPb9UsN6IMopRpYpmYal2kczycl2pkeDgM_PoQbQN2O5uGO-m6MpRVg8frpAtcNEjFc

Request Chain 399

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEMpvplr0vRy5P3Tx4xPDCZQ&google_cver=1&google_push=AehlK4BjUF76u3tKodcm4orHjaPoDDkMPdY96b-z4PeN4ENurTjd09648fKtt64d27ROZZEytu6I38tt7VoEi4NRFZcYmQfSsfU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4BjUF76u3tKodcm4orHjaPoDDkMPdY96b-z4PeN4ENurTjd09648fKtt64d27ROZZEytu6I38tt7VoEi4NRFZcYmQfSsfU

Request Chain 400

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFyjv75Z8taZcXZ8J_SavFE&google_cver=1&google_push=AehlK4BCsvrbmZUvvZfJHXe1QghkF6eDhqQrysbKl--n16nie_aQ8M2l_zhW7oVIvTj_qMwT2Ey-vxf0dnbYKReUPimNHd14iK4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4BCsvrbmZUvvZfJHXe1QghkF6eDhqQrysbKl--n16nie_aQ8M2l_zhW7oVIvTj_qMwT2Ey-vxf0dnbYKReUPimNHd14iK4

Request Chain 496

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D55%26key%3D%24UID HTTP 302
https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=55&key=4924864200398375348

Request Chain 500

https://sync.1rx.io/usersync2/rmpssp?sub=aniview&gdpr=1&gdpr_pd=0&gdpr_consent=&redir=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D200%26key%3D%5BRX_UUID%5D HTTP 302
https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=200&key=OPTOUT

Request Chain 502

https://csync.loopme.me/?redirect=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D56%26pid%3D59c9148628a0612da3689288%26key%3D%7Bdevice_id%7D HTTP 307
https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=56&pid=59c9148628a0612da3689288&key=ae49bf5f-f9d5-42ce-a952-cd45d1548c84

524 HTTP transactions
18 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request being_with_you_makes_me_waffley_happy.html Show response
www.123greetings.com/events/national_waffle_day/
Redirect Chain

https://www.jpada.com/cgi-bin/click.pl?cid=nl040874202206&lid=232092&uid=202812725
https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4

39 KB
10 KB

1159ms
854ms

Document
text/html

184.72.244.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

184.72.244.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

www.123greetings.com

Software

Apache /

Resource Hash

acd6695490b21ed0065476de6d0fa24e8e38f1e4c398e0c9df578340cbf31fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 0
Cache-Control: max-age=900
Connection: close
Content-Encoding: gzip
Content-Length: 9676
Content-Type: text/html; charset=UTF-8
Date: Wed, 24 Aug 2022 21:09:13 GMT
Expires: Wed, 24 Aug 2022 21:24:13 GMT
Server: Apache
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

Redirect headers

content-length: 433
content-type: text/html; charset=iso-8859-1
date: Wed, 24 Aug 2022 21:09:12 GMT
location: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
server: Apache/2.2.15 (CentOS)
vary: Origin
via: 1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-amz-cf-id: JtrtmhTaxWS2p_MBqJQbHe40CPjCX3i266roLuOYyngArCNor_rFpg==
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront

GET
H/1.1 200
OK card_page_R1.css
c.123g.us/css/ 27 KB
28 KB 64ms
20ms Stylesheet
text/css 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/css/card_page_R1.css
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 35276e401d27d1f4ceb5f451cd11b25ff453808d2152e338e07b4b25978f25a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 27 Jul 2022 13:42:12 GMT
Last-Modified: Wed, 15 Jun 2022 10:42:44 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2446021
ETag: "805c0-6db9-5e17a2e623100"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28089
jake_test: Test_Pass

GET
H/1.1 200
OK chk_script.js Show response
c.123g.us/js2/ 3 KB
1 KB 62ms
19ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/chk_script.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 13d4667177bf9777b7d9a0ce216beb8f877f4836ae8e234e689547abcbad7837

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Thu, 28 Jul 2022 09:44:11 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 Jul 2022 09:43:11 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2373902
ETag: "2c045-c3f-5e4da5c97a9c0"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1062
jake_test: Test_Pass

GET
H2 200 PinExt.png
assets.pinterest.com/images/ 936 B
1022 B 346ms
16ms Image
image/png 2a04:4e42:41::84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.pinterest.com/images/PinExt.png
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:41::84 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8b909b0ca962aaa8e304102c11c95a5902b6250dbb270625e822bea12330f9a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
x-cdn: fastly
etag: "61ed0472dfcbfaf25e7585f119adf76a"
vary: Origin
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: X-CDN
cache-control: max-age=86400
access-control-max-age: 86400
content-length: 936

GET
H/1.1 200
OK 347889.gif
i.123g.us/c/eaug_nationalwaffle_day/card/ 3 MB
3 MB 276ms
167ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/card/347889.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 20c9691d6a91376627c5141a980f1ccaff0ee01663d71425675ac0829762080a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 09:59:38 GMT
Last-Modified: Wed, 08 Sep 2021 12:09:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1076976
ETag: "37b26c-5cb7abfcec100"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3650156
Expires: Fri, 12 Aug 2022 10:14:38 GMT

GET
H/1.1 200
OK 340179_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 4 KB
4 KB 103ms
49ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/340179_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: d8c568b0ac5ae86b080bf1e75f3354cdec6226ebaf5cb59071749c6d368d89f1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sun, 31 Jul 2022 07:48:14 GMT
Last-Modified: Fri, 23 Aug 2019 14:00:27 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2121660
ETag: "f54-590c93a7314c0"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3924
Expires: Sun, 31 Jul 2022 08:03:14 GMT

GET
H/1.1 200
OK 325194_ic.jpg
i.123g.us/c/eaug_nationalwaffle_day/ic/ 2 KB
2 KB 77ms
35ms Image
image/jpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/325194_ic.jpg
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 4420a2dc2da2e15ec5b200647ae2f44777913780a7158cd66af274ab0907f79a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 01 Aug 2022 22:15:48 GMT
Last-Modified: Fri, 19 Aug 2016 13:25:01 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1983206
ETag: "7ad-53a6ca021c540"
Content-Type: image/jpeg
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1965
jake_test: Test_Pass
Expires: Sun, 14 Aug 2022 06:42:42 GMT

GET
H/1.1 200
OK 344134_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 4 KB
4 KB 138ms
56ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/344134_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 801fef12e66f08f92702dc8da7fbc6a7b7a1ced535e5ce16aa0dd3ff86670925

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 08 Aug 2022 16:39:37 GMT
Last-Modified: Wed, 19 Aug 2020 11:22:48 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1398577
ETag: "f62-5ad393933f200"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3938
jake_test: Test_Pass
Expires: Sat, 13 Aug 2022 05:50:19 GMT

GET
H/1.1 200
OK 344135_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 3 KB
4 KB 222ms
137ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/344135_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e95aedd1d541d298db3c600fb7629d10277e4241e4d380970bfed9d4fc8bcecb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 21:04:51 GMT
Last-Modified: Wed, 19 Aug 2020 11:24:29 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1123463
ETag: "df2-5ad393f391540"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3570
jake_test: Test_Pass
Expires: Mon, 22 Aug 2022 14:40:40 GMT

GET
H/1.1 200
OK 126782_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 2 KB
3 KB 88ms
46ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/126782_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 5e3b717b0e63024c5bcd43346a8b1817889634306aa164574eb3d653d6087378

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 30 Jul 2022 22:52:24 GMT
Last-Modified: Wed, 05 Aug 2015 15:38:21 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2153810
ETag: "9f9-51c9231459540"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2553
jake_test: Test_Pass
Expires: Fri, 05 Aug 2022 00:31:37 GMT

GET
H/1.1 200
OK 340180_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 4 KB
4 KB 126ms
54ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/340180_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 0fc1c5579296e05807e4a3ed8052d821166c556e9e39138c11dfbc0578a29256

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 10 Aug 2022 04:10:20 GMT
Last-Modified: Fri, 23 Aug 2019 13:59:55 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1270734
ETag: "f1c-590c9388accc0"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3868
jake_test: Test_Pass
Expires: Wed, 10 Aug 2022 04:25:20 GMT

GET
H/1.1 200
OK 126784_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 2 KB
2 KB 120ms
34ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/126784_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ca1deb7814e81701ef63e86adea51765e595b29cca0a0fa53c302216140ce3be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 08 Aug 2022 10:39:33 GMT
Last-Modified: Wed, 05 Aug 2015 15:38:32 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1420181
ETag: "69b-51c9231ed6e00"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1691
jake_test: Test_Pass
Expires: Thu, 11 Aug 2022 15:42:51 GMT

GET
H2 200 3.jpg
i.ytimg.com/vi/ccrZd2S5a5E/ 3 KB
3 KB 49ms
20ms Image
image/jpeg 2a00:1450:4001:801::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/ccrZd2S5a5E/3.jpg

Requested by

Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c9af50bf0b620338c52663395cc61108370bebfa8a25b9b1ece94ede1c74eb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3017
x-xss-protection: 0
server: sffe
etag: "0"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 24 Aug 2022 23:09:14 GMT

GET
H/1.1 200
OK 318305_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 3 KB
4 KB 96ms
47ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/318305_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 444fc949343083bf7be5163f23255044d67bce2f1f6b0c47382f508c594cf5b4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 08 Aug 2022 10:39:32 GMT
Last-Modified: Mon, 17 Aug 2015 23:29:47 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1420182
ETag: "d93-51d8a2d5830c0"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3475
Expires: Thu, 11 Aug 2022 15:42:55 GMT

GET
H/1.1 200
OK 347889_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 4 KB
4 KB 47ms
47ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/347889_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 74953950ae3ae1c6142dcfad80f766b6b344e6ad6cbc4a2a961f32aa17ae501b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 27 Jul 2022 04:41:45 GMT
Last-Modified: Wed, 08 Sep 2021 12:09:49 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478449
ETag: "ec6-5cb7ac2405d40"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3782
jake_test: Test_Pass
Expires: Sun, 31 Jul 2022 22:17:41 GMT

GET
H/1.1 200
OK 350888_ic.jpg
i.123g.us/c/eaug_nationalwaffle_day/ic/ 2 KB
3 KB 54ms
54ms Image
image/jpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/350888_ic.jpg
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ef8ad2c4661595931d8bef75c3809b86672e880e7d0b6730c6b9dac5e524b110

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 24 Aug 2022 11:19:38 GMT
Last-Modified: Wed, 24 Aug 2022 10:24:14 GMT
Server: Apache/2.2.15 (CentOS)
Age: 35376
ETag: "8e6-5e6fa151d2f80"
Content-Type: image/jpeg
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2278
jake_test: Test_Pass
Expires: Wed, 24 Aug 2022 12:18:24 GMT

GET
H/1.1 200
OK 126785_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 3 KB
4 KB 50ms
48ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/126785_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Footprint Distributor V6.1.1162 /
Resource Hash: 2f7e194d4373d3e45bac4568781254590d984e585b4fada6efa331a377d53791

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 23 Aug 2022 13:28:08 GMT
Last-Modified: Mon, 24 Feb 2014 08:31:58 GMT
Server: Footprint Distributor V6.1.1162
Age: 114066
ETag: "d8c-4f322ce095b80"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3468
Expires: Tue, 23 Aug 2022 13:43:08 GMT

GET
H/1.1 200
OK 334869_ic.jpg
i.123g.us/c/eaug_nationalwaffle_day/ic/ 5 KB
5 KB 41ms
36ms Image
image/jpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/334869_ic.jpg
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: deb5946ae375e1c7811c512493649f280c39699948e68c8de5fa5cb83e855942

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 08 Aug 2022 10:39:33 GMT
Last-Modified: Thu, 12 Jul 2018 11:01:03 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1420181
ETag: "146e-570cb4773d9c0"
Content-Type: image/jpeg
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5230
jake_test: Test_Pass
Expires: Mon, 08 Aug 2022 10:54:33 GMT

GET
H/1.1 200
OK 325196_ic.jpg
i.123g.us/c/eaug_nationalwaffle_day/ic/ 1 KB
2 KB 58ms
58ms Image
image/jpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/325196_ic.jpg
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 94146c0f666aa2a10834c4330172d530237db2313392b4ff4a28fdef63ff5106

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 26 Jul 2022 19:13:11 GMT
Last-Modified: Sat, 20 Aug 2016 09:31:03 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2512563
ETag: "4aa-53a7d793e43c0"
Content-Type: image/jpeg
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1194
jake_test: Test_Pass
Expires: Wed, 17 Aug 2022 14:18:39 GMT

GET
H/1.1 200
OK 126783_ic.gif
i.123g.us/c/eaug_nationalwaffle_day/ic/ 3 KB
3 KB 32ms
32ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/ic/126783_ic.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 11a589116a1e20917c76f2b0af9cd0eb518c98cba15fac04719be0bf111b1b6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 10 Aug 2022 18:24:13 GMT
Last-Modified: Wed, 05 Aug 2015 15:38:27 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1219501
ETag: "bdc-51c9231a122c0"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3036
jake_test: Test_Pass
Expires: Wed, 10 Aug 2022 18:39:13 GMT

GET
H2 200 default.jpg
i.ytimg.com/vi/wtQwtSCN_rw/ 5 KB
5 KB 64ms
36ms Image
image/jpeg 2a00:1450:4001:801::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/wtQwtSCN_rw/default.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a392ae9e21158d254aec9aea96b1b069627a8c6f0f34303aa07e603f38d38294

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4707
x-xss-protection: 0
server: sffe
etag: "1520586730"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 24 Aug 2022 23:09:14 GMT

GET
H/1.1

200
OK

zero.gif
c.123g.us/images/
Redirect Chain

https://www.123greetings.com/usr-bin/view_sent.pl?type=VW&cardid=347889
https://c.123g.us/images/zero.gif

49 B
342 B

21ms
21ms

Image
image/gif

8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/zero.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sun, 31 Jul 2022 21:14:02 GMT
Last-Modified: Wed, 15 Jun 2022 10:44:10 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2073313
ETag: "81207-31-5e17a33827280"
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49
jake_test: Test_Pass

Redirect headers

Location: https://c.123g.us/images/zero.gif
Date: Wed, 24 Aug 2022 21:09:14 GMT
Server: Apache/2.2.15 (CentOS)
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Length: 303
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H/1.1 200
OK jquery.js Show response
c.123g.us/js2/ 92 KB
92 KB 22ms
20ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/jquery.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: b1254df573d769a6c40d4a8a8649832a9f5494c28ec4c1c9ec48df9013940e1d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 26 Jul 2022 05:15:50 GMT
Last-Modified: Wed, 15 Jun 2022 10:42:43 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2562803
ETag: "8047c-16f3a-5e17a2e52eec0"
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 94010
jake_test: Test_Pass

GET
H/1.1 200
OK tab.js Show response
c.123g.us/js2/ 5 KB
3 KB 28ms
27ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/tab.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: d0fbf06f675663f1ec793289e8eaa4dcc4eb791f90e6311ed809b506e88f3a3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 27 Jul 2022 09:56:50 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Mar 2017 11:41:22 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2459543
ETag: "2c436-1586-54a227db65c80"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2897
jake_test: Test_Pass

GET
H/1.1 200
OK swfobject.js Show response
c.123g.us/js2/ 10 KB
10 KB 21ms
20ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/swfobject.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: cafd612ebd6bc497a7a05d3dfef133a0b793f1e04e277b31c424d6d8892a1d48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 10 Aug 2022 23:03:00 GMT
Last-Modified: Wed, 15 Jun 2022 10:42:43 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1202774
ETag: "80494-261f-5e17a2e52eec0"
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9759

GET
H/1.1 200
OK 123g_utils_v1.js Show response
c.123g.us/js2/ 123 KB
30 KB 27ms
26ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/123g_utils_v1.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 8118f9caab521097310cbd5980732e472a431511536759da6a7f475e2f9b1c2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 08 Aug 2022 06:17:14 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Aug 2022 06:15:37 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1435920
ETag: "2c050-1ed63-5e5b4be87d440"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30681
jake_test: Test_Pass

GET
H/1.1 200
OK utilsopt.js Show response
c.123g.us/js2/ 22 KB
22 KB 22ms
22ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/utilsopt.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 0ae485367eb0862700624f4b18563586fe0fd2ecd7abd1efb8a4896ead71fdd3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 13 Aug 2022 06:28:14 GMT
Last-Modified: Wed, 15 Jun 2022 10:42:43 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1003260
ETag: "80468-57b2-5e17a2e52eec0"
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22450
jake_test: Test_Pass

GET
H/1.1 200
OK 123g_cardpage.js Show response
c.123g.us/js2/ 42 KB
42 KB 30ms
24ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/123g_cardpage.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 664837d2bb88ac17d1bc3d9c3e65cb23adf2ba6051d2c48dfe9c3dac555eb66e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 15 Aug 2022 19:31:42 GMT
Last-Modified: Wed, 15 Jun 2022 10:42:43 GMT
Server: Apache/2.2.15 (CentOS)
Age: 783452
ETag: "80464-a777-5e17a2e52eec0"
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42871
jake_test: Test_Pass

GET
H/1.1 200
OK rakpanel.js Show response
c.123g.us/js2/ 3 KB
2 KB 41ms
24ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/rakpanel.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: f48f1b088976f2de3bb46a5c5bc609160ef0a6f919109e08f784596b0a93b7d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sun, 21 Aug 2022 11:43:23 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Aug 2018 13:50:00 GMT
Server: Apache/2.2.15 (CentOS)
Age: 293151
ETag: "2c3eb-d4c-57300e738b200"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1626
jake_test: Test_Pass

GET
H/1.1 200
OK date.js Show response
c.123g.us/js2/calendar/ 3 KB
1 KB 50ms
27ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/calendar/date.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 25a3bd032da353d8b8fc7d6307a434172a21e5cf3d86c859a23d1bd3a2db4693

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 06:26:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Mar 2017 11:41:21 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1089769
ETag: "2c3fe-afa-54a227da71a40"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 974
jake_test: Test_Pass

GET
H/1.1 200
OK jquery.datePicker.js Show response
c.123g.us/js2/calendar/ 15 KB
5 KB 30ms
21ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/calendar/jquery.datePicker.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: b7fa2ddd090d2a9539192c0d37a35999ec91e51d6b212ce5f86c62d525964b01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sun, 14 Aug 2022 17:38:01 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Mar 2017 11:41:21 GMT
Server: Apache/2.2.15 (CentOS)
Age: 876673
ETag: "2c3fd-3d65-54a227da71a40"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4593
jake_test: Test_Pass

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 69ms
12ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

30e6c841d3da47b009a6f175c3d038b5a4de09c52254c3e350f6033592c2bc80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: fwq8+jAQVszp/EvbhKkb/w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: ashz4q5WhmZfmz+Zhyxx/02B4wraI9iSe7lw3Je9GdGwzUH//KFreBQ2urBiPYxFE1se9xwIETO51YWdBBbYUQ==
x-fb-trip-id: 720026100
x-fb-content-md5: 85550d66589e7b9374f2ab01291b43c5
x-frame-options: DENY
date: Wed, 24 Aug 2022 21:09:14 GMT
vary: Accept-Encoding
x-content-cdn-origin-ts: 1661375020119
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "e01c0cf001265c0704f2c47f78feb5fc"
timing-allow-origin: *
expires: Wed, 24 Aug 2022 21:23:40 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 52 KB
21 KB 95ms
28ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d94a090aaa1d4e8ff711a478d0c1bc1a91f0d196503683ead7308f88c048b1e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20360
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
date: Wed, 24 Aug 2022 21:09:14 GMT
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "1eb2ff494a10244b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 21:09:14 GMT

GET
H2 200 pinit.js Show response
assets.pinterest.com/js/ 361 B
431 B 345ms
15ms Script
application/javascript 2a04:4e42:41::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pinterest.com/js/pinit.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:41::84 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: br
x-cdn: fastly
etag: "62d32c28f14783b94192cd8d35bc010d"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=300
content-length: 203
access-control-expose-headers: X-CDN

GET
H/1.1 200
OK jquery.ajax_autocomplete.js Show response
c.123g.us/js2/ 20 KB
7 KB 108ms
18ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/jquery.ajax_autocomplete.js
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 0ce879cfe7244a0a086ea8a95996d7ac5838d30a9b1cd8e85f045f51c41d0df8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 15 Aug 2022 11:26:40 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Sep 2021 12:46:06 GMT
Server: Apache/2.2.15 (CentOS)
Age: 812554
ETag: "2c7db-4ec6-5cbdfd9379f80"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6384
jake_test: Test_Pass

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 165 KB
57 KB 122ms
95ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00167e4286a9c4aee1aa2596925a7655770ab38a3ce62343610f895705c78184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57553
x-xss-protection: 0
server: cafe
etag: 3194819281928348803
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 24 Aug 2022 21:09:14 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
41 KB 57ms
27ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-5085183-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fe945596e10212d0c1b709c293cf76a10727c57fde6a31f3f0e66be1fa4f5634

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41950
x-xss-protection: 0
expires: Wed, 24 Aug 2022 21:09:14 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 211 KB
74 KB 56ms
40ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-47Q5QDHYDP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1d232f039a1f639bd3e6a120c7577292d428d95b950e0cfdfbaa0422334ef4c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75221
x-xss-protection: 0
expires: Wed, 24 Aug 2022 21:09:14 GMT

GET
H/1.1 200
OK styleopt_R1.css
c.123g.us/css/ 81 KB
16 KB 54ms
23ms Stylesheet
text/css 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/css/styleopt_R1.css
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/card_page_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 81113214da7b946424bed9da1f2713c0e7280b577feb58cdc17ff672143aced7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/card_page_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 13 Aug 2022 10:27:13 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 May 2022 05:14:03 GMT
Server: Apache/2.2.15 (CentOS)
Age: 988921
ETag: "2454c-14218-5df6a8f0bdcc0"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16272
jake_test: Test_Pass

GET
H/1.1 200
OK modal_window_R1.css
c.123g.us/css/ 33 KB
33 KB 58ms
21ms Stylesheet
text/css 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/css/modal_window_R1.css
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/card_page_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: c40c9c0117af4abd3ab87c81eb1725c442ec682095d29cc8bc2206e3e5ac1c23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/card_page_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 22 Aug 2022 11:52:41 GMT
Last-Modified: Wed, 15 Jun 2022 10:42:44 GMT
Server: Apache/2.2.15 (CentOS)
Age: 206193
ETag: "805c1-8220-5e17a2e623100"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 33312
jake_test: Test_Pass

GET
H/1.1 200
OK clear.js Show response
s.gk.123greetings.com/2/945541/ 6 KB
3 KB 133ms
30ms Script
text/javascript 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.gk.123greetings.com/2/945541/clear.js?dt=9455411658248091559000&pd=mkt&mo=0&si=main

Requested by

Host: c.123g.us
URL: https://c.123g.us/js2/chk_script.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-240-212-15.eu-west-1.compute.amazonaws.com

Software

Resource Hash

110f1014ca6f6bf90b90246a95e4a0debdf95f5adb09a74dabd3df247d410db4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:13 GMT
Content-Encoding: gzip
Accept-Ch: Viewport-Width, Viewport-Height, Width, DPR, RTT, ECT, Device-Memory, Downlink, Save-Data
Vary: *
Content-Type: text/javascript; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate, no-transform, private, max-age=0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Timing-Allow-Origin: *
Content-Length: 2647
Expires: 0

GET
H/1.1 200
OK 123g_master_bg.png
c.123g.us/images/ 145 B
439 B 50ms
40ms Image
image/png 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/123g_master_bg.png
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/styleopt_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: abfaa28e509b104c2edc0bd048809340d5e006ec872e1966baff8383ff8a0e22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/styleopt_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 06:36:06 GMT
Last-Modified: Wed, 15 Jun 2022 10:44:09 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1175588
ETag: "810fd-91-5e17a33733040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 145
jake_test: Test_Pass

GET
H/1.1 200
OK master_img_menu.png
c.123g.us/images/ 6 KB
6 KB 47ms
35ms Image
image/png 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/master_img_menu.png
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/styleopt_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 12ba93c7b0114439929f7ac0efcdc60e6eee9da57a2fe6ce68bb969f00f4a54e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/styleopt_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Fri, 29 Jul 2022 08:07:15 GMT
Last-Modified: Wed, 15 Jun 2022 10:44:09 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2293319
ETag: "810c2-1861-5e17a33733040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6241
jake_test: Test_Pass

GET
H/1.1 200
OK icon_set_R1.png
c.123g.us/images/ 139 KB
139 KB 71ms
33ms Image
image/png 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/icon_set_R1.png
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/styleopt_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 254d41d323b97e21b036ccf367f7dc18d8ea96daaf756167bac6f0ebbf8fbcd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/styleopt_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Thu, 18 Aug 2022 06:00:25 GMT
Last-Modified: Wed, 15 Jun 2022 10:44:02 GMT
Server: Apache/2.2.15 (CentOS)
Age: 572929
ETag: "8103e-22ca6-5e17a33086080"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 142502
jake_test: Test_Pass

GET
H/1.1 200
OK big_img_sprite.png
c.123g.us/images/ 134 KB
134 KB 25ms
22ms Image
image/png 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/big_img_sprite.png
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/styleopt_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 69303f97bf43e5d9fd7a0c8e6b5f4b49de4466684c7e2b8e2108de98e5c98483

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/styleopt_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 17 Aug 2022 15:32:11 GMT
Last-Modified: Wed, 15 Jun 2022 10:44:02 GMT
Server: Apache/2.2.15 (CentOS)
Age: 625023
ETag: "81054-21653-5e17a33086080"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 136787
jake_test: Test_Pass

GET
H/1.1 200
OK master_icon_set_2.png
c.123g.us/images/ 88 KB
88 KB 48ms
21ms Image
image/png 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/master_icon_set_2.png
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/styleopt_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 89b03d4a2f2ca3d04df1fda63a5247ef31cea689a0ca553e353122ab3d22b646

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/styleopt_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 02 Aug 2022 15:05:20 GMT
Last-Modified: Tue, 15 Feb 2022 08:14:02 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1922634
ETag: "9cb51-15fce-5d80a1da24680"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 90062
jake_test: Test_Pass

GET
H/1.1 200
OK master_icon_set.png
c.123g.us/images/ 93 KB
93 KB 52ms
25ms Image
image/png 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/master_icon_set.png
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/card_page_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 7ae9fa1fbc1caad812a3b620f407059e9f071e29025dc32793f390dcf9fc69b4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/card_page_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 01 Aug 2022 05:43:11 GMT
Last-Modified: Wed, 15 Jun 2022 10:44:02 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2042763
ETag: "81064-17326-5e17a33086080"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 95014
jake_test: Test_Pass

GET
H/1.1 200
OK ajax-loader_sm.gif
c.123g.us/images/ 2 KB
2 KB 95ms
19ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/ajax-loader_sm.gif
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/styleopt_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ed1c2c6b7b77b966dd42dbec5cda78e14595383a75aa465912cbd75c0e2dc569

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/styleopt_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 06 Aug 2022 14:08:38 GMT
Last-Modified: Tue, 07 Mar 2017 11:40:44 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1580436
ETag: "9cf53-739-54a227b728700"
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1849
jake_test: Test_Pass

GET
H/1.1 200
OK 347889_bg.gif
i.123g.us/c/eaug_nationalwaffle_day/bg/ 420 B
776 B 84ms
44ms Image
image/gif 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/bg/347889_bg.gif
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2f296cc0389eb0abafa4eaf9aa9696d7848b3a241fce03bc78982dc0d22243b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 17 Aug 2022 13:57:35 GMT
Last-Modified: Wed, 08 Sep 2021 12:09:25 GMT
Server: Apache/2.2.15 (CentOS)
Age: 630699
ETag: "1a4-5cb7ac0d22740"
Content-Type: image/gif
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 420
jake_test: Test_Pass
Expires: Wed, 17 Aug 2022 17:34:30 GMT

GET
H/1.1 200
OK 123g_master_icon_set_2.png
c.123g.us/images/ 60 KB
61 KB 35ms
22ms Image
image/png 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.123g.us/images/123g_master_icon_set_2.png
Requested by: Host: c.123g.us
URL: https://c.123g.us/css/card_page_R1.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 4330d4072d013510b91ca5648f210b614c2e4e8ecbea94a1f8a8373aa6068532

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.123g.us/css/card_page_R1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Fri, 05 Aug 2022 07:11:11 GMT
Last-Modified: Wed, 15 Jun 2022 10:44:02 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1691883
ETag: "8103f-f1d2-5e17a33086080"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 61906
jake_test: Test_Pass

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 303 KB
86 KB 36ms
14ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=7e35912c8ee15ce1b700994c9c1384df

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

84dc6bf66da590275c5bf7eb6c01f0d85a5265b82c6114c25b9cfea42fa21611

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.123greetings.com/
Origin: https://www.123greetings.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: yYxJqfw/ALbnhRZuVklKkQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 87975
x-fb-rlafr: 0
x-fb-debug: yRi/hvvr1/Ff1jijpVeU73iJ26g6DRXRhiMDD2TcCthNVh0BbLv9+AnRCI6eqaPmvJUXte2t1Yt6ghKhW8nhPw==
x-fb-content-md5: a4f1191d0cd83236288d34929e9aab78
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 24 Aug 2022 21:09:14 GMT
vary: Accept-Encoding
x-content-cdn-origin-ts: 1661369962312
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "654aea1d154cc1f2faaf0e2e5eb937ba"
timing-allow-origin: *
priority: u=3,i
expires: Thu, 24 Aug 2023 19:39:22 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.s6oManI66bc.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9oD5eGLv8eFxYnPS4KbfEER71gIQ/ 146 KB
50 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.s6oManI66bc.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9oD5eGLv8eFxYnPS4KbfEER71gIQ/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a877d18de61f68a6bf3f8240fa730e23e2d80ffbc4b5e1293e5697dc6a585d96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 00:13:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75316
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51176
x-xss-protection: 0
last-modified: Sat, 30 Jul 2022 15:17:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 00:13:58 GMT

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 118ms
31ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?oz_pl=1&dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&_x=1
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/945541/clear.js?dt=9455411658248091559000&pd=mkt&mo=0&si=main
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:13 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK main.js Show response
s.gk.123greetings.com/2/2.66.1/ 161 KB
51 KB 30ms
30ms Script
text/javascript 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.gk.123greetings.com/2/2.66.1/main.js

Requested by

Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/945541/clear.js?dt=9455411658248091559000&pd=mkt&mo=0&si=main

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-240-212-15.eu-west-1.compute.amazonaws.com

Software

Resource Hash

41c7f77cb564e20029d53084a16a3f1ba3da49f2d2c08c610584a5020dc9aaf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 24 Aug 2022 21:09:13 GMT
Content-Encoding: br
Accept-Ch: Viewport-Width, Viewport-Height, Width, DPR, RTT, ECT, Device-Memory, Downlink, Save-Data
Vary: Origin, Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: public, no-transform, immutable, max-age=999999999
Strict-Transport-Security: max-age=31536000; includeSubDomains
Timing-Allow-Origin: *
Content-Length: 51462
Expires: Sat, 02 May 2054 17:27:11 GMT

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 29ms
29ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?oz_pl=1&dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&_x=1
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/945541/clear.js?dt=9455411658248091559000&pd=mkt&mo=0&si=main
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:13 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 109ms
72ms Fetch
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=6268317308&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&sdk=joey&wants_cookie_data=true

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=7e35912c8ee15ce1b700994c9c1384df

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: b9OJymMXyyW0hjchHepSPt3yI4OSWmUpTmGAXt58FjxWZ5tcs/p1Pjkj8FwNzueD/kuP/6gec9d8yeLmwPGoSw==
fb-s: unknown
date: Wed, 24 Aug 2022 21:09:14 GMT
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.123greetings.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK request.js Show response
trkn.us/info/ 2 KB
1 KB 415ms
101ms Script
application/javascript 54.243.255.136
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trkn.us/info/request.js?sid=1efbd474-f6d6-4c7a-ab0e-0a28232c817d&ord=6054198110.337199

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.243.255.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-243-255-136.compute-1.amazonaws.com

Software

Apache /

Resource Hash

b93dce41ccddbfaaaf2dc9127d9b64c442edc15200ce6b46e08c45d94e3ade2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:14 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 732
Expires: Sun, 01 Jan 2014 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208170101/ 341 KB
120 KB 93ms
74ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208170101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8275302107693664&plah=www.123greetings.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa9c76ffeb56e65f15e8b9f9e450234fad7c4b5abb33dc212a3d620d0f08d47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122736
x-xss-protection: 0
server: cafe
etag: 3591138630523457297
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 24 Aug 2022 21:09:14 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220822/r20190131/ Frame AD4C 10 KB
5 KB 45ms
16ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220822/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 9950
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 18:23:24 GMT
etag: 8616628553774171045
expires: Wed, 07 Sep 2022 18:23:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK addressbook.js Show response
c.123g.us/js2/ 401 KB
76 KB 27ms
27ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/addressbook.js
Requested by: Host: c.123g.us
URL: https://c.123g.us/js2/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: d37a1d0a9caf1a7ab47cf71e03cb92dbce54797914e91c6ad6bf88dabd0814ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Mon, 08 Aug 2022 06:17:04 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Aug 2022 06:15:37 GMT
Server: Apache/2.2.15 (CentOS)
Age: 1435930
ETag: "2c023-64550-5e5b4be87d440"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 77410
jake_test: Test_Pass

GET
H/1.1 200
OK 347889_details.js Show response
x.123g.us/json/ 1 KB
991 B 127ms
61ms Script
text/javascript 8.241.45.124
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://x.123g.us/json/347889_details.js
Requested by: Host: c.123g.us
URL: https://c.123g.us/js2/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.241.45.124 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: db35772a9d9328cabf6f36476859ec322b7c9701bc82d5c8e2754280cc916143

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 24 Aug 2022 20:52:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 Aug 2022 20:21:58 GMT
Server: Apache/2.2.15 (CentOS)
Age: 989
ETag: "500-5e7026ec66580"
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 553
jake_test: Test_Pass
Expires: Wed, 24 Aug 2022 21:07:46 GMT

GET
H/1.1 200
OK silence.mp3
c.123g.us/js2/ Frame 7998 0
0 41ms
41ms Document
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/silence.mp3
Requested by: Host: c.123g.us
URL: https://c.123g.us/js2/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 2071219
Connection: keep-alive
Content-Length: 36494
Content-Type: audio/mpeg
Date: Sun, 31 Jul 2022 21:48:55 GMT
ETag: "2c364-8e8e-58835385fcd00"
Last-Modified: Mon, 06 May 2019 10:04:04 GMT
Server: Apache/2.2.15 (CentOS)
jake_test: Test_Pass

GET
H2 200 like.php Show response
www.facebook.com/v5.0/plugins/ Frame C4A3 0
2 KB 50ms
50ms Document
text/html 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v5.0/plugins/like.php?action=like&app_id=6268317308&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1e5b3f42a869b4%26domain%3Dwww.123greetings.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.123greetings.com%252Ff1f8f8c0d71a684%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html&layout=button_count&locale=en_US&ref=fb_lk_cd_1&sdk=joey&share=true&show_faces=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=7e35912c8ee15ce1b700994c9c1384df

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Aug 2022 21:09:14 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: mc9dFh8U7fzILZkhTBaI8cM0vB8sevuPGT4awa9kwm6BNk1tNRrHhUoQ7ekbbm0+IUdALuBMk1rJiau+WL8dwA==
x-xss-protection: 0

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 269ms
268ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375354372&oz_l=267&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:13 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 pinit_main.js Show response
assets.pinterest.com/js/ 66 KB
18 KB 32ms
31ms Script
application/javascript 2a04:4e42:41::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pinterest.com/js/pinit_main.js?0.048233168724329145
Requested by: Host: assets.pinterest.com
URL: https://assets.pinterest.com/js/pinit.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:41::84 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 20f0315c97ff7007f2e7a94d659e094a7efc01b8306da53987538c1101489e0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: br
x-cdn: fastly
etag: "3725764cf05d1a0938de73d398772331"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=300
content-length: 18679
access-control-expose-headers: X-CDN

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 47ms
8ms Script
text/javascript 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-5085183-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 197
date: Wed, 24 Aug 2022 21:05:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 24 Aug 2022 23:05:57 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
350 B 41ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-47Q5QDHYDP&gtm=2oe8m0&_p=503475776&cid=943555116.1661375355&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1661375354&sct=1&seg=0&dl=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&dt=Being%20With%20You%20Makes%20Me%20Waffley%20Happy.%20Free%20Waffle%20Day%20eCards%20%7C%20123%20Greetings&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-47Q5QDHYDP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 48 KB
48 KB 63ms
63ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478441
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 48 KB
48 KB 63ms
63ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478441
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H/1.1 206
Partial Content silence.mp3
c.123g.us/js2/ Frame 7998 36 KB
36 KB 20ms
20ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/silence.mp3
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 313051fadb0a877488f704ab08601d3d46207b0818e62d5128494ea36463add5

Request headers

Referer: https://c.123g.us/js2/silence.mp3
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Sun, 31 Jul 2022 21:48:55 GMT
Last-Modified: Mon, 06 May 2019 10:04:04 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2071219
ETag: "2c364-8e8e-58835385fcd00"
Content-Type: audio/mpeg
Content-Range: bytes 0-36493/36494
Connection: keep-alive
Content-Length: 36494
jake_test: Test_Pass

GET
H/1.1 200
OK connect_config.js Show response
c.123g.us/js2/ 203 B
503 B 30ms
28ms Script
text/javascript 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://c.123g.us/js2/connect_config.js
Requested by: Host: c.123g.us
URL: https://c.123g.us/js2/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 0ae74371a872da00743b4c907dc6b5ea22377f13ede1ac75055a55f50676dba8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Thu, 28 Jul 2022 05:07:40 GMT
Last-Modified: Wed, 15 Jun 2022 10:42:43 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2390494
ETag: "80457-cb-5e17a2e52eec0"
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 203
jake_test: Test_Pass

GET
BLOB 200
OK b59f571f-0c6c-4793-ad60-7ac426ead975
https://www.123greetings.com/ Frame 23AC 185 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.123greetings.com/b59f571f-0c6c-4793-ad60-7ac426ead975
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 848fe19ed492948709b881f504ce2eb6274baa694606ca88eb9b2990a2460caf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Length: 185
Content-Type: application/javascript

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 220 B
649 B 39ms
15ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.123greetings.com&callback=_gfp_s_&client=ca-pub-8275302107693664

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208170101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8275302107693664&plah=www.123greetings.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

86c8cd9f4420596a39db2861c16e8431bd515f695010ffe3ee388e7ae8fdc915

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 40ms
16ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.123greetings.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 41ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.123greetings.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&tn=DIV&id=cookie_bar&cls=cookie_bar&ign=false&pw=1600&ph=1200&x=1575&y=1175

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0FD2 143 KB
34 KB 522ms
503ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8275302107693664&output=html&adk=1812271804&adf=3025194257&lmt=1661375354&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1661375354402&bpp=2&bdt=506&idt=198&shv=r20220822&mjsv=m202208170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=900641229910&frm=20&pv=2&ga_vid=943555116.1661375355&ga_sid=1661375355&ga_hid=503475776&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44769306%2C31068738%2C31060566%2C31068920&oid=2&pvsid=2522243484088040&tmod=399966414&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=213

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cec06082fc8040f97866722fa0665dcc2eb8b0703712a36411f0840d37b7bdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 34665
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:15 GMT
expires: Wed, 24 Aug 2022 21:09:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 33ms
16ms XHR
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=503475776&t=pageview&_s=1&dl=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&ul=en-us&de=UTF-8&dt=Being%20With%20You%20Makes%20Me%20Waffley%20Happy.%20Free%20Waffle%20Day%20eCards%20%7C%20123%20Greetings&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAAC~&jid=1481838168&gjid=1510405085&cid=943555116.1661375355&tid=UA-5085183-1&_gid=1752293059.1661375355&_r=1&gtm=2ou8m0&z=715500663

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
442 B 68ms
19ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-5085183-1&cid=943555116.1661375355&jid=1481838168&gjid=1510405085&_gid=1752293059.1661375355&_u=YADAAUAAAAAAAC~&z=1438940846

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 24 Aug 2022 21:09:14 GMT
content-type: text/plain
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 58ms
58ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375354743&oz_l=4841&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:13 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1

200
OK

/
trkn.us/info/
Redirect Chain

https://trkn.us/info/?sid=1efbd474-f6d6-4c7a-ab0e-0a28232c817d&ord=6054198110.337199&ref=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.ht...
https://trkn.us/info/?sid=1efbd474-f6d6-4c7a-ab0e-0a28232c817d&ord=6054198110.337199&ref=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.ht...

42 B
780 B

113ms
113ms

Image
image/gif

54.243.255.136
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trkn.us/info/?sid=1efbd474-f6d6-4c7a-ab0e-0a28232c817d&ord=6054198110.337199&ref=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&dvis=visible&ip=80.255.10.202&cuidchk=1

Requested by

Protocol

HTTP/1.1

Server

54.243.255.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-243-255-136.compute-1.amazonaws.com

Software

Apache /

Resource Hash

b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:14 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 9 Nov 1980 12:59:00 GMT
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Date: Wed, 24 Aug 2022 21:09:14 GMT
X-Content-Type-Options: nosniff
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: /info/?sid=1efbd474-f6d6-4c7a-ab0e-0a28232c817d&ord=6054198110.337199&ref=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&dvis=visible&ip=80.255.10.202&cuidchk=1
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 0

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 34ms
33ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375354895&oz_l=5631&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:14 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 29ms
28ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375355056&oz_l=149&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:14 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK 347889.js Show response
s3.amazonaws.com/123g_fb_comments/ 27 B
413 B 414ms
112ms Script
text/javascript 54.231.224.232
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/123g_fb_comments/347889.js
Requested by: Host: c.123g.us
URL: https://c.123g.us/js2/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.231.224.232 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5fad4e36641f765661b0ed167547736ef4684f7a6995e515848a25aea36974d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Wed, 24 Aug 2022 21:09:16 GMT
Last-Modified: Wed, 24 Aug 2022 17:52:15 GMT
Server: AmazonS3
x-amz-request-id: 98R366BER3BGNQ2H
ETag: "9fa08eeb78d38ed337bdba5563af7a80"
x-amz-meta-colour: pink
Content-Type: text/javascript
Accept-Ranges: bytes
Content-Length: 27
x-amz-id-2: EUSNyuBfoAXVeHMlUkDReAJliUxiRoErIzRqT/hHxxLd5CT52CCWHZMA1o48kF1cRN2q53BPszE=

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208170101/ 150 KB
53 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208170101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

364ca1274b834154b9e92f69807a6a4652f63698fcb76548d7d4b6bdfe6b3743

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54625
x-xss-protection: 0
server: cafe
etag: 17897687785675459235
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Aug 2022 21:09:15 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pm&rt=8&c=ca-pub-8275302107693664&eid=44759876%2C44759927%2C44759842%2C44769306%2C31068738%2C31060566%2C31068920

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pr&rt=8&c=ca-pub-8275302107693664&eid=44759876%2C44759927%2C44759842%2C44769306%2C31068738%2C31060566%2C31068920

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 39ms
15ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.123greetings.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 32ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.123greetings.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/ Frame AB49 10 KB
4 KB 8ms
8ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 86371
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 23 Aug 2022 21:09:44 GMT
etag: 8616628553774171045
expires: Tue, 06 Sep 2022 21:09:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 29ms
28ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375355223&oz_l=841&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:14 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 css2
fonts.googleapis.com/ Frame AB49 4 KB
1 KB 48ms
16ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Aug 2022 20:10:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Aug 2022 21:09:15 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Aug 2022 21:09:15 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame AB49 205 B
742 B 36ms
7ms Image
image/png 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:40:07 GMT
x-content-type-options: nosniff
age: 1748
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 24 Aug 2023 20:40:07 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame AB49 604 B
695 B 37ms
9ms Image
image/png 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:49:48 GMT
x-content-type-options: nosniff
age: 4767
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 24 Aug 2023 19:49:48 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/ Frame AB49 19 KB
9 KB 38ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f964612ea368ffe1d612a004f0a0e05453155fa7cb27dff624e5ada25c6847fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:04:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8368
x-xss-protection: 0
server: cafe
etag: 5162546928090487746
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:04:24 GMT

GET
BLOB 200
OK 57aad25a-ee22-49c2-a361-2bef1a4f2b82
https://www.123greetings.com/ 787 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.123greetings.com/57aad25a-ee22-49c2-a361-2bef1a4f2b82
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 186456f68e798b6aeb8c250949d5568673a796257bfbb9ca6744c2c00d78c324

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Length: 787

GET
H3 200 css
fonts.googleapis.com/ Frame A7FF 3 KB
601 B 34ms
17ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fb7989597f1a10a56bd83de6a26eefec44a0c704979fb5e06f02195bc9cebfce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Aug 2022 20:15:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Aug 2022 21:09:15 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Aug 2022 21:09:15 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame A7FF 2 KB
902 B 25ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:46:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 20:46:33 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame A7FF 23 KB
9 KB 26ms
11ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9668
x-xss-protection: 0
server: cafe
etag: 3250940068065303693
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:56 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame A7FF 3 KB
1 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A7FF 140 KB
44 KB 49ms
21ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:15 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame A7FF 17 KB
7 KB 25ms
10ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3 200 e3ca5db921b3b46420ba257a4c2f6b26.js Show response
www.gstatic.com/mysidia/ Frame A7FF 33 KB
13 KB 26ms
9ms Script
text/javascript 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e3ca5db921b3b46420ba257a4c2f6b26.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220822/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24302eeb5b736bcc9f610299a37ac5dcf7e5b4c11591489fe9ad89f1533bd09b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 17 Aug 2022 22:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 599347
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13683
x-xss-protection: 0
last-modified: Wed, 17 Aug 2022 22:27:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 15 Nov 2022 22:40:08 GMT

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 30ms
29ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375355400&oz_l=636&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:14 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 48 KB
48 KB 66ms
66ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478442
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H3 200 comments.php
www.facebook.com/v5.0/plugins/ Frame 5833 0
0 67ms
49ms Document
text/html 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v5.0/plugins/comments.php?app_id=6268317308&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df33006eb3961258%26domain%3Dwww.123greetings.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.123greetings.com%252Ff1f8f8c0d71a684%26relation%3Dparent.parent&container_width=0&height=100&href=http%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html&locale=en_US&order_by=reverse_time&sdk=joey&version=v5.0&width=600

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=7e35912c8ee15ce1b700994c9c1384df

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Aug 2022 21:09:15 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=0
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: xGRF4FLO302Lmy+LYSPhzIwVQDYx0DcAFuNF0jJVfnMagE1JrNV8JWgwGD0f31bzZZ971PQXrpemNotyT+ZV4A==
x-frame-options: DENY
x-xss-protection: 0

GET
H3 200 gpt.js Show response
www.googletagservices.com/tag/js/ 83 KB
28 KB 41ms
19ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: c.123g.us
URL: https://c.123g.us/js2/123g_utils_v1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f121e168a9baaeab6c2607a5c7ea788955724717d26ae30b6e40c503c5981b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28541
x-xss-protection: 0
server: sffe
etag: "1313 / 721 of 1000 / last-modified: 1661339366"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 24 Aug 2022 21:09:15 GMT

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 32ms
32ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375355567&oz_l=6762&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:14 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 pubads_impl_2022081701.js Show response
securepubads.g.doubleclick.net/gpt/ 384 KB
131 KB 38ms
7ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

83147c4cf00c61d77d068152fdb541e2ca7761e0990682db23e77fb7affdceb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 13:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27376
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133512
x-xss-protection: 0
last-modified: Wed, 17 Aug 2022 08:37:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 24 Aug 2023 13:32:59 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 655 B
885 B 59ms
30ms XHR
application/json 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.123greetings.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

d296131da814e68033b8f973cd34aeaf058191c99e1a265b5569d6f7d0074aad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Wed, 24 Aug 2022 21:09:15 GMT

GET
H2 200 /
log.pinterest.com/ 0
333 B 135ms
97ms Image
text/plain 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://log.pinterest.com/?type=pidget&guid=fhwAzAZTKi0B&tv=2021110201&event=init&sub=www&button_count=0&follow_count=0&pin_count=0&profile_count=0&board_count=0&section_count=0&lang=en&nvl=en-US&via=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html&viaSrc=canonical
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.128.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:15 GMT
via: 1.1 varnish
x-cache: MISS
x-envoy-upstream-service-time: 1
x-cache-hits: 0
content-length: 0
x-served-by: cache-hhn4038-HHN
pragma: no-cache
server: envoy
x-timer: S1661375356.661347,VS0,VE90
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-pinterest-rid: 1299904133324163
accept-ranges: bytes
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.123greetings.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 17ms
17ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.123greetings.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 872 KB
181 KB 971ms
954ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2522243484088040&correlator=2170552324036690&eid=31068498%2C44768682%2C31061167%2C31068920&output=ldjh&gdfp_req=1&vrg=2022081701&ptt=17&impl=fifs&iu_parts=46400095%2CDesktopWeb_Showcard_LB%2CDesktopWeb_Showcard_EcardStrip%2CDesktopWeb_Showcard_Mrec%2CDesktopWeb_Showcard_LowerMrec%2CDesktopWeb_Showcard_BottomLrec%2CDesktopWeb_Showcard_EcardStrip2%2CDesktopWeb_Showcard_LMrec1%2CDesktopWeb_Showcard_LMrec2%2CDesktopWeb_Showcard_LMrec3%2CDesktopWeb_Showcard_Video%2CDesktopWeb_Showcard_VideoInContent&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9%2C%2F0%2F10%2C%2F0%2F11&prev_iu_szs=728x90%2C468x60%2C300x250%2C300x250%2C300x250%2C468x60%2C300x250%2C300x250%2C300x250%2C1x1%2C1x1&ifi=3&adks=2931586391%2C97135718%2C2334180326%2C912788858%2C619234847%2C3674860380%2C36811275%2C2261275357%2C4099441217%2C1380049161%2C265943010&sfv=1-0-38&fsapi=false&cust_params=site%3D123greetings.com%26section%3Deaug_nationalwaffle_day%26page%3Dshowcard&sc=1&cookie=ID%3D327c1cddf6b829da-223dfd4e00ce001d%3AT%3D1661375354%3ART%3D1661375354%3AS%3DALNI_MY0-UhyiFaErlTddvmeFbSZEUwnZQ&abxe=1&dt=1661375355728&lmt=1661375355&dlt=1661375353896&idt=1795&adxs=560%2C401%2C970%2C970%2C970%2C402%2C332%2C650%2C968%2C310%2C321&adys=47%2C239%2C236%2C993%2C2044%2C995%2C2339%2C2339%2C2339%2C2794%2C1087&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C1%7C0%7C2%7C3%7C4%7C5%7C0&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&frm=20&vis=1&psz=980x90%7C612x60%7C320x262%7C320x262%7C320x262%7C591x60%7C980x301%7C980x301%7C980x301%7C983x2785%7C628x0&msz=728x90%7C468x-1%7C300x250%7C300x250%7C300x250%7C468x-1%7C314x264%7C314x264%7C314x264%7C980x0%7C628x0&fws=4%2C0%2C4%2C4%2C4%2C0%2C0%2C0%2C0%2C0%2C0&ohw=728%2C0%2C300%2C300%2C300%2C0%2C0%2C0%2C0%2C0%2C0&ga_vid=943555116.1661375355&ga_sid=1661375355&ga_hid=503475776&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

24dad537459cfd0087916c12cf4ad6c26e87dca870e76646d9d3fe753ae60d38

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN60sL-x4PkCFZuS_QcdsgQMYw&gqi=&layout=/sadbundle/%24csp%253Der3%24/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLW3sL-x4PkCFZuS_QcdsgQMYw&gqi=&layout=/sadbundle/%24csp%253Der3%24/15554702494583891371/300x250_EN/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLG2sL-x4PkCFZuS_QcdsgQMYw&gqi=&layout=/sadbundle/%24csp%253Der3%24/10489799405306279296/Eleq_300x250.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN60sL-x4PkCFZuS_QcdsgQMYw&gqi=&layout=/sadbundle/%24csp%253Der3%24/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLW3sL-x4PkCFZuS_QcdsgQMYw&gqi=&layout=/sadbundle/%24csp%253Der3%24/15554702494583891371/300x250_EN/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLG2sL-x4PkCFZuS_QcdsgQMYw&gqi=&layout=/sadbundle/%24csp%253Der3%24/10489799405306279296/Eleq_300x250.html
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
google-creative-id: -1,-1,-1,-1,-1,-1,-1,-1,-1,138326033967,138321279906
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 184924
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-1,-1,-1,5501288042,5461263814
pragma: no-cache
server: cafe
google-mediationtag-id: -2
date: Wed, 24 Aug 2022 21:09:16 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.123greetings.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6CB6 6 KB
4 KB 103ms
15ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:15 GMT
expires: Thu, 24 Aug 2023 21:09:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 29ms
28ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375355764&oz_l=101&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:14 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 56ms
38ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220822&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6fe34c9211ca6293192fd2cc5a21a10b61a20354720231788fa2eacccc1a9b47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10960
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 89ms
89ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:15 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4962 13 KB
5 KB 9ms
8ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 869
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 20:54:47 GMT
expires: Thu, 24 Aug 2023 20:54:47 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame FF99 783 B
1 KB 41ms
17ms Document
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

945a33503b53b703efe23a85d5c3d51e7005d80b72da282674e1c1c381ef74e5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rHRKUZiPi0GelvSQYarBfA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-rHRKUZiPi0GelvSQYarBfA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Wed, 24 Aug 2022 21:09:16 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame 4962 36 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5492
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame FF99 0
0 41ms
40ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220822&jk=2522243484088040&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 4962 0
10 B 7ms
7ms Image
text/plain 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?wTxBEQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:16 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 32 KB
0 58ms
57ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478443
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 45ms
44ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220822&jk=2522243484088040&bg=!TE-lTwvNAAYUOm8VNDo7ACkAdvg8Wo_VtIwhI5Z62zUp8j0p52j9ktIuZMX8t4cZsMZWGAW7ErdPWgIAAABzUgAAAAJoAQcKADH4MWYpL0Rkg4EA1tM6IGaX3osjz4L2dOzjNms91ftoRbECqFcfrh17e5pVRAmOSee0mQLWHCsFBwhPUXadvrqhMdM1z7M6Ywiod_5GSWdy6DmDYJNxcWx75-y-5xzdhOu4QJkzDMwMpawXBHd18Lptdz_CZCFikb1lSNanFkrx9ECX-fqmMvyeGhl7PhFg-wDZ9nDJXrxn6fLGHIt2wQo854-DqE6jlnboKfa8BZ5z87hpbNEkqWJE4OXHG4IYPE6UhHPVs2XULGvgeZ2XbvYNO_oi4AC9si4gbkuS8t2E1VPETqAoepiQeTgfS9i1ks5JCFPaGbh0rJpENkMSkdeKYdKWUuL5vk2RiIUmSdvLoubh0yQxh_qrV8C2KqxIPFJSzCA1YisWE3D-ir6QmaM6B2AfQOmiG3XQx0J6cY10FgTD8a1lJWDfhZdAGK2CsdK023UzgCj51ee_odTjxO1rcm1TGhpkbS1M-ORBZzijDQB5eLxLSsCW9Q7DYdFV0Us0YMOtrGf6oD4p8wuK8d7PzS7JkdHH2zUdXFLiaUV2YdUkVPwcSCy0jcrxEeqXv6P7_BLJkOt6Q5NbzAvaSAfdGz839yYkRMBd3E4TcLE2BhntPewBh6a7XCZ-eSpSAdK4WPZgw7KcCc_ih2oeIgC28bYvoUJ6XtRrLgnNLhp_0z-UzWslIChir_WCc5WNsohlTBRDuYMZNhJRSOC6TNPmavjfusvJOmzBY7Wk5xoPQModpY-4_ipVInEm5m6-0xAiOjEGudLrUG7LYsl1wa2Pz5dkjpYARxF720LLBAuikwnJABz-IZglPg97mxsUEBnSi9vyUp3hGSr678VPpvrAN6ERWGwYGRVCMX3RihlAwIlJHYR1F_jyse5ObZHrCqU-rM0hZv53XQ8uMzci5Gn-vX6K6l_GMb1gWx499vBmen3HNnA3UETqsRi3sJJmlkCYA8ru9_xTABZ_Q1i9u1fMHni4wX2Tmd8p18DqsTm362cuVpqnBFFUZDse0FNE27UGJYS-fZFF1D0M
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2315 6 KB
3 KB 35ms
16ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4293 6 KB
3 KB 9ms
8ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A867 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7226 6 KB
3 KB 9ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 79E8 6 KB
3 KB 9ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 511C 6 KB
3 KB 9ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012208081650000/ Frame D73F 220 KB
61 KB 112ms
9ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2e5722cf0b8d8df31200550801d755733c56d9ca2758b7041fbed009e0c9d08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 187299
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61502
x-xss-protection: 0
server: sffe
date: Mon, 22 Aug 2022 17:07:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "df13b0b17adb5918"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Aug 2023 17:07:37 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame D73F 14 KB
5 KB 124ms
22ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e14ddde632bad66a3f79d6dc2c6a212d3b1b5cd8100cb6b73984b8797c5ed86

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 187299
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5197
x-xss-protection: 0
server: sffe
date: Mon, 22 Aug 2022 17:07:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "aca8368210f82021"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Aug 2023 17:07:37 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame D73F 94 KB
28 KB 127ms
24ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70fa25d0cd4744b6b91054ad55e3e931dad31cc85915b13e33e4e674426c7cc1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 187299
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28794
x-xss-protection: 0
server: sffe
date: Mon, 22 Aug 2022 17:07:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "cc093c4134ec5f1e"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Aug 2023 17:07:37 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame D73F 72 KB
16 KB 130ms
27ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

902565ce7f27f6e504ee3790458fa3e9137a1c2b3d63d58ce6cd2fbcbf9db7ca

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 187295
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16649
x-xss-protection: 0
server: sffe
date: Mon, 22 Aug 2022 17:07:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0cc7ecc69c61be2b"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Aug 2023 17:07:41 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame D73F 5 KB
2 KB 131ms
28ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec61d9fd1b3609a3a53f377ed07059c3dc7d2cb1502022e0623b4ebc1ea0f35e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 187299
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
date: Mon, 22 Aug 2022 17:07:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ef17e6cba96d5668"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Aug 2023 17:07:37 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame D73F 40 KB
13 KB 126ms
23ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d200dc372fb333c0ca488fba2a569a686cbf5f1ba0cc0544a4a8c96a4f91de3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 187299
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12948
x-xss-protection: 0
server: sffe
date: Mon, 22 Aug 2022 17:07:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "08e07a681963ea9f"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Aug 2023 17:07:37 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame D73F 24 KB
1 KB 19ms
18ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100italic,300,300italic,italic,500,500italic,700,700italic,900,900italic,400

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3ce91e27c75f26017876adeda75acc652f5d48f9875d6db451b2ab3547c3ba64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Aug 2022 21:09:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Aug 2022 21:09:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Aug 2022 21:09:16 GMT

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CA97 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9698 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Thu, 24 Aug 2023 21:09:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5724 0
0 46ms
45ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssB3QufT_0hSAVjLUWQbvucD4hLqdABGoGvGfou9b7sJPAY-qJN6SwEuIcALegTP_3qhSfQUn3GF_8G0Kjp_kXfjoSiP0jWc7DYHvdGKpXmttwmTO0v2PgjQzWWbok3z5XBoijEBt-S_OMJGjXTl_XM69qW5OL4BbOwamkAa8rtliGbCcdg1uCuxd_cwK5xb-8y1R5MdHTx9mJgQQl8sRojOlNjkZzL5NIz990TQ3A6uaefqpwng7rtjWmUsBITf--zTbRsKFn3_x99NWjW5U2R0cOVo5SRRPDTr38oBcEuFhmeEGzF-f99D2inyAke5o10xFocf7cd66WDA0De2QdzbGExHBY&sai=AMfl-YQF2wvnInGRF3Y8xN4iiWy_Qv5-MK9P3nsrM0T5veUvPq7c2KUUAoDxLQmV1ZFLYMLWPE9xWqTzDapE54mi7Uo0zCRLfKIbXGAyjh42NHKD3MQalDNMR-LSRKWpMg&sig=Cg0ArKJSzHj8IripgL6vEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 video-loader.js Show response
cdn.avantisvideo.com/avm/js/ Frame 5724 32 KB
11 KB 34ms
8ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2e4386cf56ad2612f0ad0526372b3d1cd96d6ecb3f32836f141aa28207b3907e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: o3_UP5DBpj34HIRp37PMEele1xlw3U13
content-encoding: gzip
last-modified: Sun, 29 May 2022 06:35:41 GMT
server: AmazonS3
age: 72052
etag: W/"d29171b34ea93548beb17fd35f5b439b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 01:08:27 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Dgh25g-kgI0vXbqWGzYY1hP4pzPwh-Z9fZHQfEMUrPlUVu0g5RLVCA==

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5724 140 KB
43 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:16 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 008C 0
0 46ms
46ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvsRyhyyjmESF5JpzhDA7DTZV3bOGi2eXwbpcDVTGIqMgYEjy_GXvR1mwPimy9PBy0C39eyXvHzYau6gukyu0nlO_D3upyesvj1-s0hXrzFDiXE24FY5SerF1R25HhB2vwMggqiNRYi2MW540SRg_pRhdzhU_nI_1cX0S_abIuvSLwGtjtDa7izlfSfFCagnm2W4wdWXf3NvfkdSSNtkE0Z5BW_KPoE_r3W5wpukULUqOrizf33PiregtEv_PM4H1ulKYW5a2MSTS9Mi3jkSXDBKr0OJNrH6udr-d9tivMKzDhjuwd4SZD6MK1N04B71sbkEVoIoBCtoP1stnTIx8ZeR542FRgGekSLvfgGtnk&sai=AMfl-YR3mn2IXliwpqwIbnQuB41bgQ-N4B02Qx9olXjTaFCqbJoaDoXeUiExnIyWJntcZv-4HSd9YJsqMSPPY_RLDO1WIdDeAnyRQM3UCxMv5bZ7tAidvpu9Z1fZVq6HhQ&sig=Cg0ArKJSzMHq1cppFTpLEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 video-loader.js Show response
cdn.avantisvideo.com/avm/js/ Frame 008C 32 KB
11 KB 26ms
10ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2e4386cf56ad2612f0ad0526372b3d1cd96d6ecb3f32836f141aa28207b3907e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: o3_UP5DBpj34HIRp37PMEele1xlw3U13
content-encoding: gzip
last-modified: Sun, 29 May 2022 06:35:41 GMT
server: AmazonS3
age: 72052
etag: W/"d29171b34ea93548beb17fd35f5b439b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 01:08:27 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Yz94TlqFc0-19-s2Aie37BZ8FmL8BHrrhniGhIjFUFl6B6WgxmJrww==

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 008C 140 KB
43 KB 34ms
31ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:16 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D73F 2 KB
2 KB 10ms
8ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:03:14 GMT
x-content-type-options: nosniff
server: cafe
age: 7562
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 25 Aug 2022 19:03:14 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D73F 295 B
319 B 11ms
10ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 05:50:56 GMT
x-content-type-options: nosniff
server: cafe
age: 55100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Thu, 25 Aug 2022 05:50:56 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D73F 0
0 42ms
15ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQDvjlsSvGCFma7YE5i3uyXK4y10xUdopQ9U9FDMT5WHqJN9g0dFq6p9xYMGWlwK4hsKAQu1Wgj3v9iYYCPu3WzG4IfTg
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D73F 0
0 55ms
54ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CXa2Pe5MGY4qMMpul9u8PsomwmAaD6OK3Y4Dcn_fpDt3ZHhABIO_2kCFgleKQgqAHoAG-49DJA8gBCakC76qSOpvEsD7gAgCoAwHIAwiqBMoCT9A9MA4C86GIEyH1fC-OENiYa-VvqxhxZ2m7sViMoueFCQm3gmJ4h_dPslXdxOL7HyDsZ93ICNjFRkd-v6F-HMgc-Z-DHaVXscJY4wbW8pr_djsgQbeK47nZ8DZAPnaOQMa6IEueL1PSOBPbJw0TVLpaQiRIuQqaMOZfQhHkdPRB3qJvsSWxdvYqSy_rkKFDAd6Ni5ZM5wtP6INUJx-kkkOVHjKPOP9rOU2HKI4IxTxLLXcQHhR1EqFc-ZrGdOUmTeO6weMZZEN6ih-A_0yEWXU4KEt7bC6WchZk4sfaCFzSX00MIxlV3z5n26lah6QjCpAZJhSqnqVHGjA0rDAZFGkmi4Iftb7bneUbocbl-96_xbp804igHsgd9glY433cuOXmdJDQ-oR5Qi1RVf66VH15ZkPHYnM0L0GqFQ9BxLg-JlqCr0iy7kUOwATHzfzY9wHgBAGSBQQIBBgBkgUECAUYBKAGLoAHqpyvNqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEK3OCtIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsB2BMK0BUBmBYBgBcBshceChwIABIUcHViLTQ2Mjc1MTc2ODAyNDk2NzAY_9cX&sigh=TzU3ID_d-TQ&uach_m=[UACH]&template_id=419
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 Background_GoogleAd.jpg
tpc.googlesyndication.com/sadbundle/4423286735091748582/ Frame D73F 24 KB
24 KB 13ms
12ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/4423286735091748582/Background_GoogleAd.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13486bde37037de547c6d03d4cd9d8d35a911b25f1dc83341245b3bf12997b8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 22 Aug 2022 18:39:37 GMT
x-content-type-options: nosniff
age: 181779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24663
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 11:07:04 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 22 Aug 2023 18:39:37 GMT

GET
H3 200 Logo-Wirtschaftsallianz.png
tpc.googlesyndication.com/sadbundle/4423286735091748582/ Frame D73F 2 KB
3 KB 12ms
11ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/4423286735091748582/Logo-Wirtschaftsallianz.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e40f0f6c712e1fee5160f07dd299f0e3597d477098ac926702d43553c8c64b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 22:02:30 GMT
x-content-type-options: nosniff
age: 428806
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2546
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 11:07:04 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 19 Aug 2023 22:02:30 GMT

GET
DATA 200
OK truncated
/ Frame D73F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0436ee4374f7ac4600ae1cfe8f988c6337667986ad567d95ea05bb45ddf52848

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame D73F 15 KB
16 KB 48ms
14ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100italic,300,300italic,italic,500,500italic,700,700italic,900,900italic,400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.123greetings.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 22 Aug 2022 16:44:52 GMT
x-content-type-options: nosniff
age: 188664
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 22 Aug 2023 16:44:52 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame D73F 15 KB
15 KB 44ms
15ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100italic,300,300italic,italic,500,500italic,700,700italic,900,900italic,400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.123greetings.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 22 Aug 2022 19:07:55 GMT
x-content-type-options: nosniff
age: 180081
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 22 Aug 2023 19:07:55 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D4ED 624 B
297 B 38ms
34ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGLz8tdEBMAE&v=APEucNVSzuHcI2x6JCIkJgwC3s__RU9NmOcpO961F3LsQanFplKJxWTaEParp_bVJfej0dS9q-ufAsS2egJc00609tbi5e-6cJqP5zdy_pNBnIcBAgyTzGl0BJRivqg-1xOOl2fYRNEdFML0Q4jYxgL983LouYDkqWcl-dzQUHdNWP1ToH7EBrc

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2315 95 KB
36 KB 75ms
71ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AIicjkSHN5uJXHv7gjyTrAFL9Tvqc1G6qxIOxfMkrvtR5Q1_tQVXIkYjHWf_DpWt1AIKYpK7avihqEUDMi1o4LKwCyR0RxRcLgG4pVEftgeTKzXoUz7nLjygCaApht3xwAZa0nYztsRusLSnjisJZ5YUOAKw&dbm_d=AKAmf-CJ-hXKj0XRoMWDR0OZ8xxYrbyBfpTp-IKvmNwWqB54-1kEWsCNbngLvOJLUMWedWOR-K0x9ajDSZ-e7caBNxqldppzgFdlcvl51hQvuiOa8FI9sSKjz0zRtJfor0fEKCmiTYAHfNqePhxV_RTkdffSEPy9Khgf-xpSVXFBcUBYBjL5gCp2xJGmT26LjEa6Ran2-GzRGtxbdmxskxWQoZI7E7pHhbcE0heee4V0qXFpwBsnn2JqzHPz8-1TZys43padyhh8-zHDgfsVuGkbthziBriTrtvxpSny93537zmdjZWywQx4zYRQueMGIWXemORRqTgCBWBRRE9u1KSSTAp-vaAsl0XJpdcnN__Mb0y_vthi0qR4V_UPAgJF31SaA_-3zbX2dzq7repgHbr2Sz4tk6Avt53qlA1KG6_pVgpR8Ki2XR_3N9ktg1pMO2nYVuYO0cWzKUJqW-U4DlIZy0RbKsAesHUpMm2AMyuI-GvVDUr_7qrZ7cswHJXT384sH6517d8DL2FUpztkvXDZE8iQRJXW5MS0UgttunfPk3T2ikAI3G7t2SJdG4fEfplqW3N7rCcCtu6Ib0OLQ1Gq3eR-LM25qsTk5iDe-hpgSpEq_mDNCUmcs0pb4HKZPpoB4hlkE1qoncU7mdnlc5shqhIqjvKe--cBROyDnlWX91EnEUJ2KrvgBzmjjQKeWWRgrmEP1GOX6c546mJyenfot8yn7hT-blWblcz7XP4h5QzdOi8E8lnDyeKXZx4-JkaCt7mCIUOd48M56lP9OgknVAZ9A0k927LiaPYN7kA3qP51pfe6qLTDvSv2s5NRed9T009ajBKcSqf9KJx4UOY_V9nD411C2byAOGM1FB_ZnHV5KaRVwRUJfRYm6W4hdA2ZVOhFnh98CF7uidul5LLv1gsOoeaxsNe2e4Uwg-y-f2fl7Za-T7QdpCtDUUJjENWYggZCfZTaXJDaGYmMAX8tA8ZGvWu5nyIAHeUFZmqa5z1nqPjmDGzeZ2M_w7yk0KECtDR-FG-1TPXgs-tdUNKlwvAEaGjDCzWToF1Y7VWpQNdP912Bw1Cr7AScDEJXBFWd8Coyrir5upG4us9RjyVRlAzisdfEorSOWDD8nKp4e8HkDDxKfxWcstSkKHIK9GtEFEaVvfpX5Ddqt_NSsq0JBypoIVd49YdVADhPG0te9EXNqms_pu6qG5NXi2aiHZJ8cL5dV4eDF27ws7WS5mQKdceTMG6zL8zmGaMCmJeHtFAxkULvnl_g_OMJb0NPYS0rIzkAF8Rn7Tp89GVBWY-JoQSUL1JLW4cDRgshIPXoHW9JHLuD82gkbuzeI-SCJ8RVEdE5T_zpEYUVx_PDTOZyhGmdapfk54uf4zT6c9FmGShU39rr41Uv4ivqFAa4QmxNym8osWq5jSkqwyMxJc3GooxcluXgJDT8fRipj_ioRNhrd_o8Hk5L2EbsYSOTG-vJ6EjtIoPuny0dZSd-fyakgRIuKhKk_fKuIZTZOMCl65s4lLIYXa5B3FdsDr1PCFzNqzsLOl-UAmv-EV_mYOgEaroAf4hRvehGbuG0QzEieTVf_ATESenJyv7i5BvuRj8qAmxClom1yax9vbuab_9YkukT5pobeAS47Uq52x1RRnScQVw9IS-0joF3a4iMQy-EmFot3xE70HBwTsVSNk5vu3huuqvfIAvrsKQruh994jBTnk-OCSZW5JwLxIpaEsKehaKhv6vQXPfAHGhnwTIfcxG2NIYLDhw4V5yJ1_q1rq9fE59s89s40XFTELoh33f8WWjvsGPbkW7G4xiDrFW0eVjOlLAgJlgHLm3k7tCT9L1pmePYY-wY-W2DQ4ydiKwciUzht52RwDU1DHb3nr8259prbMlLVp8zd8HMSIQ9qIatPOt0gHuoJ8VLavCTBK1fcqKpcPC0ViFXBF3erAYYvzs63-C90t5G_er1-k1WbEruC6yZwaBSbs8PIIeduyYVvFQL8nLIXQUvZebxOyw4qh5LYzaH8Pvh8-5hd0tse8WGPD2tW-Z0ZJf-Pj4I84MrmOGG9v_-8QXSdnBFioJ3yi6b5AtHVi35g5WYFhOHbTHGMGytwlcU6YM29KK7P09CyJ3GTThvf1hZMj1Wda4pCB0FGUx7k_AOo15ZKx_a9XM7OtG-96t__OHy7N_v0rCuKB-AkZf7AjgyyRHCqiYz8yj5MV-vwEJmwCrwECjecBBPDZUggugxyz6VY5yQvqn2gWF33C2WDmqDN_FZN-aJECGvdvhanyeMWOHMeW0rjwfm62tf3KG8e8qOKae49RfvIOX9CB7QvoBwJyeKiCR4LlawZMn4DU1QFkczazUAdYZpPKfyK4ePJV3iYHS6NEX59hMR677seuI5LYEyxVooUg4vLsm4vq6KAlNpSDB6qcRcrYNMa8x9bNKdjRklXA9uVqDik_jSlQEknY-M2_MrlbpZZ-7lvmSsnA_yGd_i54V9NIi_MPC3M_ERixok_KdqNvNZ7x54w76gl-WyE0LMCJT9hGF2qbL4mZmfTU2pW5seT4heRsQP6D8tnILlEf1aYXNzMSH3JPur-6EcMirdDyOW6VscDPNeWIRwkqHrIxN_1YoWSA1cjP1Nwp8ZfICShpuA4U3ouy01R0gRepI_gUH0iinTgeZxstjoKDLqzDQchpGXyJAk8BlY8AW3TEL-U_ZuuP5-BIaFPMUvBI28pgIxDkMtX7Po8HjXLfVmoTl0C-XsO3y1vM2hx4SE2oRliBcAxnP4SPrTpUdLvEDTVwrdvjcm8aUmMb4gEcfos2U37dYlV0tb43VGmvZJgieaAice1SdNHw3y22HDCvjMI65wNa7ZyCdI_GuXYXlu4oVUdPWVmEsTcsBIe0nbdMzSkDNRWfuqqmgjhkLoGu5f4eF6z-OkN39f895LE4ILaxXIXPWIwyQ7kvktFOw1JA-aP2O-GfpwlGaxkzkVsQCDS599Pd3IVH_XkCL_dqDCCZOqCVSSiZGoQauLXCYv1TkwBYCFav1QuS6SAbvxU1X8dEqucwoQ9TRYRmBYc4z0Gcs5QebpgWrramIVNtYQsO7zUuwzacKGqZ5m6IbO7OLRpvuV3WR7gbvYAaqQ-l3N7yulb2EC8DKXJbB5ftJDo5iz93G3IfM9zfS2wCuzoP9M7rrov_bwRTooCiVYLtFQOvY8X4qHRch-b_tGaQSpAB53d5UfZMfi8F_AZP1Qk4DUEwORHPfRDZdGOUpYyrNzN3A_Fk5utxg&cid=CAASJORoEBc9jGGrVkeZqhryycNxFpJBz7B5kh36xP6PupeGNNxSKg&rfl=1%2Chttps%253A%252F%252Fwww.123greetings.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bc37b48e4a372d1a1ea6699c4b0efaa3027148a4d5876db261a571881cb40fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36813
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2315 42 B
63 B 44ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BywQXEqUBB9iOUqpR4Im5kr_qEanvPUrQ6cktH6EfH_WC50g78N2rud1DStyN5dDu9h9K2ivbH800msEyZOVej4wm7vBzmEqt05GwDyEmRg8gmzG8

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 2315 3 KB
1 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2315 140 KB
43 KB 36ms
33ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:16 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 2315 17 KB
7 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 171
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2315 0
0 33ms
31ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQYqhkJyE6TiRinPe3RPNeIJK64eaQH2Ayk9VKfXEvk_o0lwrntyS_V-T6kanLeZGF1qJBcUOXOBglOew7C8t5zHgHgHQ
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5FED 624 B
297 B 36ms
33ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKaz1ZIDELinj5QDGMeJoNEBMAE&v=APEucNUvHAp1hDi7W9MTRRjqa5fKLMiHbbalLMPlubrts3_n3DqZlWXOmxx_sX0cF4mvkreTuCO3u1fd-WjxZKmsj2kiKEW5S7Z-ZjEnXabHXszGLlekMZf7mtGdJwiad2K3-w0OJgImhNebGQF6IV7spXzIjTk7QScsP2eSMsp6pvymPMJgn24

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame 4293 23 KB
9 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:57:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 712
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9668
x-xss-protection: 0
server: cafe
etag: 3250940068065303693
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 20:57:24 GMT

GET
H2 200 12747153945677333129
s0.2mdn.net/simgad/ Frame 4293 25 KB
25 KB 112ms
4ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12747153945677333129

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa3f278b3647a176dd5cb4ffb54e695a9cfd09c0455f88d78e568456cf66972d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 18:00:09 GMT
x-content-type-options: nosniff
age: 356948
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25178
x-xss-protection: 0
last-modified: Fri, 12 Aug 2022 11:30:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 20 Aug 2023 18:00:09 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/ Frame 4293 6 KB
3 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d4f6e28cf855271fabcd5fccb24e71ef842e3ffa3c33795d9ddd9d3a1e3a46b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2424
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2640
x-xss-protection: 0
server: cafe
etag: 4024001306453174559
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 20:28:52 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4293 0
622 B 150ms
45ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsua8LqiGawAEYrwpXEKR51DFSY1Mhi6v3iLosP08XgITP7FS7LyxHE76uEI0qViYaUnQ6HtvgAsJctPHE0JpD1D45lESgn7_q5lL0zbqtbUI54PloaNi7XiOQwOF3pe6beL5Xo-Xdl3ctZfHBvN0sH1gCAmX7FqmwMJ4s6-43NDqaxhwFN4jaTASBlo_rPu3Q-40NPIGDc6qlh4GkUue5S9ua8s-LECEFehjLvfvbOk7CPAg6mVk2HV0NIOB4A2TFv1eJAyb6YLsLne8_sZi0ok0nQJqlQyByx9DHpbljonrP-qF-0qbvloB2zkWRUbXAFQInbA_ALpBgh4-2m95cIPhkCn8hqyULevPuIvyF3jcZszaXw5BgqbIKVLeXGoybFDL31jO9CxFepjBpvZvWqhdQpnbFiF0KHYtGTRMRNCXUJmFJ7VPYPa_fDNZHP5OHUYH5BKFro6-Z9gdZhgoJJ4oj14VBqFSH7mBAUcZNfwqB6Vz6k39303AZ4SB_sCujnTCOxYGwzlP4ZxudDu0MIIzo-_I6WmrZ3nJLnb-lzgAhw3GNXJTll4Y9Rrj4Slo7LKpxzij5_1rSxOUNY5NofqF5IYh__8p-q_OjVJhWJJlKsMjaspER3h37f4ktSyUWQIGj5M6Sh9KJ3q_iEfU1Dzy3GVuhQBqg8Bam4U-STEbbI3ihWjLMEBfxF63-XMoXhrwJRHcbiGjQx-t5nRrOTkeq4nRs58_CKfn66VxFnvOB2chjfO8EFG8Qh3bYe0Uy07yKNsOjOgp4-gZWc3IsWabIPjPKhY7FE7j6eg13bJiP4EOKmHnNMivCOKnviuMSMMocGbEpcEmUTnuyUkKGX7FTLjolw3FQ_d4YGJzmqVFFFBGm1gIfJ8jKHA4fQqaGxAgitbR9aG32KM81EMkD5J-L4zMh73Ji_rK_z264-lsV7y_Y-_NRzu152B4tGiBdDcqqaO8iIUDF6PJjf-3RKM1AJ4XX7_kBiib9QE1LE4uGM5pJ_9T38GQVOMG5YhaBHa3XIPIKOvnksvTY7u1HsHlrjBs3XhP3b6wixcGuU_cOdN-ruO451XPYlefct2XW8l_UUkdaNMSqc9UYCSTCCQ0WBNNqXVQxEIkvZY6HPNAbf140PsbH6KyBi1ZxUtmLgdcLw6DJ_8F6d1k2kdiy8uLkSji1rbdvkWoPM1_442jN9Bpfgf&sai=AMfl-YSNCSdyUxxFUvDgVNMzl3Tu1EZ99afp6imvQQPUXcMS0HSXDQWDtAvLkymbCpVuYfYwJD-8SPaQ-1KbDSHr0OBISz1CxfhotpdbZj0d2-RYmS5Aa7Z8Th7mY9NuT2BvuX1V7ddv0e6WugWEUelpOv0VQN4Z64G_7s-FcJt0owIy7sgcRBAgyTyqUDbq3vb_EA6yejbFae-YGBb9S_qKbjUd-spltNcrKylN7DA6isVOXj2S7Jcl0I4vpFIJw0gMPqqNdRgqWT-ly1csV2unhCHZ1CjfjM6373lFGEU&sig=Cg0ArKJSzEUkxGv4TPAaEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220822.59957&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 24 Aug 2022 21:09:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4293 41 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 11:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121559
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Aug 2023 11:23:17 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4293 42 B
63 B 73ms
51ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CRszRUuS07IBZ7sJXv9WIMP3KUDrpxABAPBvbUWNG63RXSe2hQPIn0AcST6Im--m4JxMNr8t0E-AZkrJSYAxc5KqBvAKZWZ_UMbbGXQtgB7Yxmymc

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 4293 3 KB
1 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4293 140 KB
43 KB 60ms
37ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 4293 17 KB
7 KB 27ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4293 0
0 51ms
32ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQDJPI1hPyFr78HJdEOKmU4QsnxqX7ldN2kZwGIlG-bhsZpwfmQVQT0V0Q_cwxK9mGJ2rSbem75bsjyyT_Ww8pLvLZJJA
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame A867 0
0 81ms
62ms Fetch
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C7af5e5MGY6SIMpul9u8PsomwmAbJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ2Mjc1MTc2ODAyNDk2NzCgAdW20uoDyAEJqQLvqpI6m8SwPuACAKgDAaoEswJP0H4Gn8AGHt7CZ_CqcRsrrRUJ8Co3WhuPP4yDAuGVtWejo3UqD9B7QIAtm6UZQqyuZ4WP2Aiu7gHroATtCBJpCwJVWOYbh8qj73xhWbic_QHURG_CNBNHrlA-7AjjagpKd1x-JLUx7UZRPAtY1x5g2tpleUnIVNMzus9CYWyqinA1B-K3Z08YIKD1mtJzn6roZHfK1JP-H2DIXgUdOywPzcNQoDQqE7KDnmK9kMLYql8_Zc0hHZ9T5nRythLIGFbuAAD9-B7EVji2jL4PK3mBIQHmisbK_PspL8r__SCh2GvMeuNr14jn81l9fJ39wTssfYgNS1NmEsGNFI2ECYzqROPIluHXI2ruCAlFv2QsszETSztG410KS-XCtxG4uhQTPr9jsLyK-bgc5Pl0z8mx7lDU4AQBgAaLvozdwK6T2toBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi00NjI3NTE3NjgwMjQ5NjcwGP_XFw&sigh=03g950hhTGQ&uach_m=[UACH]&cid=CAQSOwCsnQUxNbvxoeMzX3RLk5UV1_YFmN9Qqy6bKW5alsRYLBJqFBxGH8OgQBo-Ya4C-z2NXFiXaRcLkhPGGAE
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame A867 0
0 320ms
22ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=k-DuEsc1rAL6AZ2DYgICAAAAoVE7jJl3H1IffN3qK-WvnBB7kwZj2LcKFH_VjUcAxT0AEgAA&wp=YwaTewAMhCQH_ZKbAAwEskkWxLYgKefFm_wKWw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:16 GMT
server: Kestrel
server-processing-duration-in-ticks: 242568
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 788C 220 KB
58 KB 249ms
137ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YwaTewAMhCQH_ZKbAAwEskkWxLYgKefFm_wKWw&u=%7CIONJyjsMzQ7cJ4645g06%2BSk73yDFMajVImWv%2BtGARNo%3D%7C&c1=VEd5MTeK-DVtvwpxQwkatQ5fNcsqqVzrn0bJRZSWEljoMqTy8nHmy-ZCx2l8r38z-Y5KeOqAmeGKc9dh3PNWVQn404KTD77vBGTZgYRjMPz_4aEs-vs_puyZCUHkvYKSVwTCnzCDODg6XLOk626p9iBtC1r959XS3Hg7uD7iAHvZB6OzfWHBbUfUeSHrmM3ONdl8KMIlWYpjAHABIF5kpJfapFeADPxXb1pDl3KIzh1aScSWn1eMeBFjJ0knhSj7lKSmWQBU9pj2OUugSgGyh4-zC5bPwt_OgYoR7kFxfzNxBIofigG1RyNTmQQbidtTSklo2E3Bs-1BjCvsj5a0uxnYYPT-5h-t5uKVBseTmCyXjwRgm6xnoiqYzuHDraoSjp2r9ygujrslXLh9K5mFGKYJOnnwLS00f6wbiCle2lpOLFGtnq72DgfIqWEpKomrikzmNmLtZdlH28pIUixLiUM7-2lHcnBprIZ1Mq8KkZ0&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfFcqe5MGY6SIMpul9u8PsomwmAbJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ2Mjc1MTc2ODAyNDk2NzCgAdW20uoDyAEJqQLvqpI6m8SwPuACAKgDAaoEtgJP0H4Gn8AGHt7CZ_CqcRsrrRUJ8Co3WhuPP4yDAuGVtWejo3UqD9B7QIAtm6UZQqyuZ4WP2Aiu7gHroATtCBJpCwJVWOYbh8qj73xhWbic_QHURG_CNBNHrlA-7AjjagpKd1x-JLUx7UZRPAtY1x5g2tpleUnIVNMzus9CYWyqinA1B-K3Z08YIKD1mtJzn6roZHfK1JP-H2DIXgUdOywPzcNQoDQqE7KDnmK9kMLYql8_Zc0hHZ9T5nRythLIGFbuAAD9-B7EVji2jL4PK3mBIQHmisbK_PspL8r__SCh2GvMeuNr14jn81l9fJ39wTssfYgNS1NmEsGNFI2ECYzqROPIluHXI2ruCAlFvyYukqOUxKdVXMEe6DX_Eemxrh6lNJF7MghCxB7uW-dY10wbakNrKSat4AQBgAaLvozdwK6T2toBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2zD1xNWfm405kdZ8fBYDLdhPfXJQ%26client%3Dca-pub-4627517680249670%26adurl%3D

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

3db1636e511eda3c40e26595b191a9db98ee2170d1e5c3274e2d664c9e371aaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:16 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=9ljWZpGyeCoKK9vP0ng4PLVs6nDFRsW3_45pTWrPpceMKCf69C6QNxjEK_9fo2oFoN-sEXBlLRxH_bbcDk7EsvOAIPAAdwxC6xU5xDMT072zN544ME6lndXnYF-67862ITxl9Z-mxteO3oSN-BO67LE7NTH3lGjNzGlnbXLOweNjHsnvJ-1YsM1ZmHlMZZYiAPSuNG7X9BxGe-XdUTOirG4Jr0Gun_CUn23t-y6fLyCnefeffe8g3ZV57Rte-yEzEt5zyA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 117328538
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame A867 3 KB
1 KB 27ms
9ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5DC6 1 KB
749 B 33ms
14ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 14:32:04 GMT
etag: 48472445140208031
expires: Thu, 25 Aug 2022 14:32:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A867 140 KB
43 KB 59ms
41ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame A867 17 KB
7 KB 31ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A867 0
0 50ms
32ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQbWjlQ2qM0mwN6ANIzQez3n5q2o5I-KmC_7S2UMDI2_0lCb1K4JB-XfVdixw57yUHUvBYlCyFxAklMZRRYQMZNQHWy4A
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame A867 22 KB
7 KB 32ms
15ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 06:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 483506
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 19 Aug 2023 06:50:51 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 67EA 640 B
316 B 52ms
35ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNH7tdEBMAE&v=APEucNVXHWIljw5ahBHYzwjqCiOpDnYeD0f4PPdam-2edxeCGLoKRf6rQrNotrXNoQcr2Ohl08ljGC7jW-qoTrqd6kFgUOv7Efzf8xivtd053QF3r0wT85BdMWPLFVJEx1pmV7qQGf342wupPOp1vvKJ-ADdM8sJpuZaccl58DxsXRRAihN5qf8

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 295
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7226 95 KB
36 KB 92ms
75ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzLMN6wodC2sG5VUY5rHtiZSdCv3ZEOyiddKz_RTQW7-aXpvmZr2qwJAKEBF279DIGmXw8XcWMwHWtY6gPqIdTQA2GFMHpvhytaQHIRB7vyNAAHOO3b85VyuDxuzT3szm0D4fyKaYyw7k1Wv9YoOMmkhNZHg&dbm_d=AKAmf-AViHsttNGYUcwcgCy01GUjQ-BoUBJhzl-YQ2nPl0efXVfX160sZps5-Z5UxDcH-jMJnypfcPTB19_6zBhBm-qipJyl9unzaQNEY-AXKMQwti4rwZnwmxiLnRAvfQcU_n2vjfJGAf30_sh3n0g6SjZQ-ievFGJHJapmQGvAeZy1H_MnM4HZLNihS42NvR06wkrq0IVJ2wz2WM9A9C4flpuKU2QkjMrwbOgCgv3fOI6b51s4kF-el3c3eLhApMrLkerQUgS5MQk2uyDy1G0RSjvYm7MWWHmZigGx-42WiFpDhduiuzB56kXsjEig8FZXk6o4teO1SAayHNmaaBJjkhremJaOFEKM7zdBCCkvTMYHDSMsDHhDbESpSb4NBjXW_YF0EB7PMOn6Ti96ZemtgbNsF4xe4PWUI_k2iXbOG0ZRrXBJbtXOsWAfuZPx1_HdOtwaF1gbWwSAxVwUYkmBE-ybPD6WwDG4HTB3mI5eUmp50Lt_Ydj5z3tSXO_Qc9rABfAnEfMaXyqcAcfiOkiq2LNcoJ6jGo7NpLVdj70q8tKeF8eCjlu7BbkWTLMBsKvo5MWNFUDnFzKhTCgTfPbXzxSEvGCP9XbvfbKyXrrVE0fgsisN_gXK7qkjoddqiAGwi2ka3gsDgvgYMAGvJNETc0a5vHFAInWKBrv5eTg8S69rPbZClutMSNJOONy5dkviailWo2rtodKxmyCyARdjbaz2RIHgBxXIXfHUQwGrYjSXRdPChN0-B-hu2JJLvL26LJtcZrPTtbv_CRHGJuBAByLGe6t4TrF6tUcfVB0DS3M-y101xZciN72cWvDo7klwIzloFvIXB4zXPV-Z36Ns7Z5PxW0E5aLqD_ZfBnlgp2DNT61ZDu0cDb9gjbn4PUSbVYe8ahom_iuvnLkQyOwNvbt_mN8Zx86wKmZAQKCudoofWWXjPUJetOONNeel2XV0Sam9kl3ARHi_KeLT6ls9bDhbaInUbZKJo4lHthYgKl4bB3m-gCQcVieWXvpAZleqgtsBS3K54cxuPBCH5xfJJgZpQ9ko04Bwvh1xmBMr73RfS9zl9bXBA11dGCIiUnp1ShEqIpN0RCG1CJ_xaahDT4U8R6sWLC8RRTTFvjF5y5zPWDcWItS0Dy9TagezRH3vkeAZHc-C2gIQlgapMyIN3qQW6JzEXV5FyBfIjbKl4gUk984Arw04N8LHlFdHC6oETzVYBWaDe043A-zfBBNalCuYrYKgKwO8Gavql6rxkKXJu8NvhKXz-XMgOswSc4G3OGIbys9Lsa9OcXuzrbC4FN2C0sclCUsg2NJQ1UMk-KlaD74dpJCrRVvYPXMo5WSaRKLtW_j0klHHW7mU8jiy6opciz6OYHsCRNKCOghaWlGK5SUaLCBITckji-8uvLWHSPQGfPpHAHQoHdDSq-f_ux805PuoK8lXWa17TJbCBXTlPyS1iqcvwQRo6oJuZJ6NZTnmhlX-5XOBwyxhZf5zfBbEP3qEaRhQQgnnHNCwQSdFaaSVG9onMX4TIux9raFBO9a8KUPuvHsxFPj5DATQCQHgFdfFtBnzGkTDDHbVkMS2W_vUcoMDMFEEdsfUtQc1fAQywXPRoG5BOpazK2HPFpsIgkb-64A_VlkSiBuMYcF3xyWR0PZZf3ZzLQqg3sPXd016Kk4_s1e0jGTDT27tkvDf0dvkUs91PJqT2ASC5T4r6xyFHsiOAq9PcD0-Jpy2PHPgZqV1XKerxfb7pxNT1SlqH9ooEuGQoRZd1ATAQp9QIUkW42eq4wBx60-S4WTIN5xevrqiJICecK7Fqc7RtH9EZy2kQSQPRDYxFZaqjQgpb7U2JrHWkMGDQ15BLD31ky57gV7APjRIn74yFFSL7z1pWKel2z56ny7gQcqG9WMk4WxNUpt77bLzFHsWI-StjgPY_Zs3HK1luB4QLQaQXLJIe8jPpApMVJ4AeoEPBWNOHmgCIGqtGPKuOxjHvk1SKxfeRInnVrr7UuU8uVR-Cd-zXEa4Ehf1DJfn5Z023VVeyo_pNZ5FEcn3Jr39FZglt-7eMd84WC4aNUuovoCV-eYAjlxOMFBq5ft7M9dcqqrI3A1eLnq7bj3FmUTIRSjJWpq55muoSo2z-6SbsoWY4IsO90ZeASGWcb0OQ36Wsry4Q2rdzItw49xdhqrojUgANOqSVPVE4VudlLIywPu2wN-37Amj6CLDgufRpLI6aRMxXlHlUGEkMVOkbLziEsLFqd5q9JZ1aJZmen4P_djWkpuzQAHprIpLLOH32dwi6blvJxjiJpyc7IPreunqfn-tTZNN9j0mUJISxPw__FJTkWJqCBF4Uq-KRl9WUjS8OFna6PuowDLd2XitjQg8SeZaZ_5u52yGDhj30vqGEzXNxaAJo3A4BcLCZPgmmuLSGWue01FdjuyymJcc2k3yHWkx4Gl-hf7uimVh8Lq7y0sTFkRO9FEz4KfOOzfe9JYsw5VInH18s3SPqNyHm-5ZHXnJvB3wRqvk4j-Rg5MWiXF67KRruufLqeeUDtooYQn4QGHpn4e1iZExwUclZHf-wQFUHs8jZcaB-8D6iqjtksDfhhLtXc_CcB_f59Mhbz6YMSKmLsvFTxJkBKtpgbt1I9LTce2wwhJpVmUtgTwMUSP4uZY7702O7tcYZnBBntRuXxT_hAJZGoLc2gO4etBwAJGGJAp8Rcsd4kvfoNpAOlhTVZ0fS-k1GmejRUoA2mTUFpLnfhI8N-bFkqOaT7pSBSuxhjgURszTQ-Pz3Nt4WrFdnTXbDFb6eRklVW8Ogs3LoxFnPjXnnLAhq4qwbOmddpbUttdxNmef-ZKjlVflSIZGjyNRcFnKHAiu0CaOWEf10X_zOmNetczfEz1UrW8elbuhNOE34XWDGBVkPDKEJIwZAC9AkafYHKPQBYPL7ncqf2lhJoPQP1aBmPGgL0La72g4AMQcuXXNnat5eL_ZmEak19z97U14OqWtAz4_3Ld2WG6bD0pHyFoeks87n7jG1RWECtSvvzS3S40bmV3p0xr5pezeOsgwTvZAdYlfbbSZgmHkysQLiAlv4kD6AhHkKXLYpfCwZFJh9qFdPm4tg7CbMp9rXjWmEYPyc4nVaPlUBJxn0Zp26iT0p_36aoevTev0rHuOkRYGH9C2c9knhtcuWYv6hkVAf2mJqtwKL-ctJc0LfdVmgTOmNA6rWKRw89pj6RT_u4gZNI8lUOqRQ8BGSjxeCrus6YdsV29NZDsE_7wPpytXHGt7cXjVvvKeCUyKqFIxaOn6&cid=CAASJORoJtX307u2RCgZn1CfBe729a7GUJ5uAKgO5As4xd0y7E5Emw&rfl=1%2Chttps%253A%252F%252Fwww.123greetings.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08b6918c8b01473efd085f2c8f49afc2072e39b4dbc40c85216896e3c743495b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37074
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7226 42 B
63 B 65ms
48ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D2J6GG20YsmAe_cQZNceX2w6JEYDb1_9FsoTU0HkeZfOrKyyq1vyaHctwYcBWjsXafnNJOdHe3rcFBG4812x1BWuCnsM4OAL8gnFiy5DfVFVLfXMk

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 7226 3 KB
1 KB 40ms
24ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7226 140 KB
43 KB 62ms
46ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 7226 17 KB
7 KB 33ms
16ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7226 0
0 48ms
32ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT4Pk6qZo5J2Av8A_aOzbm3t-qnSLAUtIYEWY2aE47vPZPtr631qxS4SJN4uPH2yJVUIX128fx0wgGZ7GB_xLq1DckWow
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F642 640 B
316 B 47ms
35ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJWG2AEQ0ryZ9AMY6_bW0QEwAQ&v=APEucNVXmeHpKifDgtVDueHIrYJAIdqJeOArrFwiDix5JfNm3vgYk4y1hLKBUX6040kwUQ8wfWkCx74gMgwrqdOIleSIVrB34qedfOGf_TCgYGL__fL6U-TjNj12M9cuGN6u2cDeAkdPoxZl_sMB-Gq38zUklskyYkPfM50B7DJHnFQvwKRTNgo

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 295
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame 79E8 23 KB
9 KB 32ms
20ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:57:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 713
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9668
x-xss-protection: 0
server: cafe
etag: 3250940068065303693
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 20:57:24 GMT

GET
H2 200 8497462523863047075
s0.2mdn.net/simgad/ Frame 79E8 32 KB
32 KB 95ms
12ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8497462523863047075

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8749b37272182407219f5d8208f812bd74b9fa10e7877b1ddbe1963b794bc51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 23:24:53 GMT
x-content-type-options: nosniff
age: 423864
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32651
x-xss-protection: 0
last-modified: Fri, 19 Aug 2022 15:41:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Aug 2023 23:24:53 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/ Frame 79E8 6 KB
3 KB 33ms
21ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d4f6e28cf855271fabcd5fccb24e71ef842e3ffa3c33795d9ddd9d3a1e3a46b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2425
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2640
x-xss-protection: 0
server: cafe
etag: 4024001306453174559
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 20:28:52 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 79E8 0
64 B 127ms
46ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsulY6gIiN50metXPl5TMGwBcOJ6O6z4G27LGWIMAmBAgDfeLOQ67sBD2rxYl6_8zJUM8YFaQrQbVspo6jwT5Uqc4StAzgdoq1kuFwY2bAesZDqlm-zfS4SXEwljIxIdertoDIG1mBeV4FOl51UqTtX5OaPAhw3Rz2PT8Bm9oeFxIr7v8V6Sz8kDZgLYkdmUGOV-1zoopE3wLHu45Kz9RExGttjAS80nRdvhS7GlsNca4hVeoLvWPp8k1RmsHw4CUDcphCMJCWusMO_-YvNZQVInnwilDv11CQoHDB0OxCzWr-Tvd619yB7Jssne6wy5KccqXvf91WwvKgiQLHBkmLDFIafGMvKnwTh9Qv4z6BvajVvqff3s0vzERcAdF9LzZs4u_bviq9eT4LrqUfWa8uS-uxDhfwdRHKZ5md3UofwIoue_e-AeFqY2mparYJxpDqtrScLZ5f2mU3j7Ltq6ncZswRu3vP0IZvFxgHmvusBHRkvVIxYt9VAXruHBcuV9AoukQ3LVjGStvtYjHtVaIR2McCPCFJ3j5puBLQzwmbCLB7idwU3VX8ywIOMXjZZmaHP3qLJoRL34pB1Xjo7OiXkKOsN_OezFSk5r7NCNNOxRHxvSsX-h-Kkaox4wyv9CXrdrngGJgOjBLWekx67sR9eSbX6-Kd3n8JPJXDMNNGStQZC-_M5l4ADZdYCt0ixzTWKqxqYUs7I7zSbvusp10UEchscruqJfFIeIpyNCVbR37q4s1T9YE40EwFMZk6dsmX1HxXo59qxz0b0cEnh3YfA5A_gxXnbw7T2tcJJ5tLQ1ZYI32iz_SR0CJus6FPerW9tqazKkj4cfR7dfBOJajwQcmGAGfBoE1o6C_fwtoU6IVsssfTDWF0G8YJteNxHPH65n55yZY0nqRbOhbqpo2dxV7bwkipDMKrooH5j02zzmSfiHKcjRmWkC7T477ViaSysql4E82S5zWUjTxG1h62o9GKgOdRuqzyCjTQQssS9AU4iab6VU71mNhbMjpLFT_MAYD4Jea-VtG_FzkVMNwbrE3LIlhxtfDthcxVMHm8tNMenLFYySl-VTpf4QCfkeEUOoxdiSccDdRXzRopUaRCYrJ2rb7348_bc2c1Ntjtu-Q2uM0LZ0PTj3SwNICh4WMPTVGUehthq4C-JCDO3dfi9UvJoDUx8POhH7InHZNVXqDLAKUZSy&sai=AMfl-YQVqpUUf7_LPV7-ravyaIGgZm4QPiETfeMDb27PozuWBO0UpF85i3wK2yKctBvNLFuX85t45TyAz8sDPseTXu-y2H1JZkdBnYeYZ9efqjh3B0OqEgOx2z9ANuuaVtcpAlaapI2fJvSXVoyQnvxSX2GuHeV_IblB2cTtJZBHcpDhztgjt7edIIsL_ofGZViciBOTokeHmTTYzT3YM3Iz70sV3wBZqpqMI5jK8bCQ7fbcJsKixqEw5GB602sLrklcv1UYn5K6qsjAgbMuNPyNsBz1pBvFeUAAkLVpzwU&sig=Cg0ArKJSzOS11L3g6UpZEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220822.88371&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 24 Aug 2022 21:09:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 79E8 41 KB
15 KB 33ms
25ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 11:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Aug 2023 11:23:17 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 79E8 42 B
63 B 57ms
49ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CSngjqDaqZILihBU2cAeScr2ZfXkKuvy_wpkWG_bie87mHc0do3EuUd4pEcvwcOiiXgazoObjKqkLBALhth7LoAqu1vRBr0IOqxm6cvjOBVhsvwWI

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 79E8 3 KB
1 KB 34ms
26ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 79E8 140 KB
43 KB 51ms
43ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 79E8 17 KB
7 KB 25ms
17ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 79E8 0
0 40ms
32ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRvR9IiYc2DIq_d0NZJ4tDRpRUzp8Uz5crdFbDEDvEsqiGMBGl9fsQpEV4ANn9jfm3M6qwveItLSAizNRtQpUxHY7LHjQ
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 220407_deinenacht_v1_p_ODB_GDN_468x60.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/ Frame 96D9 2 KB
1 KB 52ms
22ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8df5652cde6aa3f3eadedb348b5d51d636291f6d7dbbf97cfde4bc1adc580d6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 207775
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1131
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Mon, 22 Aug 2022 11:26:22 GMT
expires: Tue, 22 Aug 2023 11:26:22 GMT
last-modified: Fri, 22 Apr 2022 12:42:38 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 511C 0
0 80ms
52ms Fetch
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CwTjye5MGY56LMpul9u8PsomwmAbihJXBa_SLycqkEN3ZHhABIO_2kCFgleKQgqAHoAHes66XKMgBCakC76qSOpvEsD7gAgCoAwHIA0iqBLcCT9CWjWe8o-tMKo8mA_cTTIihJ_IGV5Y88Wr-xsqcqleUQjxRx5DTKZAxfG9O7rfpMt2MunBhzMiu9pyHiYE-HHH3ekfxcvza3iw33NAm6BmQER4f-S-n9BqfI-z11HGmByo0RyFDijE7Yfa-nor16Xyti6JKwUW-HdpTbW-_FV93i1aoap5ilA0BfcX3Bu6QVTIpS3fxlcKRvCZnffgQHcE3aA3G79JpFpPbiCnQOO5vk3ZvgFVEvGk2ZPQz43mxCKNbtjrH8MNfCsoZ5ke4PaTSW7BO8xpb0M6llBp-G6jXWEOtI8Gx9QUK8RU7_Navzsr10_kJrlPDE2vPAbRqzaba-C2Y7R-7vlAL2BhAG2x-PDdJCIIGrsEG6w0a77Bbme7AxKruX5eFW3v21ltm_0xIGg19B13ABNXcm4_zA-AEAZIFBAgEGAGSBQQIBRgEoAYugAfe6_72AqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEN7ECNIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsB2BMK0BUBmBYBgBcBshceChwIABIUcHViLTQ2Mjc1MTc2ODAyNDk2NzAY_9cX&sigh=gzLp_smQ93s&uach_m=[UACH]&template_id=419
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame 511C 23 KB
9 KB 41ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9668
x-xss-protection: 0
server: cafe
etag: 3250940068065303693
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:56 GMT

GET
H3 200 Eleq_300x250.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/ Frame FC8F 74 KB
16 KB 44ms
13ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69812ad8e013a18d150c24955514568522513d93ef5178540ac6d2cbea28bcb0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 69861
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 16540
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 01:44:56 GMT
expires: Thu, 24 Aug 2023 01:44:56 GMT
last-modified: Fri, 02 Aug 2019 06:46:58 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame CA97 0
0 74ms
52ms Fetch
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Ceabwe5MGY_GMMpul9u8PsomwmAaZkqSWYaHm8uDjCt3ZHhABIO_2kCFgleKQgqAHoAG_0bKMA8gBCakC76qSOpvEsD7gAgCoAwHIA0iqBMcCT9CjFDQHRqXpQnaUk_DtaxLJS9eyczAMTy8vZP9NUoAWpsDxOQ2Dg7qvPMGS5D6u2Kt2wJRoF5_aNkVH2ywjj4-VfaURO7qHyxuxdMUjPdP_izoUbxX3l34Ot4qxHIwpWbG2mEUpUCOK8WwyVOcg3Sm4LQvWRh-Y71khg1Uo1IEz38Y2yJ0XMGyt5OjT1069pXkhjyEZIQtkyeOGV4vWrAmF39Zhb0d8y2STFa3R51O58hMUyAwsuvOgbASTxt4_f9CNANiJecKBr7-rmoB3ytk0sdtmpi31r3r7I5SF-91ATLwRKmVHXJsvEGnfLX0Sx7_cwuVWt9dRYPUqqYKLUmwLv0mIUpc-bvM51Ut_gY-hJFAyoacrNu0j95eH71qrPiCuxNhuS2I8sn1OoDcBXkO7I-i52cIFrrXCqI7xuwSs5ZNkqiUzwAS2ubmwhgLgBAGSBQQIBBgBkgUECAUYBKAGLoAHqa7Nc6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEIr8EdIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsB2BMN0BUBgBcBshceChwIABIUcHViLTQ2Mjc1MTc2ODAyNDk2NzAY_9cX&sigh=p1DfusvCbg8&uach_m=[UACH]&template_id=419
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame CA97 23 KB
9 KB 41ms
19ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9668
x-xss-protection: 0
server: cafe
etag: 3250940068065303693
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:56 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/ Frame 417E 8 KB
2 KB 34ms
9ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0a76a678ec2c5059f902cc43c97b0de8cb0e7fed2b8bfbfbc3bb34e8739b8b1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 72846
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1733
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 00:55:11 GMT
expires: Thu, 24 Aug 2023 00:55:11 GMT
last-modified: Fri, 12 Aug 2022 14:54:51 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9698 0
0 77ms
53ms Fetch
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cc4gQe5MGY_WNMpul9u8PsomwmAaO6aTpa5eYu-2xEN2rg8LwIhABIO_2kCFgleKQgqAHoAHumKTtAcgBCakC-2OBaFrbqT7gAgCoAwHIA0iqBLgCT9CU0aOBuqcOn25BA_fbL3iwRvpPmFkzA-QPjP0lDZq46lsDpak2YFPuycE07KF4vgnQdNYpxKmXxzfFAhv0W9QMWs6c_Q9XELzB7Gw6dxZ4YJJBUPU7O_kQ3VJlzSbaMfLcH6NmH5TpbPPZ4Jgob8ZTVFtQIZmqFmiRuM-iD94oRJ5i3doLXGxIe1l-7snw9Z15NN0E9SASCnxQi2kSWWVeCp6h8zzxK2WxtDhfK3kbzg813mRkhQWJBDRiyTQPAH4rNSRd05gyg4YYRkN-eit_0IIjThahFXLEq_sSwFVgxinzSWqV6U1SDSws0G52XfeBWjKUYXzc17uVMkkCbPsj6nmyUfYIRDw-nIJMCxfRwSZGGEiaHz6S0cF2hzuRm_fxFkFmJiN82km1pNdjnWJbEKeJjdglwAS2je-UhQTgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH-ubbkgKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBC67BjSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAdgTDdAVAZgWAYAXAbIXHgocCAASFHB1Yi00NjI3NTE3NjgwMjQ5NjcwGP_XFw&sigh=PH8J1Eza3fU&uach_m=[UACH]&template_id=419
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame 9698 23 KB
9 KB 32ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9668
x-xss-protection: 0
server: cafe
etag: 3250940068065303693
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:56 GMT

GET
H2 200 abc.txt Show response
static.avantisvideo.com/data/ Frame 5724 10 KB
4 KB 46ms
8ms XHR
text/plain 2600:9000:2250:7a00:8:9ed9:9c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.avantisvideo.com/data/abc.txt
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:7a00:8:9ed9:9c40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5f80fa2132d722dd124412c74cfc1084f4991195f7cfba1f34c9ccdd2e2fd28f

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 24 Aug 2022 11:50:52 GMT
content-encoding: gzip
last-modified: Wed, 24 Aug 2022 11:46:41 GMT
server: AmazonS3
age: 33506
etag: W/"6fd8702284c7c857d580cfbb99464d99"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: SytUc_Lwq1DIrVyqaR5MBFsd7tZqLNOglqpzbrvXJu_vlfgFmrep-w==
via: 1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)

GET
H2 200 abc.txt Show response
static.avantisvideo.com/data/ Frame 5724 10 KB
4 KB 45ms
9ms XHR
text/plain 2600:9000:2250:7a00:8:9ed9:9c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.avantisvideo.com/data/abc.txt
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:7a00:8:9ed9:9c40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5f80fa2132d722dd124412c74cfc1084f4991195f7cfba1f34c9ccdd2e2fd28f

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 24 Aug 2022 11:50:52 GMT
content-encoding: gzip
last-modified: Wed, 24 Aug 2022 11:46:41 GMT
server: AmazonS3
age: 33506
etag: W/"6fd8702284c7c857d580cfbb99464d99"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: JCypKZ_zR57mbOz6HwdL_tLEbHLew-_fIHopYPIpiyd_2239O7Jj8Q==
via: 1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)

GET
H2 200 abc.txt Show response
static.avantisvideo.com/data/ Frame 008C 10 KB
4 KB 42ms
10ms XHR
text/plain 2600:9000:2250:7a00:8:9ed9:9c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.avantisvideo.com/data/abc.txt
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:7a00:8:9ed9:9c40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5f80fa2132d722dd124412c74cfc1084f4991195f7cfba1f34c9ccdd2e2fd28f

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
last-modified: Wed, 24 Aug 2022 11:46:41 GMT
server: AmazonS3
age: 33506
etag: W/"6fd8702284c7c857d580cfbb99464d99"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: L2JqBYSgPBYfGqxlIF3opQI4rK92-haqK3w1I_Avp5RvaE7_6ZOcFA==
via: 1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)

GET
H2 200 abc.txt Show response
static.avantisvideo.com/data/ Frame 008C 10 KB
4 KB 42ms
10ms XHR
text/plain 2600:9000:2250:7a00:8:9ed9:9c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.avantisvideo.com/data/abc.txt
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:7a00:8:9ed9:9c40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5f80fa2132d722dd124412c74cfc1084f4991195f7cfba1f34c9ccdd2e2fd28f

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
last-modified: Wed, 24 Aug 2022 11:46:41 GMT
server: AmazonS3
age: 33506
etag: W/"6fd8702284c7c857d580cfbb99464d99"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: rdhRDIU10PLthnrWi455gDq79qZxJMvdEn7NpEcM1SS0QMql9sd-Xw==
via: 1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)

GET
DATA 200
OK truncated
/ Frame 008C 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 106de2465907b3815cb65b5964f59834c9b576be8bcdd2f67886e04baf53e7e7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 008C 0
0 60ms
44ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssg8Hs-r_xdYgxyATuJ-DsnQi-OsA5723lpfPZ_ZtfzHIn5hAhQGBWgfbCEKAGdVad33lW-lEKJUei_CpYi2_OIm-_I7Tg3XhFaagccnN7y3ttSnbBDV7hpHQQVavOjqVTiexz8zguxwjKVgUfMxhcS1zAeU3JHJ9hRsB3v8AmOUzKttBmkpkqUP68gmjcZpfHoRFQLvfjxwB38Cxcr0hCm4nuyr6DWz27VEoug5IQWpUMRmJgTygUwL_sKwXpfhYBjSe1-FH81UgUwXWHar65Y90Ijh7y7tlEnZoKNZL8dqkPZNatIk8PRgBCOUmyJ37U8kOPRb4lv5flt6NqacK5L4QO2laES99p-4LljbqPBjg&sai=AMfl-YRPpQf2Fto8XrFRtc6hqvp1UoLRtCJwtdDVOiGqNc6UU4NwhyNc_Sdgh8R3tkgva3t7nHDvOF-Y7B1dbdFToV50HJO_bLFKOW9opd0DIFPBF9XreJH5a20g32cc_w&sig=Cg0ArKJSzEOg_VIC79oAEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
DATA 200
OK truncated
/ Frame 5724 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 018d1ca70b337096cbdd1c407a2543d66ecb31f70cb14b5e9614737d7676f5d5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5724 0
0 44ms
44ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstY3gmyiKdV47Dp4vkSGoVaikA8t0-OGmD0nxwTrWbHQWzgxh850zmY8cBTrJGY310YftbJuYUlg9BoIRafvPe16kxIC03ifCfT2lroOd_Jmv1sKhYczsTgivsWDiiuu9icH6Z7hFN5Xqo-1E_pDeALnQ9QANHRBvCkgu0J557vAPNFANxC6PTm_M8LKq7J9DmZP5fDSrd6hLzy7q2LE-Stm6JGMxkhPJ1pg2VtXY3i-NWMZnH4Sx9DMiowMs3Xi5cNlGlH2L4BBqr9ll7sn9hHcL5FXYQBmEYEtmhBqNFiojR-_VlpmaI-QITRujrWeDb9pBLTKko9DaeVBYFptoIZODpnOmc-RQ&sai=AMfl-YQFsL_b7KR9AZSkihzevWKbJSeAAUwlsugq6GhykkapO6931eYbdRTlatmvmhvXF-oONuMiS4zrw-EBmJ01y1IDbfl3QQaB8ux1PtPYMLY9y7ZD8ozO1L6RvnZE8A&sig=Cg0ArKJSzEgvChSMAxpKEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 24 Aug 2022 21:09:17 GMT

POST
H2 204 /
events1.avantisvideo.com/ Frame 5724 0
34 B 526ms
171ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT

POST
H2 204 /
events1.avantisvideo.com/ Frame 5724 0
35 B 525ms
170ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT

POST
H2 204 /
events1.avantisvideo.com/ Frame 008C 0
34 B 526ms
172ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT

POST
H2 204 /
events1.avantisvideo.com/ Frame 008C 0
34 B 522ms
174ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D4ED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

43 B
909 B

50ms
30ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGLz8tdEBMAE&v=APEucNVSzuHcI2x6JCIkJgwC3s__RU9NmOcpO961F3LsQanFplKJxWTaEParp_bVJfej0dS9q-ufAsS2egJc00609tbi5e-6cJqP5zdy_pNBnIcBAgyTzGl0BJRivqg-1xOOl2fYRNEdFML0Q4jYxgL983LouYDkqWcl-dzQUHdNWP1ToH7EBrc
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73ff116fcde591d2-FRA
pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rMGchgSZNpRs9c34TvUUj1TxZOHsofKrty0mNJpLOuwVhqzyyPaPmKONXFDAhPQag%2Fc6uSJko3vAbY2BnupXDe6Vi8HEPZPu%2Fis7iN%2F4MhnsbT8dpvnVepUiWFG8k30lXBGkdTH7UhGqMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D4ED
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

43 B
914 B

23ms
22ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGLz8tdEBMAE&v=APEucNVSzuHcI2x6JCIkJgwC3s__RU9NmOcpO961F3LsQanFplKJxWTaEParp_bVJfej0dS9q-ufAsS2egJc00609tbi5e-6cJqP5zdy_pNBnIcBAgyTzGl0BJRivqg-1xOOl2fYRNEdFML0Q4jYxgL983LouYDkqWcl-dzQUHdNWP1ToH7EBrc
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73ff11717f7e91d2-FRA
pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=32N2ynpT1p0QLp8QVlZU%2Br%2F%2FzhlAEwG%2BdRIyspUjC0%2BJAqvgqxat2tj8RO9RwZUWlwUKzUy38JBGNHjChc89%2FIW2SqYR4mBOFQA5FyRigJkYphf2ZV1CR947ajqjajRmqG76I2LeOzjwAw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame D4ED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1

43 B
1016 B

27ms
12ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGLz8tdEBMAE&v=APEucNVSzuHcI2x6JCIkJgwC3s__RU9NmOcpO961F3LsQanFplKJxWTaEParp_bVJfej0dS9q-ufAsS2egJc00609tbi5e-6cJqP5zdy_pNBnIcBAgyTzGl0BJRivqg-1xOOl2fYRNEdFML0Q4jYxgL983LouYDkqWcl-dzQUHdNWP1ToH7EBrc

Protocol

HTTP/1.1

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:17 GMT
X-Proxy-Origin: 80.255.10.202; 80.255.10.202; 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 682b31bb-a03b-43f8-97b4-369b805d00b8
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D4ED
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:17 GMT
X-Proxy-Origin: 80.255.10.202; 80.255.10.202; 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ca2cfab6-6e13-41bd-857e-4b995abab717
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5FED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

43 B
908 B

47ms
28ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKaz1ZIDELinj5QDGMeJoNEBMAE&v=APEucNUvHAp1hDi7W9MTRRjqa5fKLMiHbbalLMPlubrts3_n3DqZlWXOmxx_sX0cF4mvkreTuCO3u1fd-WjxZKmsj2kiKEW5S7Z-ZjEnXabHXszGLlekMZf7mtGdJwiad2K3-w0OJgImhNebGQF6IV7spXzIjTk7QScsP2eSMsp6pvymPMJgn24
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73ff116fcde691d2-FRA
pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iP6E2u9X3%2FWKLzPlyGZOC1tTXrIO7Bnf235gYLUHidUTbweOeh78JiSpmfPcsG8O%2B7%2F2cScbUfNNJf7yKR1pgGsVZzJhahRKQMPa1WhAohcgDCx1KIdOH0UBntjkx5Q4fW6KHxvsFuzKLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5FED
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1

43 B
915 B

25ms
24ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKaz1ZIDELinj5QDGMeJoNEBMAE&v=APEucNUvHAp1hDi7W9MTRRjqa5fKLMiHbbalLMPlubrts3_n3DqZlWXOmxx_sX0cF4mvkreTuCO3u1fd-WjxZKmsj2kiKEW5S7Z-ZjEnXabHXszGLlekMZf7mtGdJwiad2K3-w0OJgImhNebGQF6IV7spXzIjTk7QScsP2eSMsp6pvymPMJgn24
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73ff11716f7291d2-FRA
pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1lu6XSlWg9KqKDT1W6Y20FLhNxAQDMRV1kxM6Qfz%2BLhqDUxcRxDEXsvwhFIc%2BLk7AmsR476RHPv%2Fn%2FXpJhwMq7%2BrBMGEvfTCg0v5lhq5eOCWhx%2BgaWPOFS1KBuj8xLTuqYhvpFNfLvaTZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELR01rG399EC5QlTP9t5yA4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 5FED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1

43 B
1016 B

34ms
18ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKaz1ZIDELinj5QDGMeJoNEBMAE&v=APEucNUvHAp1hDi7W9MTRRjqa5fKLMiHbbalLMPlubrts3_n3DqZlWXOmxx_sX0cF4mvkreTuCO3u1fd-WjxZKmsj2kiKEW5S7Z-ZjEnXabHXszGLlekMZf7mtGdJwiad2K3-w0OJgImhNebGQF6IV7spXzIjTk7QScsP2eSMsp6pvymPMJgn24

Protocol

HTTP/1.1

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:17 GMT
X-Proxy-Origin: 80.255.10.202; 80.255.10.202; 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a0db5610-d918-4827-b4ab-d29b740e1291
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEmMH1-bcKvgRTy3hoJGNjc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5FED
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:17 GMT
X-Proxy-Origin: 80.255.10.202; 80.255.10.202; 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1d10e27c-f58f-44f1-b1ac-0c457d676b78
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDkyNDg2NDIwMDM5ODM3NTM0OA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1141311/65046779/ Frame 2315 235 KB
70 KB 194ms
61ms Script
application/javascript 34.254.17.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1141311/65046779/skeleton.js?ias_dspID=3&ias_campId=1008628059&ias_pubId=pub-4627517680249670&ias_chanId=1&ias_placementId=17989214151&bidurl=https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gdkS8BIy-Y50tjdI1xtXVb
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.17.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-17-167.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a375f0868f27f673a2142c3790a5ddd77cbc1eecc13e63dca666d03cc8b4571a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 2315 106 KB
37 KB 35ms
7ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Origin: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:50:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Aug 2022 07:50:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/ Frame 2315 8 KB
3 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AIicjkSHN5uJXHv7gjyTrAFL9Tvqc1G6qxIOxfMkrvtR5Q1_tQVXIkYjHWf_DpWt1AIKYpK7avihqEUDMi1o4LKwCyR0RxRcLgG4pVEftgeTKzXoUz7nLjygCaApht3xwAZa0nYztsRusLSnjisJZ5YUOAKw&dbm_d=AKAmf-CJ-hXKj0XRoMWDR0OZ8xxYrbyBfpTp-IKvmNwWqB54-1kEWsCNbngLvOJLUMWedWOR-K0x9ajDSZ-e7caBNxqldppzgFdlcvl51hQvuiOa8FI9sSKjz0zRtJfor0fEKCmiTYAHfNqePhxV_RTkdffSEPy9Khgf-xpSVXFBcUBYBjL5gCp2xJGmT26LjEa6Ran2-GzRGtxbdmxskxWQoZI7E7pHhbcE0heee4V0qXFpwBsnn2JqzHPz8-1TZys43padyhh8-zHDgfsVuGkbthziBriTrtvxpSny93537zmdjZWywQx4zYRQueMGIWXemORRqTgCBWBRRE9u1KSSTAp-vaAsl0XJpdcnN__Mb0y_vthi0qR4V_UPAgJF31SaA_-3zbX2dzq7repgHbr2Sz4tk6Avt53qlA1KG6_pVgpR8Ki2XR_3N9ktg1pMO2nYVuYO0cWzKUJqW-U4DlIZy0RbKsAesHUpMm2AMyuI-GvVDUr_7qrZ7cswHJXT384sH6517d8DL2FUpztkvXDZE8iQRJXW5MS0UgttunfPk3T2ikAI3G7t2SJdG4fEfplqW3N7rCcCtu6Ib0OLQ1Gq3eR-LM25qsTk5iDe-hpgSpEq_mDNCUmcs0pb4HKZPpoB4hlkE1qoncU7mdnlc5shqhIqjvKe--cBROyDnlWX91EnEUJ2KrvgBzmjjQKeWWRgrmEP1GOX6c546mJyenfot8yn7hT-blWblcz7XP4h5QzdOi8E8lnDyeKXZx4-JkaCt7mCIUOd48M56lP9OgknVAZ9A0k927LiaPYN7kA3qP51pfe6qLTDvSv2s5NRed9T009ajBKcSqf9KJx4UOY_V9nD411C2byAOGM1FB_ZnHV5KaRVwRUJfRYm6W4hdA2ZVOhFnh98CF7uidul5LLv1gsOoeaxsNe2e4Uwg-y-f2fl7Za-T7QdpCtDUUJjENWYggZCfZTaXJDaGYmMAX8tA8ZGvWu5nyIAHeUFZmqa5z1nqPjmDGzeZ2M_w7yk0KECtDR-FG-1TPXgs-tdUNKlwvAEaGjDCzWToF1Y7VWpQNdP912Bw1Cr7AScDEJXBFWd8Coyrir5upG4us9RjyVRlAzisdfEorSOWDD8nKp4e8HkDDxKfxWcstSkKHIK9GtEFEaVvfpX5Ddqt_NSsq0JBypoIVd49YdVADhPG0te9EXNqms_pu6qG5NXi2aiHZJ8cL5dV4eDF27ws7WS5mQKdceTMG6zL8zmGaMCmJeHtFAxkULvnl_g_OMJb0NPYS0rIzkAF8Rn7Tp89GVBWY-JoQSUL1JLW4cDRgshIPXoHW9JHLuD82gkbuzeI-SCJ8RVEdE5T_zpEYUVx_PDTOZyhGmdapfk54uf4zT6c9FmGShU39rr41Uv4ivqFAa4QmxNym8osWq5jSkqwyMxJc3GooxcluXgJDT8fRipj_ioRNhrd_o8Hk5L2EbsYSOTG-vJ6EjtIoPuny0dZSd-fyakgRIuKhKk_fKuIZTZOMCl65s4lLIYXa5B3FdsDr1PCFzNqzsLOl-UAmv-EV_mYOgEaroAf4hRvehGbuG0QzEieTVf_ATESenJyv7i5BvuRj8qAmxClom1yax9vbuab_9YkukT5pobeAS47Uq52x1RRnScQVw9IS-0joF3a4iMQy-EmFot3xE70HBwTsVSNk5vu3huuqvfIAvrsKQruh994jBTnk-OCSZW5JwLxIpaEsKehaKhv6vQXPfAHGhnwTIfcxG2NIYLDhw4V5yJ1_q1rq9fE59s89s40XFTELoh33f8WWjvsGPbkW7G4xiDrFW0eVjOlLAgJlgHLm3k7tCT9L1pmePYY-wY-W2DQ4ydiKwciUzht52RwDU1DHb3nr8259prbMlLVp8zd8HMSIQ9qIatPOt0gHuoJ8VLavCTBK1fcqKpcPC0ViFXBF3erAYYvzs63-C90t5G_er1-k1WbEruC6yZwaBSbs8PIIeduyYVvFQL8nLIXQUvZebxOyw4qh5LYzaH8Pvh8-5hd0tse8WGPD2tW-Z0ZJf-Pj4I84MrmOGG9v_-8QXSdnBFioJ3yi6b5AtHVi35g5WYFhOHbTHGMGytwlcU6YM29KK7P09CyJ3GTThvf1hZMj1Wda4pCB0FGUx7k_AOo15ZKx_a9XM7OtG-96t__OHy7N_v0rCuKB-AkZf7AjgyyRHCqiYz8yj5MV-vwEJmwCrwECjecBBPDZUggugxyz6VY5yQvqn2gWF33C2WDmqDN_FZN-aJECGvdvhanyeMWOHMeW0rjwfm62tf3KG8e8qOKae49RfvIOX9CB7QvoBwJyeKiCR4LlawZMn4DU1QFkczazUAdYZpPKfyK4ePJV3iYHS6NEX59hMR677seuI5LYEyxVooUg4vLsm4vq6KAlNpSDB6qcRcrYNMa8x9bNKdjRklXA9uVqDik_jSlQEknY-M2_MrlbpZZ-7lvmSsnA_yGd_i54V9NIi_MPC3M_ERixok_KdqNvNZ7x54w76gl-WyE0LMCJT9hGF2qbL4mZmfTU2pW5seT4heRsQP6D8tnILlEf1aYXNzMSH3JPur-6EcMirdDyOW6VscDPNeWIRwkqHrIxN_1YoWSA1cjP1Nwp8ZfICShpuA4U3ouy01R0gRepI_gUH0iinTgeZxstjoKDLqzDQchpGXyJAk8BlY8AW3TEL-U_ZuuP5-BIaFPMUvBI28pgIxDkMtX7Po8HjXLfVmoTl0C-XsO3y1vM2hx4SE2oRliBcAxnP4SPrTpUdLvEDTVwrdvjcm8aUmMb4gEcfos2U37dYlV0tb43VGmvZJgieaAice1SdNHw3y22HDCvjMI65wNa7ZyCdI_GuXYXlu4oVUdPWVmEsTcsBIe0nbdMzSkDNRWfuqqmgjhkLoGu5f4eF6z-OkN39f895LE4ILaxXIXPWIwyQ7kvktFOw1JA-aP2O-GfpwlGaxkzkVsQCDS599Pd3IVH_XkCL_dqDCCZOqCVSSiZGoQauLXCYv1TkwBYCFav1QuS6SAbvxU1X8dEqucwoQ9TRYRmBYc4z0Gcs5QebpgWrramIVNtYQsO7zUuwzacKGqZ5m6IbO7OLRpvuV3WR7gbvYAaqQ-l3N7yulb2EC8DKXJbB5ftJDo5iz93G3IfM9zfS2wCuzoP9M7rrov_bwRTooCiVYLtFQOvY8X4qHRch-b_tGaQSpAB53d5UfZMfi8F_AZP1Qk4DUEwORHPfRDZdGOUpYyrNzN3A_Fk5utxg&cid=CAASJORoEBc9jGGrVkeZqhryycNxFpJBz7B5kh36xP6PupeGNNxSKg&rfl=1%2Chttps%253A%252F%252Fwww.123greetings.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 241
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:16 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame 2315 30 KB
12 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 233
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11819
x-xss-protection: 0
server: cafe
etag: 10563440404697844360
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:24 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 67EA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1

43 B
61 B

38ms
24ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNH7tdEBMAE&v=APEucNVXHWIljw5ahBHYzwjqCiOpDnYeD0f4PPdam-2edxeCGLoKRf6rQrNotrXNoQcr2Ohl08ljGC7jW-qoTrqd6kFgUOv7Efzf8xivtd053QF3r0wT85BdMWPLFVJEx1pmV7qQGf342wupPOp1vvKJ-ADdM8sJpuZaccl58DxsXRRAihN5qf8
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 67EA 43 B
304 B 54ms
16ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNH7tdEBMAE&v=APEucNVXHWIljw5ahBHYzwjqCiOpDnYeD0f4PPdam-2edxeCGLoKRf6rQrNotrXNoQcr2Ohl08ljGC7jW-qoTrqd6kFgUOv7Efzf8xivtd053QF3r0wT85BdMWPLFVJEx1pmV7qQGf342wupPOp1vvKJ-ADdM8sJpuZaccl58DxsXRRAihN5qf8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 67EA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1

23 B
172 B

43ms
42ms

Image
image/gif

23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNH7tdEBMAE&v=APEucNVXHWIljw5ahBHYzwjqCiOpDnYeD0f4PPdam-2edxeCGLoKRf6rQrNotrXNoQcr2Ohl08ljGC7jW-qoTrqd6kFgUOv7Efzf8xivtd053QF3r0wT85BdMWPLFVJEx1pmV7qQGf342wupPOp1vvKJ-ADdM8sJpuZaccl58DxsXRRAihN5qf8
Protocol: H2
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.8 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 24 Aug 2022 21:09:17 GMT
server: akka-http/10.2.8
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 67EA 23 B
172 B 156ms
42ms Image
image/gif 23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNH7tdEBMAE&v=APEucNVXHWIljw5ahBHYzwjqCiOpDnYeD0f4PPdam-2edxeCGLoKRf6rQrNotrXNoQcr2Ohl08ljGC7jW-qoTrqd6kFgUOv7Efzf8xivtd053QF3r0wT85BdMWPLFVJEx1pmV7qQGf342wupPOp1vvKJ-ADdM8sJpuZaccl58DxsXRRAihN5qf8
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.8 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 24 Aug 2022 21:09:17 GMT
server: akka-http/10.2.8
content-length: 23
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame F642
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1

43 B
61 B

31ms
17ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJWG2AEQ0ryZ9AMY6_bW0QEwAQ&v=APEucNVXmeHpKifDgtVDueHIrYJAIdqJeOArrFwiDix5JfNm3vgYk4y1hLKBUX6040kwUQ8wfWkCx74gMgwrqdOIleSIVrB34qedfOGf_TCgYGL__fL6U-TjNj12M9cuGN6u2cDeAkdPoxZl_sMB-Gq38zUklskyYkPfM50B7DJHnFQvwKRTNgo
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDsks6QgablSzCYL2w86ffA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame F642 43 B
120 B 53ms
17ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJWG2AEQ0ryZ9AMY6_bW0QEwAQ&v=APEucNVXmeHpKifDgtVDueHIrYJAIdqJeOArrFwiDix5JfNm3vgYk4y1hLKBUX6040kwUQ8wfWkCx74gMgwrqdOIleSIVrB34qedfOGf_TCgYGL__fL6U-TjNj12M9cuGN6u2cDeAkdPoxZl_sMB-Gq38zUklskyYkPfM50B7DJHnFQvwKRTNgo
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame F642
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1

23 B
172 B

41ms
40ms

Image
image/gif

23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJWG2AEQ0ryZ9AMY6_bW0QEwAQ&v=APEucNVXmeHpKifDgtVDueHIrYJAIdqJeOArrFwiDix5JfNm3vgYk4y1hLKBUX6040kwUQ8wfWkCx74gMgwrqdOIleSIVrB34qedfOGf_TCgYGL__fL6U-TjNj12M9cuGN6u2cDeAkdPoxZl_sMB-Gq38zUklskyYkPfM50B7DJHnFQvwKRTNgo
Protocol: H2
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.8 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 24 Aug 2022 21:09:17 GMT
server: akka-http/10.2.8
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEFj8JoIc0vRFXckYKLIWEt4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame F642 23 B
172 B 168ms
55ms Image
image/gif 23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJWG2AEQ0ryZ9AMY6_bW0QEwAQ&v=APEucNVXmeHpKifDgtVDueHIrYJAIdqJeOArrFwiDix5JfNm3vgYk4y1hLKBUX6040kwUQ8wfWkCx74gMgwrqdOIleSIVrB34qedfOGf_TCgYGL__fL6U-TjNj12M9cuGN6u2cDeAkdPoxZl_sMB-Gq38zUklskyYkPfM50B7DJHnFQvwKRTNgo
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.8 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 24 Aug 2022 21:09:17 GMT
server: akka-http/10.2.8
content-length: 23
content-type: image/gif

GET
H2 200 u_d.html Show response
cdn1.avantisvideo.com/connect/ Frame 8E80 46 KB
17 KB 21ms
11ms Document
text/html 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.avantisvideo.com/connect/u_d.html
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 24374f583eeb0c88723c3cb830828d5798ce87144c8ce4e32076df4786f72848

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 52304
content-encoding: gzip
content-type: text/html
date: Wed, 24 Aug 2022 06:37:34 GMT
etag: W/"f9678e3c391d61d33ed4b6129f75c60e"
last-modified: Wed, 06 Apr 2022 12:25:53 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
x-amz-cf-id: _4hW8l4HnATu2kgE0iTY6Ru5j6fSvr7DfzVIsVBkxo8zsNZAbXtD_A==
x-amz-cf-pop: FRA6-C1
x-amz-version-id: dem0VvOWe0jwgvR1YOcBwtPtUobNlIGA
x-cache: Hit from cloudfront

GET
H2 200 u_d.html Show response
cdn1.avantisvideo.com/connect/ Frame 0B6B 46 KB
17 KB 18ms
8ms Document
text/html 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.avantisvideo.com/connect/u_d.html
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 24374f583eeb0c88723c3cb830828d5798ce87144c8ce4e32076df4786f72848

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 52304
content-encoding: gzip
content-type: text/html
date: Wed, 24 Aug 2022 06:37:34 GMT
etag: W/"f9678e3c391d61d33ed4b6129f75c60e"
last-modified: Wed, 06 Apr 2022 12:25:53 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
x-amz-cf-id: ZYLImDCmbmvIURBcp0eMDhqhk5POENXKzfNxwKdFh2i2Ya5yue-dHA==
x-amz-cf-pop: FRA6-C1
x-amz-version-id: dem0VvOWe0jwgvR1YOcBwtPtUobNlIGA
x-cache: Hit from cloudfront

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D73F 2 KB
2 KB 14ms
11ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:03:14 GMT
x-content-type-options: nosniff
server: cafe
age: 7563
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 25 Aug 2022 19:03:14 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D73F 295 B
325 B 16ms
14ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 05:50:56 GMT
x-content-type-options: nosniff
server: cafe
age: 55101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Thu, 25 Aug 2022 05:50:56 GMT

GET
H3 200 Background_GoogleAd.jpg
tpc.googlesyndication.com/sadbundle/4423286735091748582/ Frame D73F 24 KB
24 KB 16ms
15ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/4423286735091748582/Background_GoogleAd.jpg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13486bde37037de547c6d03d4cd9d8d35a911b25f1dc83341245b3bf12997b8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 22 Aug 2022 18:39:37 GMT
x-content-type-options: nosniff
age: 181780
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24663
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 11:07:04 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 22 Aug 2023 18:39:37 GMT

GET
H3 200 Logo-Wirtschaftsallianz.png
tpc.googlesyndication.com/sadbundle/4423286735091748582/ Frame D73F 2 KB
3 KB 16ms
15ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/4423286735091748582/Logo-Wirtschaftsallianz.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e40f0f6c712e1fee5160f07dd299f0e3597d477098ac926702d43553c8c64b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 22:02:30 GMT
x-content-type-options: nosniff
age: 428807
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2546
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 11:07:04 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 19 Aug 2023 22:02:30 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 96D9 9 KB
3 KB 13ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 25 Aug 2022 09:41:38 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 96D9 26 KB
10 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 16:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 25 Aug 2022 16:14:17 GMT

GET
H3 200 createjs.min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/libs/1.0.0/ Frame 96D9 236 KB
63 KB 19ms
18ms Script
application/x-javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/libs/1.0.0/createjs.min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33be66f63aca50629829ad77a1b1def4d69887f267ec408420286cd0138dd587

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 207775
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64214
x-xss-protection: 0
last-modified: Fri, 22 Apr 2022 12:42:38 GMT
server: sffe
date: Mon, 22 Aug 2022 11:26:22 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 22 Aug 2023 11:26:22 GMT

GET
H3 200 220407_deinenacht_v1_p_ODB_GDN_468x60.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/ Frame 96D9 50 KB
10 KB 12ms
11ms Script
application/x-javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b54c8343995dadbb7020528bcd0bca9287694f0abbbfe982da9bdd16d6d64ad

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 207775
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10090
x-xss-protection: 0
last-modified: Fri, 22 Apr 2022 12:42:38 GMT
server: sffe
date: Mon, 22 Aug 2022 11:26:22 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 22 Aug 2023 11:26:22 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1D12 1 KB
749 B 23ms
7ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 14:32:04 GMT
etag: 48472445140208031
expires: Thu, 25 Aug 2022 14:32:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame FC8F 9 KB
3 KB 20ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 25 Aug 2022 09:41:38 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame FC8F 26 KB
10 KB 26ms
14ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 16:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 25 Aug 2022 16:14:17 GMT

GET
H3 200 createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame FC8F 186 KB
48 KB 46ms
17ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/Eleq_300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49100
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1141311/65046770/ Frame 7226 235 KB
70 KB 71ms
32ms Script
application/javascript 34.254.17.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1141311/65046770/skeleton.js?ias_dspID=3&ias_campId=1008628059&ias_pubId=pub-4627517680249670&ias_chanId=1&ias_placementId=17989214151&bidurl=https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gddbRv07qW-scVQj1K0HkZ
Requested by: Host: www.123greetings.com
URL: https://www.123greetings.com/events/national_waffle_day/being_with_you_makes_me_waffley_happy.html?utm_source=img1&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.17.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-17-167.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: c578b55eeae09926dd782092c3f676412cf65f4d7f156f5d62b4b17307184716

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 7226 106 KB
37 KB 26ms
15ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Origin: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:50:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Aug 2022 07:50:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/ Frame 7226 8 KB
3 KB 24ms
14ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzLMN6wodC2sG5VUY5rHtiZSdCv3ZEOyiddKz_RTQW7-aXpvmZr2qwJAKEBF279DIGmXw8XcWMwHWtY6gPqIdTQA2GFMHpvhytaQHIRB7vyNAAHOO3b85VyuDxuzT3szm0D4fyKaYyw7k1Wv9YoOMmkhNZHg&dbm_d=AKAmf-AViHsttNGYUcwcgCy01GUjQ-BoUBJhzl-YQ2nPl0efXVfX160sZps5-Z5UxDcH-jMJnypfcPTB19_6zBhBm-qipJyl9unzaQNEY-AXKMQwti4rwZnwmxiLnRAvfQcU_n2vjfJGAf30_sh3n0g6SjZQ-ievFGJHJapmQGvAeZy1H_MnM4HZLNihS42NvR06wkrq0IVJ2wz2WM9A9C4flpuKU2QkjMrwbOgCgv3fOI6b51s4kF-el3c3eLhApMrLkerQUgS5MQk2uyDy1G0RSjvYm7MWWHmZigGx-42WiFpDhduiuzB56kXsjEig8FZXk6o4teO1SAayHNmaaBJjkhremJaOFEKM7zdBCCkvTMYHDSMsDHhDbESpSb4NBjXW_YF0EB7PMOn6Ti96ZemtgbNsF4xe4PWUI_k2iXbOG0ZRrXBJbtXOsWAfuZPx1_HdOtwaF1gbWwSAxVwUYkmBE-ybPD6WwDG4HTB3mI5eUmp50Lt_Ydj5z3tSXO_Qc9rABfAnEfMaXyqcAcfiOkiq2LNcoJ6jGo7NpLVdj70q8tKeF8eCjlu7BbkWTLMBsKvo5MWNFUDnFzKhTCgTfPbXzxSEvGCP9XbvfbKyXrrVE0fgsisN_gXK7qkjoddqiAGwi2ka3gsDgvgYMAGvJNETc0a5vHFAInWKBrv5eTg8S69rPbZClutMSNJOONy5dkviailWo2rtodKxmyCyARdjbaz2RIHgBxXIXfHUQwGrYjSXRdPChN0-B-hu2JJLvL26LJtcZrPTtbv_CRHGJuBAByLGe6t4TrF6tUcfVB0DS3M-y101xZciN72cWvDo7klwIzloFvIXB4zXPV-Z36Ns7Z5PxW0E5aLqD_ZfBnlgp2DNT61ZDu0cDb9gjbn4PUSbVYe8ahom_iuvnLkQyOwNvbt_mN8Zx86wKmZAQKCudoofWWXjPUJetOONNeel2XV0Sam9kl3ARHi_KeLT6ls9bDhbaInUbZKJo4lHthYgKl4bB3m-gCQcVieWXvpAZleqgtsBS3K54cxuPBCH5xfJJgZpQ9ko04Bwvh1xmBMr73RfS9zl9bXBA11dGCIiUnp1ShEqIpN0RCG1CJ_xaahDT4U8R6sWLC8RRTTFvjF5y5zPWDcWItS0Dy9TagezRH3vkeAZHc-C2gIQlgapMyIN3qQW6JzEXV5FyBfIjbKl4gUk984Arw04N8LHlFdHC6oETzVYBWaDe043A-zfBBNalCuYrYKgKwO8Gavql6rxkKXJu8NvhKXz-XMgOswSc4G3OGIbys9Lsa9OcXuzrbC4FN2C0sclCUsg2NJQ1UMk-KlaD74dpJCrRVvYPXMo5WSaRKLtW_j0klHHW7mU8jiy6opciz6OYHsCRNKCOghaWlGK5SUaLCBITckji-8uvLWHSPQGfPpHAHQoHdDSq-f_ux805PuoK8lXWa17TJbCBXTlPyS1iqcvwQRo6oJuZJ6NZTnmhlX-5XOBwyxhZf5zfBbEP3qEaRhQQgnnHNCwQSdFaaSVG9onMX4TIux9raFBO9a8KUPuvHsxFPj5DATQCQHgFdfFtBnzGkTDDHbVkMS2W_vUcoMDMFEEdsfUtQc1fAQywXPRoG5BOpazK2HPFpsIgkb-64A_VlkSiBuMYcF3xyWR0PZZf3ZzLQqg3sPXd016Kk4_s1e0jGTDT27tkvDf0dvkUs91PJqT2ASC5T4r6xyFHsiOAq9PcD0-Jpy2PHPgZqV1XKerxfb7pxNT1SlqH9ooEuGQoRZd1ATAQp9QIUkW42eq4wBx60-S4WTIN5xevrqiJICecK7Fqc7RtH9EZy2kQSQPRDYxFZaqjQgpb7U2JrHWkMGDQ15BLD31ky57gV7APjRIn74yFFSL7z1pWKel2z56ny7gQcqG9WMk4WxNUpt77bLzFHsWI-StjgPY_Zs3HK1luB4QLQaQXLJIe8jPpApMVJ4AeoEPBWNOHmgCIGqtGPKuOxjHvk1SKxfeRInnVrr7UuU8uVR-Cd-zXEa4Ehf1DJfn5Z023VVeyo_pNZ5FEcn3Jr39FZglt-7eMd84WC4aNUuovoCV-eYAjlxOMFBq5ft7M9dcqqrI3A1eLnq7bj3FmUTIRSjJWpq55muoSo2z-6SbsoWY4IsO90ZeASGWcb0OQ36Wsry4Q2rdzItw49xdhqrojUgANOqSVPVE4VudlLIywPu2wN-37Amj6CLDgufRpLI6aRMxXlHlUGEkMVOkbLziEsLFqd5q9JZ1aJZmen4P_djWkpuzQAHprIpLLOH32dwi6blvJxjiJpyc7IPreunqfn-tTZNN9j0mUJISxPw__FJTkWJqCBF4Uq-KRl9WUjS8OFna6PuowDLd2XitjQg8SeZaZ_5u52yGDhj30vqGEzXNxaAJo3A4BcLCZPgmmuLSGWue01FdjuyymJcc2k3yHWkx4Gl-hf7uimVh8Lq7y0sTFkRO9FEz4KfOOzfe9JYsw5VInH18s3SPqNyHm-5ZHXnJvB3wRqvk4j-Rg5MWiXF67KRruufLqeeUDtooYQn4QGHpn4e1iZExwUclZHf-wQFUHs8jZcaB-8D6iqjtksDfhhLtXc_CcB_f59Mhbz6YMSKmLsvFTxJkBKtpgbt1I9LTce2wwhJpVmUtgTwMUSP4uZY7702O7tcYZnBBntRuXxT_hAJZGoLc2gO4etBwAJGGJAp8Rcsd4kvfoNpAOlhTVZ0fS-k1GmejRUoA2mTUFpLnfhI8N-bFkqOaT7pSBSuxhjgURszTQ-Pz3Nt4WrFdnTXbDFb6eRklVW8Ogs3LoxFnPjXnnLAhq4qwbOmddpbUttdxNmef-ZKjlVflSIZGjyNRcFnKHAiu0CaOWEf10X_zOmNetczfEz1UrW8elbuhNOE34XWDGBVkPDKEJIwZAC9AkafYHKPQBYPL7ncqf2lhJoPQP1aBmPGgL0La72g4AMQcuXXNnat5eL_ZmEak19z97U14OqWtAz4_3Ld2WG6bD0pHyFoeks87n7jG1RWECtSvvzS3S40bmV3p0xr5pezeOsgwTvZAdYlfbbSZgmHkysQLiAlv4kD6AhHkKXLYpfCwZFJh9qFdPm4tg7CbMp9rXjWmEYPyc4nVaPlUBJxn0Zp26iT0p_36aoevTev0rHuOkRYGH9C2c9knhtcuWYv6hkVAf2mJqtwKL-ctJc0LfdVmgTOmNA6rWKRw89pj6RT_u4gZNI8lUOqRQ8BGSjxeCrus6YdsV29NZDsE_7wPpytXHGt7cXjVvvKeCUyKqFIxaOn6&cid=CAASJORoJtX307u2RCgZn1CfBe729a7GUJ5uAKgO5As4xd0y7E5Emw&rfl=1%2Chttps%253A%252F%252Fwww.123greetings.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 241
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:16 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/ Frame 7226 30 KB
12 KB 21ms
14ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220822/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:05:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 233
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11819
x-xss-protection: 0
server: cafe
etag: 10563440404697844360
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:05:24 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 417E 9 KB
3 KB 18ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 25 Aug 2022 09:41:38 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 417E 26 KB
10 KB 18ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 16:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 25 Aug 2022 16:14:17 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 417E 1 KB
396 B 24ms
19ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:700,400

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b4820095dbb33dffee5026491f08575d5adcb7e3cab956061f0cffb5052d78c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Aug 2022 21:09:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Aug 2022 21:09:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/ Frame 417E 7 KB
7 KB 8ms
7ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/logo.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

645f3114d7724d4edcb038ce63c5587379515238cfa2e334819d1230063df902

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 71041
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7455
x-xss-protection: 0
last-modified: Fri, 12 Aug 2022 14:54:51 GMT
server: sffe
date: Wed, 24 Aug 2022 01:25:16 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Aug 2023 01:25:16 GMT

GET
H3 200 300x250.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/ Frame 417E 79 KB
79 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/300x250.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15554702494583891371/300x250_EN/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1cd5b14882e11f3d2fdb4aba6032814e064c61db98ac5bec88113789ff5c773

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 71041
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81310
x-xss-protection: 0
last-modified: Fri, 12 Aug 2022 14:54:51 GMT
server: sffe
date: Wed, 24 Aug 2022 01:25:16 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Aug 2023 01:25:16 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4293 0
26 B 73ms
47ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 79E8 0
26 B 69ms
45ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 899A 1 KB
749 B 12ms
9ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 14:32:04 GMT
etag: 48472445140208031
expires: Thu, 25 Aug 2022 14:32:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 54EC 143 B
163 B 13ms
9ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3479
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Wed, 24 Aug 2022 20:11:18 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 511C 3 KB
1 KB 15ms
9ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 511C 140 KB
43 KB 60ms
55ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
DATA 200
OK truncated
/ Frame 4293 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6382a5009f2d1613d7c5b239d04fd7dd4ec4c3854c50e47dc7004a5d9f4c71c8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 14BA 143 B
163 B 9ms
8ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3479
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Wed, 24 Aug 2022 20:11:18 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame CA97 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CA97 140 KB
43 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F9FC 143 B
163 B 9ms
8ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3479
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Wed, 24 Aug 2022 20:11:18 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 9698 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/window_focus_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:07:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:07:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9698 140 KB
43 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44049
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661168302676581"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 5DC6
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEK-hhlK_OJBxZBM13jRdZfM&google_cver=1&google_push=AehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA&r...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEK-hhlK_OJBxZBM13jRdZfM&google_cver=1&google_push=AehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA...

43 B
440 B

201ms
190ms

Image
image/gif

2606:4700:4400::6812:230b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEK-hhlK_OJBxZBM13jRdZfM&google_cver=1&google_push=AehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 73ff11733ad8910d-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 980
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 73ff1170af33910d-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEK-hhlK_OJBxZBM13jRdZfM&google_cver=1&google_push=AehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAehlK4BY9_xnumwXjgMm2ZeEHTgwG4OWdp7MGa54ukd6jr8Rvfq2M07u6Z4qHuJEXZydXBIf-AhgSGj_3UKrzOJHquzflNmxZfA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5DC6
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIFo-jDO72qd18O6eGfsFeQ&google_cver=1&google_push=AehlK4CdG8e1opYc2OZkU1AtsrVfEWhToLJze_0tOFtsNg8o5TEo-_fHfv6BGv_XFG_sZAUCJnQC0QTKkXvijiAiPYWtj3m...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4CdG8e1opYc2OZkU1AtsrVfEWhToLJze_0tOFtsNg8o5TEo-_fHfv6BGv_XFG_sZAUCJnQC0QTKkXvijiAiPYWtj3mdX2YJ&google_hm=NzQxMDE2NTkxNjIzNTAxOT...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4CdG8e1opYc2OZkU1AtsrVfEWhToLJze_0tOFtsNg8o5TEo-_fHfv6BGv_XFG_sZAUCJnQC0QTKkXvijiAiPYWtj3mdX2YJ&google_hm=NzQxMDE2NTkxNjIzNTAxOTcwMw%3D%3D

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 24 Aug 2022 21:09:17 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4CdG8e1opYc2OZkU1AtsrVfEWhToLJze_0tOFtsNg8o5TEo-_fHfv6BGv_XFG_sZAUCJnQC0QTKkXvijiAiPYWtj3mdX2YJ&google_hm=NzQxMDE2NTkxNjIzNTAxOTcwMw%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5DC6
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pqP86pw...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pq...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pqP86...

170 B
188 B

19ms
19ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pqP86pwDwNAzLWizFRiXS6Af5OU

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4DCEu_qGcJBZfYuzJMDThVPzqFKguDqCasJHlEfcRssb2Nz7oEkLUp38o7GwH7lnc8y6pqP86pwDwNAzLWizFRiXS6Af5OU
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5DC6
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEL4R9wXI2EtWoej5bETECXk&google_cver=1&google_push=AehlK4CNTx-UeSp7m1zW5-5uNIBgJFJ9JqHiNZ_owzF5z7nOWv8RKWf13F2F47GjRYz6kxuwoZw...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRN0stMVAtMkFLTg==&google_push=AehlK4CNTx-UeSp7m1zW5-5uNIBgJFJ9JqHiNZ_owzF5z7nOWv8RKWf13F2F47GjRYz6kxuwoZwIg0TckrndGp-mKCmuyu97GNzr

170 B
188 B

19ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRN0stMVAtMkFLTg==&google_push=AehlK4CNTx-UeSp7m1zW5-5uNIBgJFJ9JqHiNZ_owzF5z7nOWv8RKWf13F2F47GjRYz6kxuwoZwIg0TckrndGp-mKCmuyu97GNzr

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRN0stMVAtMkFLTg==&google_push=AehlK4CNTx-UeSp7m1zW5-5uNIBgJFJ9JqHiNZ_owzF5z7nOWv8RKWf13F2F47GjRYz6kxuwoZwIg0TckrndGp-mKCmuyu97GNzr
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5DC6
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEAKtXDy9ffxOsfj4HvcADG8&google_cver=1&google_push=AehlK4AfLX6ns1gQPMDZNx5QJFm8CCrJ_ePqjWYoNLYcpAKNjKHBtuJcZ_e7cWigRITecIxsZh2rsDB_wVTu...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AehlK4AfLX6ns1gQPMDZNx5QJFm8CCrJ_ePqjWYoNLYcpAKNjKHBtuJcZ_e7cWigRITecIxsZh2rsDB_wVTuCDJER8Z-IHsBSEek

170 B
188 B

20ms
20ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AehlK4AfLX6ns1gQPMDZNx5QJFm8CCrJ_ePqjWYoNLYcpAKNjKHBtuJcZ_e7cWigRITecIxsZh2rsDB_wVTuCDJER8Z-IHsBSEek

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AehlK4AfLX6ns1gQPMDZNx5QJFm8CCrJ_ePqjWYoNLYcpAKNjKHBtuJcZ_e7cWigRITecIxsZh2rsDB_wVTuCDJER8Z-IHsBSEek
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 5DC6 0
75 B 315ms
21ms Image
text/plain 185.86.139.94
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEP9mcFEAe3EeZ9_AxAEgV4s&google_cver=1&google_push=AehlK4DW9kVKvrAU8g0egKJZtu9Ejl3NYdYlq0Pkcli1DvH5fj26Thrzc-4fT4WfwkxbtC8HfPr00OivmS4IwBUiTLEFMQInQuw
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.94 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-length: 0

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 5DC6 43 B
65 B 20ms
16ms Image
image/gif 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEAiCW7BVUhdCX10ClU4zRW4&google_cver=1&google_push=AehlK4Cetvlyxs9Pixn9BP9ZAm2nfjVrXKx6W8NaFqhE6IZcwVWQ3_n-9WxHOKVq8yvDIBxQe6jSEbwVKAdvITBQCPSUk7-MU_-O

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Aug 2022 21:09:17 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5DC6 0
12 B 19ms
16ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JI4L_oZMdFMAJL6eUeEe2smYpwK6WPbfzJhIo7rn_3Eou6-C-mcx0gq9UUsa8Zao946gStIQ

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 79E8 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0fe5f0a7225b1396ee1ac5ca2ead3bbb66f4cd4dd09b7e5f1ea49fc1668af9e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 788C 2 KB
1 KB 167ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YwaTewAMhCQH_ZKbAAwEskkWxLYgKefFm_wKWw&u=%7CIONJyjsMzQ7cJ4645g06%2BSk73yDFMajVImWv%2BtGARNo%3D%7C&c1=VEd5MTeK-DVtvwpxQwkatQ5fNcsqqVzrn0bJRZSWEljoMqTy8nHmy-ZCx2l8r38z-Y5KeOqAmeGKc9dh3PNWVQn404KTD77vBGTZgYRjMPz_4aEs-vs_puyZCUHkvYKSVwTCnzCDODg6XLOk626p9iBtC1r959XS3Hg7uD7iAHvZB6OzfWHBbUfUeSHrmM3ONdl8KMIlWYpjAHABIF5kpJfapFeADPxXb1pDl3KIzh1aScSWn1eMeBFjJ0knhSj7lKSmWQBU9pj2OUugSgGyh4-zC5bPwt_OgYoR7kFxfzNxBIofigG1RyNTmQQbidtTSklo2E3Bs-1BjCvsj5a0uxnYYPT-5h-t5uKVBseTmCyXjwRgm6xnoiqYzuHDraoSjp2r9ygujrslXLh9K5mFGKYJOnnwLS00f6wbiCle2lpOLFGtnq72DgfIqWEpKomrikzmNmLtZdlH28pIUixLiUM7-2lHcnBprIZ1Mq8KkZ0&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfFcqe5MGY6SIMpul9u8PsomwmAbJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ2Mjc1MTc2ODAyNDk2NzCgAdW20uoDyAEJqQLvqpI6m8SwPuACAKgDAaoEtgJP0H4Gn8AGHt7CZ_CqcRsrrRUJ8Co3WhuPP4yDAuGVtWejo3UqD9B7QIAtm6UZQqyuZ4WP2Aiu7gHroATtCBJpCwJVWOYbh8qj73xhWbic_QHURG_CNBNHrlA-7AjjagpKd1x-JLUx7UZRPAtY1x5g2tpleUnIVNMzus9CYWyqinA1B-K3Z08YIKD1mtJzn6roZHfK1JP-H2DIXgUdOywPzcNQoDQqE7KDnmK9kMLYql8_Zc0hHZ9T5nRythLIGFbuAAD9-B7EVji2jL4PK3mBIQHmisbK_PspL8r__SCh2GvMeuNr14jn81l9fJ39wTssfYgNS1NmEsGNFI2ECYzqROPIluHXI2ruCAlFvyYukqOUxKdVXMEe6DX_Eemxrh6lNJF7MghCxB7uW-dY10wbakNrKSat4AQBgAaLvozdwK6T2toBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2zD1xNWfm405kdZ8fBYDLdhPfXJQ%26client%3Dca-pub-4627517680249670%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Aug 2023 21:09:17 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 788C 2 KB
1 KB 165ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Aug 2023 21:09:17 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 788C 308 B
636 B 51ms
19ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 19 Aug 2023 21:09:17 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 788C 293 B
621 B 50ms
18ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 19 Aug 2023 21:09:17 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 788C 43 B
348 B 128ms
17ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=ONXTEfH_dNFOQcwVwoTGj-AZ128S6AoJ76Llr4B-U4In4LowgtB4sn-ND_LF-PZDSxX1nzNm0Li4_Nc4Re-IyLYM3wmlOPRn9C3CdTLVoaI16K7YJn_On2aYaRWZQ4cnXQKj2pITe_0xE93SYTBwQV3EzW0h-HGBiDYxFfLFqn33fweQn7ue39scr2hG89gKTV75uMFGpwNXIZxuYFwuFpEi3rmpuJGv5KxsdteoZ6YuKqLi45-qql-S0uY7JHHnSAvOt0Ek8LDeFAX_Vu6MgDiLiGrPyfIKSOX4KLnDVru1IKVE7KK3Dpttx15gzXBRU2GPKop-hHCkWRrS4RaEGYJuvOhLeVmMXkWX3dim2FSDisBEps7CqF4vXf9dkFJFya-MwZ9N2rpsBMrvWaA2YbfasIms3TLju7-ers6T-QMCRT3i

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3168485
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B520 22 KB
8 KB 9ms
8ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 28862
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 13:08:15 GMT
expires: Thu, 24 Aug 2023 13:08:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 66A1 22 KB
8 KB 9ms
7ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 28862
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 13:08:15 GMT
expires: Thu, 24 Aug 2023 13:08:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A867 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 25865b28d8300f5c86ba998f59742a08ae08af54a3cfafc046f8089e009eb046

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 geoip Show response
avm.avantisvideo.com/api/v1/ Frame 0B6B 175 B
930 B 151ms
150ms XHR
application/json 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Requested by

Host: cdn1.avantisvideo.com
URL: https://cdn1.avantisvideo.com/connect/u_d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

31b6019da0be3ec6fb6d130582695015635ba2ac5316b1b6528b53fc779d327d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cdn1.avantisvideo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
vary: Origin
content-length: 175
x-xss-protection: 0
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
date: Wed, 24 Aug 2022 21:09:17 GMT
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cdn1.avantisvideo.com
access-control-allow-credentials: true
x-amz-cf-id: 0wKC9HD-OF24PgKU6pKHkw9vffWNXYLXK3OiiJbLWPy1skATiawzgg==

OPTIONS
H2 204 geoip
avm.avantisvideo.com/api/v1/ Frame 0
0 172ms
150ms Preflight 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://cdn1.avantisvideo.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://cdn1.avantisvideo.com
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Wed, 24 Aug 2022 21:09:17 GMT
expect-ct: max-age=0
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-amz-cf-id: 5S1-3cqzAh__HH_KexGQRSFAS7naphI_nOguCGrPzpqJHd6zRP5v5A==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

GET
H2 200 geoip Show response
avm.avantisvideo.com/api/v1/ Frame 8E80 175 B
930 B 152ms
151ms XHR
application/json 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Requested by

Host: cdn1.avantisvideo.com
URL: https://cdn1.avantisvideo.com/connect/u_d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

31b6019da0be3ec6fb6d130582695015635ba2ac5316b1b6528b53fc779d327d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cdn1.avantisvideo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
vary: Origin
content-length: 175
x-xss-protection: 0
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
date: Wed, 24 Aug 2022 21:09:17 GMT
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cdn1.avantisvideo.com
access-control-allow-credentials: true
x-amz-cf-id: VGUFpZzXPxHRF8tt3q5ARmmZ9ONkK_dg50PVc_P2SbYl6My9zw-6Qw==

OPTIONS
H2 204 geoip
avm.avantisvideo.com/api/v1/ Frame 0
0 168ms
150ms Preflight 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://cdn1.avantisvideo.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://cdn1.avantisvideo.com
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Wed, 24 Aug 2022 21:09:17 GMT
expect-ct: max-age=0
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-amz-cf-id: tZmgK15HmDHYuZjocClN0oMcRzU9l3AkcHkPsbi7-07HmuNUXzj5bg==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 48 KB
48 KB 59ms
59ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478444
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 7226
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1141311/65046770/4.js?ias_dspID=3&ias_campId=1008628059&ias_pubId=pub-4627517680249670&ias_chanId=1&ias_placementId=17989214151&bidurl=https://www.123greetings...
https://static.adsafeprotected.com/4.js

1 KB
1 KB

8ms
8ms

Script
application/javascript

2600:9000:223f:6600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:223f:6600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 22 Aug 2022 09:42:56 GMT
content-encoding: gzip
age: 213982
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 22 Aug 2022 09:42:51 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
x-amz-version-id: 2V7Ev0h1pYaSOwq2q1CGzR0zwlYXy7sH
via: 1.1 cf2071a2896a4f71dbfdbc521d554362.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA56-P5
content-type: application/javascript
x-amz-cf-id: vd8XYr3595QusSMti2CBknAcu5rM7AeJ9Q2TBKnDAERrDxMd7bvGVg==

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
x-server-name: app11.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 93F6 80 KB
21 KB 26ms
8ms Script
application/javascript 2600:9000:223f:6600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:6600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 16 May 2022 08:34:34 GMT
content-encoding: gzip
age: 8685284
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 cf2071a2896a4f71dbfdbc521d554362.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-P5
content-type: application/javascript
x-amz-cf-id: 2A1cwH1mbMP9oMgG5TvzK5yVr3cnSNTqNZhMktk_sySAhy8HxDT_9A==

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 2315
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1141311/65046779/4.js?ias_dspID=3&ias_campId=1008628059&ias_pubId=pub-4627517680249670&ias_chanId=1&ias_placementId=17989214151&bidurl=https://www.123greetings...
https://static.adsafeprotected.com/4.js

1 KB
1 KB

8ms
8ms

Script
application/javascript

2600:9000:223f:6600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:223f:6600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 22 Aug 2022 09:42:56 GMT
content-encoding: gzip
age: 213982
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 22 Aug 2022 09:42:51 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
x-amz-version-id: 2V7Ev0h1pYaSOwq2q1CGzR0zwlYXy7sH
via: 1.1 cf2071a2896a4f71dbfdbc521d554362.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA56-P5
content-type: application/javascript
x-amz-cf-id: Aqb__Y3zAgc3pWw_8Q5aAqX04riofkTZ-7l6knjqpK9_ODz-OrG01w==

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
x-server-name: app01.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 2E61 80 KB
21 KB 8ms
8ms Script
application/javascript 2600:9000:223f:6600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:6600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 16 May 2022 08:34:34 GMT
content-encoding: gzip
age: 8685284
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 cf2071a2896a4f71dbfdbc521d554362.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-P5
content-type: application/javascript
x-amz-cf-id: 1idPKjLyi8_PLXQQ8ybDPOqTxa3f_7jTAEuWBZq5i8HYFysgpvmLWQ==

GET
H3 200 bett2_468x60.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/images/ Frame 96D9 10 KB
10 KB 19ms
19ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2308844050242602212/images/bett2_468x60.jpg

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d811a4d5d35ec8ca928a06493c58f91f92756f2415b818bfb864526426a08588

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 595264
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10251
x-xss-protection: 0
last-modified: Fri, 22 Apr 2022 12:42:38 GMT
server: sffe
date: Wed, 17 Aug 2022 23:48:13 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Aug 2023 23:48:13 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 1D12 35 B
463 B 54ms
9ms Image
image/gif 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECcDExv9qK6bozjarfeGR1k&google_cver=1&google_push=AehlK4AlXKUVN7Bu_7JfsGhQDxkK5hV5CeIXv21Ci1pRnx8WFX3WqgXiXdcKtX4iUUKB8Amehhytr-4m9n267holDR6tIzsCM4Q

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 1D12 43 B
351 B 100ms
18ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPtC2f1lXGr-lf8-wDGoScQ&google_cver=1&google_push=AehlK4Dt4ldC7vF7FEQAWjNl7tKwcB_yhkqCKNb2oGCBbCObJdeYomCugHD5J6QgzaYWHA09HUMwSViwBeueemo19ZCbTqZSd5U
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 4mjjn31k9t9gbmmj3uv8rb2iost22ooq

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 1D12 0
166 B 57ms
12ms Image
text/html 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEDFqCloZPK8KMczdeec1lAU&google_cver=1&google_push=AehlK4AYMD9tO2WbBteQt-dneB80Yc8X6hO9NNHCG5iO2Ss4QsuJhlQg0wbJl4HGrzqHkP29NQDbwobr0nMESuwFYbz-qZjhNbOL
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1D12
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEL4R9wXI2EtWoej5bETECXk&google_cver=1&google_push=AehlK4D7hPlGa0M4-JPRDssVeQUbXLbTqeRN3fdhTHyz9t4ltWINGVa6xPejoOtKJM9zmJIEYSE...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRRlgtMVMtQzRIRg==&google_push=AehlK4D7hPlGa0M4-JPRDssVeQUbXLbTqeRN3fdhTHyz9t4ltWINGVa6xPejoOtKJM9zmJIEYSEbAnOt8BDxOfZf2WprL9hyveTf

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRRlgtMVMtQzRIRg==&google_push=AehlK4D7hPlGa0M4-JPRDssVeQUbXLbTqeRN3fdhTHyz9t4ltWINGVa6xPejoOtKJM9zmJIEYSEbAnOt8BDxOfZf2WprL9hyveTf

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDc4M1pRRlgtMVMtQzRIRg==&google_push=AehlK4D7hPlGa0M4-JPRDssVeQUbXLbTqeRN3fdhTHyz9t4ltWINGVa6xPejoOtKJM9zmJIEYSEbAnOt8BDxOfZf2WprL9hyveTf
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1D12
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DEde1SMH7MWt_ynnmMlZx3u5qZib28Z...

170 B
188 B

25ms
24ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DEde1SMH7MWt_ynnmMlZx3u5qZib28ZMWK6FRwxG1UN1SaU0M8iUVueFyJP3G26haB5zh-vtyOfe8NoqLCR-M_FAIDOCev

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rsf6KV9KaGyuH1DkP3dVa0nMv06LoB1JCP5LMLObSkVPCXF1CYKc0FmeZMsnHNGbiPqnVI45UNNoXM%2Bigc8aGaMYaAtTmvDKv0jbFZOEcc%2BkmZZOXf79wDnrTBJQnAGYTrDbOnsQax0Mzw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DEde1SMH7MWt_ynnmMlZx3u5qZib28ZMWK6FRwxG1UN1SaU0M8iUVueFyJP3G26haB5zh-vtyOfe8NoqLCR-M_FAIDOCev
cache-control: no-cache
cf-ray: 73ff1172d90b9950-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 trk
ag.innovid.com/ Frame 1D12 43 B
296 B 259ms
26ms Image
image/gif 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEG_uNAr1tXLiVx_Q3mewloc&google_cver=1&google_push=AehlK4DoZOkH0-9ZLP4t5gun6k8NWlYH7MvHbK5j8i4mcbCUvYP2DdzJ-ejgxQOPg0U8D6VlxWJ0pn0WvgK0XDfdswLKMzfMmoE
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET googleredir
googlecm.hit.gemius.pl/ Frame 1D12 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1D12 0
12 B 23ms
21ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JWz8UKaP-LtBN6VRp3au75abJ6d7h6h3BswwWO45w264bp7g8Xwv9ijwoTm4QdrLe65umjyQ

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 c1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/ Frame FC8F 22 KB
22 KB 12ms
11ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/c1.png

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2efc0670c8661b4d73ab1a09dc1767e7904ad6ce7312552ebc30f6b80e9825b5

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 150421
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22055
x-xss-protection: 0
last-modified: Fri, 02 Aug 2019 06:46:58 GMT
server: sffe
date: Tue, 23 Aug 2022 03:22:16 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 23 Aug 2023 03:22:16 GMT

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ Frame 417E 23 KB
23 KB 32ms
9ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:700,400

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 17:07:14 GMT
x-content-type-options: nosniff
age: 100923
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Aug 2023 17:07:14 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2315 41 KB
15 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 11:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Aug 2023 11:23:17 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5348 1 KB
749 B 20ms
10ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 14:32:04 GMT
etag: 48472445140208031
expires: Thu, 25 Aug 2022 14:32:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6092393553986610343/ Frame 0A85 13 KB
3 KB 15ms
13ms Document
text/html 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4e791ca4ccfdf6fffd9961ea63b4b7e6faa1a364fd6b55eb8b091d8b25992d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 42902
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3137
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 09:14:15 GMT
expires: Thu, 24 Aug 2023 09:14:15 GMT
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2315 0
27 B 55ms
54ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssbkMF1vbEKbfWua-uu3ndipE-7w3mEES5ktSR8tPnSMpJA-OSMHZDUzLJk5KzM1MGzFkylIyLD2J5cKyLD23O56WzQ068MU1XYEXF8-DRRJtzRf_ojK6qS5FOxMXbsrUP7n42IBLbciNLTB61RgTuf9QpkAnEUhlsx9UDrFNRmONOCSrvfabASHZDWoWRIFlrT1yPnhpsr4di28s2gpZrk29vNbuoQrIKtU2I9iHXLBSgRURhX_34YoSk3KzTnJ5da61fXEJ0p2SU0S99xSHQ5RJA75KWHHqo4Yd-p4KJX9RL2VxQSO9VckCGn6LQD6-XMxE2WWyh8MbEl34udBBpKN_is3NnuOzpHrNAc54rmdyUktPJ3v4cMoCq3hpJpJ2I1ZqMYwvalAJkFo6k81NlHbHGkNCmubaNWqRAyrlvYi7JPOAefxauduD_gf87RXe39BPvLc_ycYAN6Fdc9162TkO_ktsyyRFlTWC0-9hKKr-4wFKpxwCCP9M1AqXiJjNXc9w5Ocb0g0ryUcSnNlRiej2SBGBM7IgLB5DiDNWBi2wyO2Bf4M9C7kjbv5zWhTU_-tLgVpwG3hwjJXkCdjI6vlK-9Z_Aq69iOQEKKDMJgsllrUg44DJ3wBDw31Jc0gGsm2rJox5Cm818PNxBhTnuewJaly89Yjf6M1JO6TqgdZlvt9BOrSfmelJD_lLOcwi8XujNLGU1it6sM_Z-Qio6QNW-EG-_4ee6rCs-NrBS36e1Y4bB_2alyTXx1-HeM_Ni4oTp4ESZma7Cq9qwu0Es_5XYYYYPYe9Tpde1CM5lhNS6Ega-Y_IgZJ37j5fvZ528lM_7P0-z270wE3ZlYz78Gyk2Ku0TbCKf36fAWIx4bBErZNHKiVJ0tB6nRfqrA9Nvggj0KCPvi_sEQbrTbn10MxYxRzNPnF3twFfs8ghklKTc4haChihbOtR_2Bi_6L3uUZ5dBzkoo2WPgXX4TkpR6hAcQTA7Ltxi87FKeyu2M7hIYTsQN5eVvoX4qz23V_gf8Su5lntyJi-2usKDW8ykcZC-YLk3_mJ3PN5KnwH-HaoNSUQf61d0dWzxON7l9YMBNnU_MGDeOvRt138M6hqZaHSNEodk03OGgbWN0M7IAPaIgRv8mp7Zhyxw-M567EPTOMCbZaCSVA1Nbigc79VBbMUAcZTf5f2gOIxQML8taAaoF5uNNetLQtA&sai=AMfl-YQEtKUonHnGDv5YR_81rezOUYZBFt2RgMzEqAWZ41HflP5OxTkH8sVO0OOH6NekMZ0D7-v-v6qlbx69OsfgeyFKhEi17g9CLnr-mtO5DhYhtodnU1dxDZxh23uSnRzmXtbD7j3-NQB0WzedZWjS5Z0v3tAyEwTsTW7Mj20RFQWh8JEfOXx4uIcmT6wYX5rNKuRhrT0ZRdPc3oj-Gg3nvw&sig=Cg0ArKJSzAjCV7M6Lav7EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=674&cbvp=1&cstd=671&cisv=r20220822.65685&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 24 Aug 2022 21:09:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 899A
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEPGRNJlanIV1MGiff8G4DS8&google_cver=1&google_push=AehlK4DY_G_5I8IxcW7kNMVMfe_vE3zvTvuGkWiGVGijS5qTB40wH9vNUTrQd8SZnK21qBq1lt82cXxsSJHA5d0i52xUaOqn190K
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ0NTkzNzI3MDk3MjI3ODQ5Nw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPGRNJlanIV1MGiff8G4DS8&google_cver=1

43 B
398 B

210ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPGRNJlanIV1MGiff8G4DS8&google_cver=1
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPGRNJlanIV1MGiff8G4DS8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899A
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESECztc-uTX6X0_AA-MID2_z8&google_cver=1&google_push=AehlK4C5Cnk0XzkrM0sovq_DZCvTTrwICxMESo15ICMWUXo4C2hp4J6g4zUX4aKdMlaitxCC1KqhiMm5SrwKqPek...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4C5Cnk0XzkrM0sovq_DZCvTTrwICxMESo15ICMWUXo4C2hp4J6g4zUX4aKdMlaitxCC1KqhiMm5SrwKqPekAFauNKevegJG

170 B
188 B

27ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4C5Cnk0XzkrM0sovq_DZCvTTrwICxMESo15ICMWUXo4C2hp4J6g4zUX4aKdMlaitxCC1KqhiMm5SrwKqPekAFauNKevegJG

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 24 Aug 2022 21:09:17 GMT
Server: MT3 4494 7cf1da7 master zrh-pixel-x25 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4C5Cnk0XzkrM0sovq_DZCvTTrwICxMESo15ICMWUXo4C2hp4J6g4zUX4aKdMlaitxCC1KqhiMm5SrwKqPekAFauNKevegJG
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 24 Aug 2022 21:09:16 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 899A 0
173 B 76ms
15ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEJHj5F5zKeOCCSjBFM68aWE&google_cver=1&google_push=AehlK4BYyFMimqEUpKyM2ZmU8gogeM0uG7KemKHIbwkJR_BxbRYsBZwjlkclUZGquGNSxZBccJCKp8Fz2aXbzO14fN9diODG0HGg
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899A
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEIR46vHE2DcF5HLMpjZ_M7o&google_cver=1&google_push=AehlK4DdrL2w06E2v3tyM6WyZoCnvoH0H3l7d3_6EOAnhElOx2jpdniLS7iFsxH08-_26bULwMI4P1zEJvOu4Y...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzEzNTU1MjgyNDcxNjU1NjQzMQ%3D%3D&google_push=AehlK4DdrL2w06E2v3tyM6WyZoCnvoH0H3l7d3_6EOAnhElOx2jpdniLS7iFsxH08-_26bULwMI4P1zEJvOu4YjB74...

170 B
188 B

31ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzEzNTU1MjgyNDcxNjU1NjQzMQ%3D%3D&google_push=AehlK4DdrL2w06E2v3tyM6WyZoCnvoH0H3l7d3_6EOAnhElOx2jpdniLS7iFsxH08-_26bULwMI4P1zEJvOu4YjB74TXKNozf9Y

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzEzNTU1MjgyNDcxNjU1NjQzMQ%3D%3D&google_push=AehlK4DdrL2w06E2v3tyM6WyZoCnvoH0H3l7d3_6EOAnhElOx2jpdniLS7iFsxH08-_26bULwMI4P1zEJvOu4YjB74TXKNozf9Y
Date: Wed, 24 Aug 2022 21:09:17 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899A
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4BJvpE-m3rCG-48kWuwAl5e42Rc8MeRYwG-JMrg0xtwwXYngTukqjSW5Uwh9AvzSG4mzFn38esE...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4BJvpE-m3rCG-48kWuwAl5e42Rc8MeRYwG-JMrg0xtwwXYngTukqjSW5Uwh9AvzSG4mzFn38e...

170 B
188 B

20ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4BJvpE-m3rCG-48kWuwAl5e42Rc8MeRYwG-JMrg0xtwwXYngTukqjSW5Uwh9AvzSG4mzFn38esEH5iVHFSLFzbjMlxPgyoD

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:17 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4BJvpE-m3rCG-48kWuwAl5e42Rc8MeRYwG-JMrg0xtwwXYngTukqjSW5Uwh9AvzSG4mzFn38esEH5iVHFSLFzbjMlxPgyoD
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899A
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFyjv75Z8taZcXZ8J_SavFE&google_cver=1&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86aVva9oer1siCaNqqL_hJbvr4-17OBViWULNEBgUV6rlx
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86aVva9oer1siCaNqqL_hJbvr4-17OBViWULNEBgUV6rl...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86...

170 B
188 B

27ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86aVva9oer1siCaNqqL_hJbvr4-17OBViWULNEBgUV6rlx

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4D3vcwXeQCdoHlfxJOs2nFP3Uxc41qKvqgLAV8GtA9pbAc6us86aVva9oer1siCaNqqL_hJbvr4-17OBViWULNEBgUV6rlx
date: Wed, 24 Aug 2022 21:09:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899A
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEKEuyiGDc2W6nAgwKdeULKw&google_cver=1&google_push=AehlK4Dq81GpIgigb_WrV9cG3o3yr0S7sNZxGe4prr-e4fRr344XSjty2Pkew_1VpZGF9cEJfu...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Wb3BobmVaRTJ1R0Nud3R4RTM2YVdjNGdobXZXSmZLen5B&google_push=AehlK4Dq81GpIgigb_WrV9cG3o3yr0S7sNZxGe4prr-e4fRr344XSjty2...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Wb3BobmVaRTJ1R0Nud3R4RTM2YVdjNGdobXZXSmZLen5B&google_push=AehlK4Dq81GpIgigb_WrV9cG3o3yr0S7sNZxGe4prr-e4fRr344XSjty2Pkew_1VpZGF9cEJfuy_k_l3W7S55LV4B-0PnmyNzPbu

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Wb3BobmVaRTJ1R0Nud3R4RTM2YVdjNGdobXZXSmZLen5B&google_push=AehlK4Dq81GpIgigb_WrV9cG3o3yr0S7sNZxGe4prr-e4fRr344XSjty2Pkew_1VpZGF9cEJfuy_k_l3W7S55LV4B-0PnmyNzPbu
date: Wed, 24 Aug 2022 21:09:17 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 899A 0
12 B 26ms
16ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L46dAFS1LVBcMd_yQd-ZZ3gxxKIPOJaKFB5nQeVn12k4xkt42vT33IB69y9tGSP71JKwN_Rg

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 2315 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b88b2f1daf7a6b9f69e1b505ff6eaa2700f6220a1f8702d40c87d0ed4010bd97

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7226 43 B
215 B 350ms
94ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=da6541a0-7316-3f96-b625-2eb5f24be1cd&tv=%7Bc:mff44Q,pingTime:-3,time:231,type:v,im:%7BpBlk:50%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:26%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:231,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B224~0%5D,as:%5B224~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h*.1141311-65046770%7C1h1%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1h*,rmeas:1,rend:0,renddet:svg.us%7D&br=c
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7226 43 B
215 B 432ms
180ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=da6541a0-7316-3f96-b625-2eb5f24be1cd&tv=%7Bc:mff44S,pingTime:-6,time:233,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:233,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B226~0%5D,as:%5B226~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h*.1141311-65046770%7C1h1%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1h*,rmeas:1,rend:0,renddet:svg.us%7D&tpiLookup=ao:www.123greetings.com*&br=c
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2315 43 B
216 B 321ms
92ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=79e680a6-b2cc-df4f-f367-c2be50febad2&tv=%7Bc:mff45i,pingTime:-3,time:204,type:v,im:%7BpBlk:47%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:23%7D,%7Br:r,w:728,h:90,t:203%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:204,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B198~0%5D,as:%5B197~0.0,1~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e*.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h.1141311-65046770%7C1h1%7C1h2%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1e*,rmeas:1,rend:0,renddet:svg.us%7D&br=c
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2315 43 B
215 B 319ms
95ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=79e680a6-b2cc-df4f-f367-c2be50febad2&tv=%7Bc:mff45k,pingTime:-6,time:206,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:206,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B200~0%5D,as:%5B197~0.0,3~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e*.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h.1141311-65046770%7C1h1%7C1h2%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1e*,rmeas:1,rend:0,renddet:svg.us%7D&tpiLookup=ao:www.123greetings.com*&br=c
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7226 41 KB
15 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 11:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Aug 2023 11:23:17 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 06AD 1 KB
749 B 10ms
10ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 14:32:04 GMT
etag: 48472445140208031
expires: Thu, 25 Aug 2022 14:32:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/346351590727387842/ Frame FB5E 13 KB
3 KB 11ms
9ms Document
text/html 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39f066d84bc1d1bb9d217e769b3812732a12c3ff611fa0e2a22ae6c81a30f445

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 42913
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3147
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 09:14:05 GMT
expires: Thu, 24 Aug 2023 09:14:05 GMT
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7226 0
27 B 58ms
54ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssGD8uZiH6lZq0ufI1Hsv_ll-L_OtNyY6HKKmeEDrBODe2clHHWOsi1_ctaHmVfZhanO4uQ3K-dqGSRtE9o8TqzFBAnl2Xe4rhWYGyQSdeFQB6qvhMDVbAvRsZ-Edlu4Sm9-hru9IpD2T57648Q464hgvl3JAuwZo761uA8P4ntNSS2-1917LIiSQK_w1I8DTVTnNiK8Mw--ZInNYxYcaedVnXbHAS1Tauoimg_4taEMR0mcyyG7u8lgkABTFe5M-wSeAQwtV9m0b8AvJ35xw-WeyOxpXhZtCbrBu-hL-YLVBJC4A2EEox8Fxs0DSoKaJ-85Hkt1y2ikoeEi312I13V9XN5pmRa5x7zgUoqg0sVDmI2Sju3h_t1JogX0fpa5ztmaky6_RfOreRsW7-m9uYgQdvbsg3ZoHx8cpwJvES1kmAGL7HWZkM5DfMhKR-CzHXy0WlWSOpmHpOnegv8bsjegR-_mL0bee-i8sG43yu1yVK1zyoHU-ThFLde7ILzsS7dM6rKu_gI35wPQIV_FzaDlrl2iPQqnRBU-75kH6wRgorqFCU_FpMCYY31HtXKWypLD8vH0HWOYo9eiNyvyVKXbVHZnEJo_r04gU_K2nB1WsL8cvhkwKpr0XjKheBJTo4idspZjGp_jdpO8pwioDgKe-rnT37670nD_6JDR0pX99y1uzMYpVruT6hami9izZUkTtBZij7XE8iU8yaJQb-ZtiwhmUVVvq8LacoC8zFCWBb-GruXtsoYY5lfku7UPYoEbicHMQ4KBy3qEJNqRir2SX17vDOWG_eK6N3J8S2OenKT6w8esPEUpYAjb2ym7kxJ7FGXSrK76q2MPSvyvWEuv7srbH1v_HUSOqpv0B1rO5hl76RxVWEFiDIfWyYCBrHhYW16__DyEFgHguvJ6TdnYHHg7Pevyse3brX1mrvmu8DWyH11JrhvRknVVi5SYWBOAH2aFhTlNZuqPrqqhy4zs9XM-aKAkA6xbj7CnuCgdFQdis5jiL0SV5TWsbn0fnOoPYKzdJUMKStt4BzbGImii8R0smL9GWcneNHrq-3FylJXBt5s5Lo47vvbw_5e2lm9FOc5Nu78Xp2Th6peJ_JsjP_isFqh5pSGsYByU3CYRNiXrXvUL7pcb-cwdSBnzGr2w7_yVfkr7gxVeRlpC8ia1-WAWRxWZz3USvUcOtaefM9HIaWYPRmhCMpvY1idz1KhxS4&sai=AMfl-YQeaVno8VoEp4VczOBf1CYgPwDUT5aSVQiSPaUInZJr0y5uNrND347yENYrFO0tNbpHd3TQK1CVRfkOag_EzY2fqrIIb0zX7bDyE4UN396Gd9c_uJ5BO9b3vgY27vsNA9SQT_hd-QFi6KgsmRNYqmeeQuoIYYvoMNDkEriab7jTHga1tNj4o4CAvBaJbd5TC3WP8RY4R8mymMP3KdFTVw&sig=Cg0ArKJSzIVnZjeiuMcfEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=695&cbvp=1&cstd=693&cisv=r20220822.07546&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 24 Aug 2022 21:09:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 7226 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d64b11edc21383e374eaec1bc29e92192b3e91cccf7e4237cb61c9a9026f2f96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 788C 12 KB
5 KB 36ms
13ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 92114
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ciCf1XwAj9I9MVE4V540LpKl2U2yyYRzo2zVwVYLGqylYseU2hD2wUGz2Lp%2FB%2BdwEPhJcPoqnllc06UdUPWu6X9SbQdYHf9tyeP9xCU1ekKcOsZ3XS73W5CnSW9Pnibh82l8Q5bF7XUPNRJRu%2FpUzz5P"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 73ff11741b23bb55-FRA
expires: Mon, 14 Aug 2023 21:09:18 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 788C 12 KB
6 KB 14ms
14ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Aug 2023 21:09:18 GMT

GET
H2 200 b113c14be1be4dbda4ef71cee8de4dfc_casanspro_regular.woff
static.criteo.net/design/dt/ Frame 788C 56 KB
56 KB 55ms
24ms Font
application/octet-stream 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/b113c14be1be4dbda4ef71cee8de4dfc_casanspro_regular.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ba98e735ce0f8021ed850e1cfd1e5f20049e17ac90b3bea352b04324d045c233

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
last-modified: Thu, 24 May 2018 07:59:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5b0670fe-dec4"
strict-transport-security: max-age=31536000; preload;
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Aug 2023 21:09:18 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 5 KB
6 KB 103ms
32ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=76&m=0&partner=942&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F942%2F210816%2F232132f7860e42a1936cac015f404380_ca_logo-01.png&v=3&w=596&s=98cru8JzcaZbooQmfXNEAJuL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0aab059870f012f12f3e3fe550c62b6d8cef07be8d509a0ce69df144e7fdfe1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=31050604
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5472
expires: Sat, 19 Aug 2023 06:19:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 16 KB
16 KB 93ms
22ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1658316031%2F2176055-1-01.jpg&v=3&w=400&s=AjZ5kT9CJqj5NaYd6tyndTL7&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

512264732ddbe17805b120cc3876938cad3b5b330c39d71a795e61ff99a57a7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28960296
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 16272
expires: Wed, 26 Jul 2023 01:40:54 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 5 KB
5 KB 108ms
38ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1657195819%2F2186030-1-01.jpg&v=3&w=400&s=C9Z3il05W7svZdIOGrQTiGv-&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

4a409076ca2553d234ff017fd0d2dcae6105cb2d3c691e73cdd8847c5dc62239

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28924004
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4644
expires: Tue, 25 Jul 2023 15:36:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 14 KB
14 KB 98ms
28ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1655884805%2F2179271-2-01.jpg&v=3&w=400&s=RXB51KBxaBbwGTYdcTaPLYXT&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

b1aa412377e37f25c55971ab7419530d954c8b59d533b316a759adba698a624e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31079440
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 14436
expires: Sat, 19 Aug 2023 14:19:58 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 12 KB
13 KB 107ms
36ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1653666374%2F2181821-1-01.jpg&v=3&w=400&s=WT4FUyqJCSGOUzds0wLow7OZ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

939f233d46c8791222267d77e29d924882274eb346c609ff6551061396a25ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29696344
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 12762
expires: Thu, 03 Aug 2023 14:08:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 7 KB
7 KB 100ms
29ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1650568469%2F2170539-1-01.jpg&v=3&w=400&s=uQZ6aDK7Ujh307dxfJzjlq4z&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

bb68aae18ecd5bcf816bb98cf5bb19c7e9fd1431b1519f746a9fd3aeb5d57e0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29779264
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7130
expires: Fri, 04 Aug 2023 13:10:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 17 KB
17 KB 18ms
15ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1655463779%2F2179768-1-01.jpg&v=3&w=400&s=aTIt6ndLcMN8JRIx2D8GL63h&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

ad296f39ad4411e513f1cb6a7779759b4854b8d5e885502ff79b37c1b644daef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30824807
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 17496
expires: Wed, 16 Aug 2023 15:36:05 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 9 KB
9 KB 21ms
18ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1651573581%2F2172120-1-01.jpg&v=3&w=400&s=KnEyhDPDWPL1G2hMElW9K0-E&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

3fcca84d7025351471c7f04b8641ce8b95b439566c382f2a72476a173609d373

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29773771
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 9008
expires: Fri, 04 Aug 2023 11:38:49 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 5 KB
5 KB 22ms
19ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1649239524%2F2169782-2-01.jpg&v=3&w=400&s=Tb16z0Tz8amyvSXsUfU-K5qG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

7ee6edca912233b18504a48459d37c8840c3d2067c93652bf1401041c53595e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30250153
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4962
expires: Wed, 09 Aug 2023 23:58:31 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 788C 8 KB
8 KB 24ms
21ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=942&q=80&r=0&u=https%3A%2F%2Fwww.c-and-a.com%2Fproductimages%2Fc_scale%2Cc_scale%2Cif_ih_gt_iw%2Cw_400%2Cq_95%2Ce_sharpen%3A70%2Fif_iw_gt_ih%2Ch_400%2Cq_95%2Ce_sharpen%3A70%2Fv1656583467%2F2182477-1-08.jpg&v=3&w=400&s=wzzlmS8S6XLrSJZlZaI087uv&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

4e697f80bfa436d6e9bbbca8506192023dd8284b4a0c8d52a4629f5140a20359

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31254990
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8288
expires: Mon, 21 Aug 2023 15:05:48 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 788C 0
128 B 117ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=9ljWZpGyeCoKK9vP0ng4PLVs6nDFRsW3_45pTWrPpceMKCf69C6QNxjEK_9fo2oFoN-sEXBlLRxH_bbcDk7EsvOAIPAAdwxC6xU5xDMT072zN544ME6lndXnYF-67862ITxl9Z-mxteO3oSN-BO67LE7NTH3lGjNzGlnbXLOweNjHsnvJ-1YsM1ZmHlMZZYiAPSuNG7X9BxGe-XdUTOirG4Jr0Gun_CUn23t-y6fLyCnefeffe8g3ZV57Rte-yEzEt5zyA&sds=2&rev=82533&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 24 Aug 2022 21:09:17 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 788C 2 KB
1 KB 24ms
23ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Aug 2023 21:09:18 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 788C 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Aug 2023 21:09:18 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7226 43 B
215 B 162ms
94ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=da6541a0-7316-3f96-b625-2eb5f24be1cd&tv=%7Bc:mff47T,pingTime:-2,time:420,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:950,beZ:952,mfA:954,cmA:955,inA:955,inZ:960,prA:960,prZ:971,si:977,poA:979,bl:1001,poZ:1001,cmZ:1001,mfZ:1001,loA:1183,loZ:1186,ltA:1371,ltZ:1371%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:26%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:420,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B414~0%5D,as:%5B414~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h*.1141311-65046770%7C1h1%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1h*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:svg.us,sinceFw:392,readyFired:false%7D&br=c
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-server-name: dt02.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 511C 17 KB
7 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2315 43 B
215 B 240ms
180ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=79e680a6-b2cc-df4f-f367-c2be50febad2&tv=%7Bc:mff481,pingTime:-2,time:373,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1040,beZ:1041,mfA:1043,cmA:1045,inA:1045,inZ:1049,prA:1049,prZ:1058,si:1065,poA:1066,bl:1087,poZ:1087,cmZ:1088,mfZ:1088,loA:1247,loZ:1250,ltA:1413,ltZ:1413%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:23%7D,%7Br:r,w:728,h:90,t:203%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:373,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B367~0%5D,as:%5B197~0.0,170~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e*.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h.1141311-65046770%7C1h1%7C1h2%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1e*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:svg.us,sinceFw:348,readyFired:true%7D&br=c
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 54EC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

29ms
24ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:18 GMT
expires: Wed, 24 Aug 2022 21:09:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:18 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame CA97 17 KB
7 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 14BA
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

32ms
30ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:18 GMT
expires: Wed, 24 Aug 2022 21:09:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:18 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F9FC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

29ms
20ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:18 GMT
expires: Wed, 24 Aug 2022 21:09:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 21:09:18 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/ Frame 9698 17 KB
7 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220822/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 21:06:25 GMT

GET
H3 200 c2.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/ Frame FC8F 36 KB
36 KB 11ms
10ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/c2.png

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f52f8f6c9d11dfff0b979fe99e83d6eb65f850c25542626f7d7987ca2478543

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 150422
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36357
x-xss-protection: 0
last-modified: Fri, 02 Aug 2019 06:46:58 GMT
server: sffe
date: Tue, 23 Aug 2022 03:22:16 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 23 Aug 2023 03:22:16 GMT

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame B520 36 KB
14 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame 66A1 36 KB
14 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 008C 42 B
64 B 74ms
69ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssezReN09xseTwjkWYeBA6KHW1-l5wy_BawmIwis5VHxGjwcxlabinrMPvGrrzE34TgXExkt0ag5bZCEadABvH3-_B-KMKDbPE99TQLBI9N8_xj1yXV&sig=Cg0ArKJSzJiSFhGzW0kuEAE&id=lidar2&mcvt=1054&p=1099,635,1100,636&mtos=1054,1054,1054,1054,1054&tos=1054,0,0,0,0&v=20220822&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=265943010&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1661375356809&rpt=352&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame 96D9 36 KB
14 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B6CA 22 KB
8 KB 40ms
26ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 28863
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 13:08:15 GMT
expires: Thu, 24 Aug 2023 13:08:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame FC8F 36 KB
14 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5348
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESECztc-uTX6X0_AA-MID2_z8&google_cver=1&google_push=AehlK4CUwdMf9wFJFqJ_5QZ_JXiKkl0cxE88LZetEVO_V8ooND8WS_XG_Yuloly5crAhQk3Ism9fiTJOQYB2GvBY...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=IdFjBpN9SgCkV1trz_5yjg&google_push=AehlK4CUwdMf9wFJFqJ_5QZ_JXiKkl0cxE88LZetEVO_V8ooND8WS_XG_Yuloly5crAhQk3Ism9fiTJOQYB2GvBYVbTTTWwy...

170 B
188 B

26ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=IdFjBpN9SgCkV1trz_5yjg&google_push=AehlK4CUwdMf9wFJFqJ_5QZ_JXiKkl0cxE88LZetEVO_V8ooND8WS_XG_Yuloly5crAhQk3Ism9fiTJOQYB2GvBYVbTTTWwyY_VX

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 24 Aug 2022 21:09:18 GMT
Server: MT3 4494 7cf1da7 master zrh-pixel-x13 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=IdFjBpN9SgCkV1trz_5yjg&google_push=AehlK4CUwdMf9wFJFqJ_5QZ_JXiKkl0cxE88LZetEVO_V8ooND8WS_XG_Yuloly5crAhQk3Ism9fiTJOQYB2GvBYVbTTTWwyY_VX
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 24 Aug 2022 21:09:17 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5348
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIFo-jDO72qd18O6eGfsFeQ&google_cver=1&google_push=AehlK4Bayit15JfK6UbR8ubhtI_dl4kmPnmhevHHp4zIbxr46h0ZlVo_1jCW5ZcXJIaMR6U2Va2hbI7Q_T0PzwiWQ_NWyzs...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4Bayit15JfK6UbR8ubhtI_dl4kmPnmhevHHp4zIbxr46h0ZlVo_1jCW5ZcXJIaMR6U2Va2hbI7Q_T0PzwiWQ_NWyzstBsXj1w&google_hm=NzQxMDE2NTkxNjIzNTAx...

170 B
188 B

20ms
19ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4Bayit15JfK6UbR8ubhtI_dl4kmPnmhevHHp4zIbxr46h0ZlVo_1jCW5ZcXJIaMR6U2Va2hbI7Q_T0PzwiWQ_NWyzstBsXj1w&google_hm=NzQxMDE2NTkxNjIzNTAxOTcwMw%3D%3D

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 24 Aug 2022 21:09:18 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4Bayit15JfK6UbR8ubhtI_dl4kmPnmhevHHp4zIbxr46h0ZlVo_1jCW5ZcXJIaMR6U2Va2hbI7Q_T0PzwiWQ_NWyzstBsXj1w&google_hm=NzQxMDE2NTkxNjIzNTAxOTcwMw%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5348
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPc91A0PCYK1fl5tuIsItGk&google_cver=1&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJO...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPc91A0PCYK1fl5tuIsItGk&google_cver=1&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJO...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJOw-qG8RKB_if0g&google_hm=FM41uGZHwDPZMbehRCq5...

170 B
188 B

22ms
19ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJOw-qG8RKB_if0g&google_hm=FM41uGZHwDPZMbehRCq5Zbcl

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 24 Aug 2022 21:09:18 GMT
pod: X-Sovrn-Pod: ad_ap6ams1
location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4BGw75K9ACzQ4Hkp5raZjsIiU9qpXw6K4Vxg_OfZ3YQRzpSkoJrv5mo6OaHXs5DdRH5RTK9So2rIgKBoxsJOw-qG8RKB_if0g&google_hm=FM41uGZHwDPZMbehRCq5Zbcl
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
access-control-allow-credentials: true
connection: close
access-control-allow-headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5348
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEMpvplr0vRy5P3Tx4xPDCZQ&google_cver=1&google_push=AehlK4CLJwf0l_QPPDghvzOZhh8Ai0XlRy08_Ue68KOHXjDZvFisvxFqtdERpRJzWtucWS7C7cwDhTHh3E2EK7uP...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4CLJwf0l_QPPDghvzOZhh8Ai0XlRy08_Ue68KOHXjDZvFisvxFqtdERpRJzWtucWS7C7cwDhTHh3E2EK7uPEFqpykFLy2lsLA

170 B
188 B

19ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4CLJwf0l_QPPDghvzOZhh8Ai0XlRy08_Ue68KOHXjDZvFisvxFqtdERpRJzWtucWS7C7cwDhTHh3E2EK7uPEFqpykFLy2lsLA

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 24 Aug 2022 21:09:18 GMT
via: 1.1 b30b1c2659a3fb836783824fe37110ee.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P5
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4CLJwf0l_QPPDghvzOZhh8Ai0XlRy08_Ue68KOHXjDZvFisvxFqtdERpRJzWtucWS7C7cwDhTHh3E2EK7uPEFqpykFLy2lsLA
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: sBwn3pPP0LjkGtK_C6FcUxOP6Qyj313oRa5R-YsxUas0h8qbuxYZag==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5348
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFyjv75Z8taZcXZ8J_SavFE&google_cver=1&google_push=AehlK4DGRCaXRGc_-564Yq2LEFjtdXyUwAC3GYHBTOGgnrwqFX0WTuIIfHTTz4jxm2EZ7WjSiBbr251UEEeuTpqWJbGQfbdv4f...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4DGRCaXRGc_-564Yq2LEFjtdXyUwAC3GYHBTOGgnrwqFX0WTuII...

170 B
188 B

29ms
21ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4DGRCaXRGc_-564Yq2LEFjtdXyUwAC3GYHBTOGgnrwqFX0WTuIIfHTTz4jxm2EZ7WjSiBbr251UEEeuTpqWJbGQfbdv4fkcCQ

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4DGRCaXRGc_-564Yq2LEFjtdXyUwAC3GYHBTOGgnrwqFX0WTuIIfHTTz4jxm2EZ7WjSiBbr251UEEeuTpqWJbGQfbdv4fkcCQ
date: Wed, 24 Aug 2022 21:09:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 5348 0
75 B 38ms
21ms Image
text/plain 185.86.139.94
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEP9mcFEAe3EeZ9_AxAEgV4s&google_cver=1&google_push=AehlK4BnOFDp9ltfRiRXC5HjIXhVmnrFcMux68usNDFYrOqa5_WeOLlTKy6tVoOzb0zkFroh5P5Nb_UFRc5amdF3SdfsvX0VnHKu
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.94 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:17 GMT
content-length: 0

GET
H2 200 um
sync.teads.tv/ Frame 5348 23 B
172 B 56ms
38ms Image
image/gif 23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESENBS-oPtBpnQ0lrRcxVGcAo&google_cver=1&google_push=AehlK4A95zksSzgzHZMY5xlcOsvYMqETBcfBCQPS41aUcLZiwMYl3JDjeGu-cow3cVmlQUz-LmhzrnTm4OhWXDZhL1dX92gjoXo1HJw
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.8 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 24 Aug 2022 21:09:18 GMT
server: akka-http/10.2.8
content-length: 23
content-type: image/gif

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5348 0
12 B 46ms
29ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ITHHPu-CmkEYBfGI-LNol5KGudv7ESXJKEDTxUOtok1pkSDWyuzSo3kcTRuY-mVp-C7k9p2Q

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 sting.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 2 KB
2 KB 37ms
20ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/sting.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b61929b14eb6529451dbcb5f5434188969f68cc02057d563a9db3b9591b92d44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2104
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 8 KB
8 KB 52ms
35ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b8cbcb59cf389b8ca11449ce132c6bff62acd77bae98e239a28ed826d28db89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7726
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 10 KB
10 KB 51ms
34ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19fd57aa8d7877c0da46db560ce9c8cbce09ffcf6af7299a932bb04a041183d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9951
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 8 KB
8 KB 37ms
21ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54516fff8a9e3907172f96f8e51bba682cd29253dce254f199b4132372e56381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8517
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 txt2a.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 4 KB
4 KB 46ms
34ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/txt2a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e08ec01ec1f7c75dd7fb608523af7f7a31b5db23636bfbb9e98d4f831ab30ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4043
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 txt2b.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 4 KB
4 KB 34ms
21ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/txt2b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acceeca10c7bd430647a047c76f082e90d69ab3ef3c10aa2589ca680d0cd2ead

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4382
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 img2.jpg
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 11 KB
11 KB 34ms
22ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/img2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7694c67b7b768c34067735a92d9c60a6c3cc709a37047008b16c8ee5cfaa235f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11288
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 img3.jpg
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 8 KB
8 KB 34ms
21ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/img3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf419273c67644558beea89b3ca478ffe4b98c7984f7982c2f70383464eeae1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8473
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 img1.jpg
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 14 KB
14 KB 49ms
37ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/img1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a82c3690dae9aba60c0df9449ec207f73213f07cb0c620a99dc3167f4e93935

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13833
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 6 KB
6 KB 56ms
44ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e567f904425b2e20b19ea7dfec04e43cf3e36b9f4d830bc41c95b14b9e866bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5877
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 logo1.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 3 KB
3 KB 57ms
44ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/logo1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1af3d023238f654c9be5b0d33c51317620cedc7dd026b08ae7383629c976d9ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2951
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 proposition.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 1 KB
1 KB 56ms
44ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/proposition.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ced7e6e0093af5c4242071f4d334809fed7d85374a3f9a7bd9c785d7ef147aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1440
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 caveat.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 4 KB
4 KB 47ms
35ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/caveat.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57ffcb4f7a5e82c3f6d27f241098b76bb638c87f1af1a2fe02ecb72bf1f2809d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4374
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 caveatclosebtn.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 225 B
252 B 48ms
36ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/caveatclosebtn.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1aede1b27429a9ec1b3539e2451b7904806532630861c83294cfc576611758db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 caveatopen.png
s0.2mdn.net/sadbundle/6092393553986610343/images/ Frame 0A85 7 KB
7 KB 48ms
36ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/images/caveatopen.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83d0f26ea04c4e488bd17ac03327efe9888f2f5231038ae4f0c05b8979ead096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7076
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H2 200 video-loader2-cr.js Show response
cdn.avantisvideo.com/js/ Frame 008C 115 KB
37 KB 64ms
52ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/js/video-loader2-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b2675f2bc3393449a44784c7815f9c36449024e4397d7f174812c42c6bbaa148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: 23HYQ0o2ylfY4CikTtNpDIRIBjFm3stq
content-encoding: gzip
last-modified: Wed, 10 Aug 2022 07:12:05 GMT
server: AmazonS3
age: 50488
etag: W/"34fc05e1a66d53097cb2d428812d10e3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 07:07:51 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 5WqNUl8XgzBVmPh3XAX1bpF6O8yLgnEFS-qzzaNIam65vaM_K6ZAuA==

GET
H2 200 video-loader2.1-cr.js Show response
cdn.avantisvideo.com/js/ Frame 008C 115 KB
37 KB 19ms
9ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f85b446cf7c5640aa90f2663bf232af45a2d4ebd65fcf60a3105f400ea8bdac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: R3srv_l_.CCJ9VrYZEKFH47S4Xn_qYV0
content-encoding: gzip
last-modified: Mon, 15 Aug 2022 08:52:18 GMT
server: AmazonS3
age: 15113
etag: W/"e47a13a604e4ac4e6ccdc005c9e93287"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 16:57:26 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: kVFWDWOlNNDCFPBWpVIkyLUrhXBwLi0YrsittYT2a90F9tkQfQoTJQ==

GET
H2 200 video-loader2.1-cr.js Show response
cdn.avantisvideo.com/js/ Frame 5724 115 KB
37 KB 26ms
18ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/avm/js/video-loader.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f85b446cf7c5640aa90f2663bf232af45a2d4ebd65fcf60a3105f400ea8bdac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: R3srv_l_.CCJ9VrYZEKFH47S4Xn_qYV0
content-encoding: gzip
last-modified: Mon, 15 Aug 2022 08:52:18 GMT
server: AmazonS3
age: 15113
etag: W/"e47a13a604e4ac4e6ccdc005c9e93287"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 16:57:26 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: OSvIzJ-OC2b5OwtTO_5fFOzYDuN620zOyW5NZu0IRG9oU8EH2SLfIg==

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2138 22 KB
8 KB 27ms
20ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 28863
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 13:08:15 GMT
expires: Thu, 24 Aug 2023 13:08:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 p2.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/ Frame FC8F 17 KB
17 KB 20ms
14ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/p2.jpg

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2aa499a3091dda7e928c1945d710f743afeb98bc154b78fca1b9290a95fb3539

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 513653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17719
x-xss-protection: 0
last-modified: Fri, 02 Aug 2019 06:46:58 GMT
server: sffe
date: Thu, 18 Aug 2022 22:28:25 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 18 Aug 2023 22:28:25 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame 06AD 43 B
686 B 217ms
186ms Image
image/gif 2606:4700:4400::6812:230b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEK-hhlK_OJBxZBM13jRdZfM&google_cver=1&google_push=AehlK4BOMcCHLaG_1-mouFssBwrNCNq94GZdMQIs0oyxMzr8o-ArXVAdqFTmJp87gcIkj3ULEJKVUJf9SQfMx1QxYBDIYM_L9Uk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAehlK4BOMcCHLaG_1-mouFssBwrNCNq94GZdMQIs0oyxMzr8o-ArXVAdqFTmJp87gcIkj3ULEJKVUJf9SQfMx1QxYBDIYM_L9Uk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 73ff1175cb099b4c-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 06AD 70 B
265 B 125ms
33ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEHJuy-TeP3RfrXaLbL98kJI&google_cver=1&google_push=AehlK4B5_tasBVlVygqZI5CG3htUxoj8DNeE9vaGGM64UiGQ7PY3KpPYR1dj9LXiLjDzEe6PYycbFxIHnY18ahw3pf4i9bOxnbs
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06AD
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESENCVdE7-Dd_-EgW__0hhUUw&google_cver=1&google_push=AehlK4AjSOXWrcz7SSFofJLKA6JMnCWSJdMeZAbwPcavvqsSjp7j1XztkLr43awo6gmX11LDQfwvPQIkW7auyHQF...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=OconkSDuSLq9z6aG1lwq5Q2&google_push=AehlK4AjSOXWrcz7SSFofJLKA6JMnCWSJdMeZAbwPcavvqsSjp7j1XztkLr43awo6gmX11LDQfwvPQIkW7auyHQFVA8m7jixZ1U

170 B
188 B

20ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=OconkSDuSLq9z6aG1lwq5Q2&google_push=AehlK4AjSOXWrcz7SSFofJLKA6JMnCWSJdMeZAbwPcavvqsSjp7j1XztkLr43awo6gmX11LDQfwvPQIkW7auyHQFVA8m7jixZ1U

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 24 Aug 2022 21:09:18 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=OconkSDuSLq9z6aG1lwq5Q2&google_push=AehlK4AjSOXWrcz7SSFofJLKA6JMnCWSJdMeZAbwPcavvqsSjp7j1XztkLr43awo6gmX11LDQfwvPQIkW7auyHQFVA8m7jixZ1U
x-host: tde-deliveryengine-production-7498b6c884-956lp
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06AD
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHLDML4nLO_v_0WLSmjSmSU&google_cver=1&google_push=AehlK4CYeZ2sHsphsxb3kJSiQ5moXV_IGnShyWmQsziL2GbIh1MFGqhlssKh-CEGoLwja3rby0nuvmF8...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4CYeZ2sHsphsxb3kJSiQ5moXV_IGnShyWmQsziL2GbIh1MFGqhlssKh-CEGoLwja3rby0nuvm...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4CYeZ2sHsphsxb3kJSiQ5moXV_IGnShyWmQsziL2GbIh1MFGqhlssKh-CEGoLwja3rby0nuvmF8u4Sy_ww7i_Q-rvvanPk

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIzMDcwMjQ1ODI4MTAzODY2Nw&google_push=AehlK4CYeZ2sHsphsxb3kJSiQ5moXV_IGnShyWmQsziL2GbIh1MFGqhlssKh-CEGoLwja3rby0nuvmF8u4Sy_ww7i_Q-rvvanPk
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06AD
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DlKpNeLAdgTMl1n8gAlgbS67UAnPb9U...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DlKpNeLAdgTMl1n8gAlgbS67UAnPb9UsN6IMopRpYpmYal2kczycl2pkeDgM_PoQbQN2O5uGO-m6MpRVg8frpAtcNEjFc

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ci%2BkFfKgIY0BRVNtpDAys6Ztya2hYv57Jnqb%2FHl9Dsjw2AqUaMkcDg74nZQQj6GL7h%2B6K9K0VXPIL6UbEBicYLB7dXzq7LdroA4jmD4yHht3UlAKA4mTbdeRDa078eGm%2BcZL1ReZQhVETg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEMCCbWrXjEJbeRtTcixPl3g&google_hm=YwaTfZIp4Z2xk1Kly3OOnAAABMIAAAIB&google_nid=index&google_push=AehlK4DlKpNeLAdgTMl1n8gAlgbS67UAnPb9UsN6IMopRpYpmYal2kczycl2pkeDgM_PoQbQN2O5uGO-m6MpRVg8frpAtcNEjFc
cache-control: no-cache
cf-ray: 73ff1175c96a9b95-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06AD
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEMpvplr0vRy5P3Tx4xPDCZQ&google_cver=1&google_push=AehlK4BjUF76u3tKodcm4orHjaPoDDkMPdY96b-z4PeN4ENurTjd09648fKtt64d27ROZZEytu6I38tt7VoEi4NR...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4BjUF76u3tKodcm4orHjaPoDDkMPdY96b-z4PeN4ENurTjd09648fKtt64d27ROZZEytu6I38tt7VoEi4NRFZcYmQfSsfU

170 B
188 B

20ms
19ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4BjUF76u3tKodcm4orHjaPoDDkMPdY96b-z4PeN4ENurTjd09648fKtt64d27ROZZEytu6I38tt7VoEi4NRFZcYmQfSsfU

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 24 Aug 2022 21:09:18 GMT
via: 1.1 b30b1c2659a3fb836783824fe37110ee.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P5
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AehlK4BjUF76u3tKodcm4orHjaPoDDkMPdY96b-z4PeN4ENurTjd09648fKtt64d27ROZZEytu6I38tt7VoEi4NRFZcYmQfSsfU
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: d-aQJH0ak6Q1e0loPZggREZ5XiKWKbkBtt-UrGoGOupNdEw3yKGZUQ==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06AD
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFyjv75Z8taZcXZ8J_SavFE&google_cver=1&google_push=AehlK4BCsvrbmZUvvZfJHXe1QghkF6eDhqQrysbKl--n16nie_aQ8M2l_zhW7oVIvTj_qMwT2Ey-vxf0dnbYKReUPimNHd14iK4
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4BCsvrbmZUvvZfJHXe1QghkF6eDhqQrysbKl--n16nie_aQ8M2l...

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4BCsvrbmZUvvZfJHXe1QghkF6eDhqQrysbKl--n16nie_aQ8M2l_zhW7oVIvTj_qMwT2Ey-vxf0dnbYKReUPimNHd14iK4

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMzA3Njk2NTE0OTAxMjc2NzA1Ng%3D%3D&google_push=AehlK4BCsvrbmZUvvZfJHXe1QghkF6eDhqQrysbKl--n16nie_aQ8M2l_zhW7oVIvTj_qMwT2Ey-vxf0dnbYKReUPimNHd14iK4
date: Wed, 24 Aug 2022 21:09:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 06AD 0
12 B 44ms
25ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JbAiDMnI-PBBusIVepvJw3KjCwK15LtWxRxF8vbREqcwZ7RLymAeVcVcm7nmMt-UkqDswj

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 l
www.google.com/ads/measurement/ Frame 511C 0
0 42ms
24ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRP_wjxvc5fAX22YBPqigDeCugXaoJk_p89rhFM4mspH3tHB6YKTJ3SuKq9pgTZhtS3JB8FqoyXiPiXtapKo4g4HeyBww
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 sting.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 1 KB
1 KB 25ms
10ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/sting.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

958bc2d27d930acc97b8f783e9f6135ec27f060f8775d93d8990246af63cd87b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1200
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 2 KB
2 KB 28ms
13ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d1ffd03b86922298b77c8df77a267845dccf197515ce5e5fa3fa17f1d60ad25a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2285
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 4 KB
4 KB 26ms
11ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f5ca0a34974048b141ab16c85540d298814604ae1e649023e29659888c212f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3724
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 3 KB
3 KB 28ms
13ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

734f9af6d0f8e6633f5898a8c29ae88c0194d4e398ce773c159e4478af3e3443

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2734
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 txt2a.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 970 B
997 B 33ms
17ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/txt2a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1fc7e03c8804a8d3df2989093ca36911e9d117dd7d465bc12b80115306f67a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 970
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 txt2b.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 1 KB
1 KB 32ms
17ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/txt2b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

047bf1d6aacbf20c071e62c73a1eb72dd3385f14caebb74d22890cef92c64f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1129
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 img2.jpg
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 12 KB
12 KB 31ms
15ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/img2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6c367683b30312c52b7a31c0f72fd4208c9f8e99f183dfbe31a2a1bea648e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11847
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 img3.jpg
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 10 KB
10 KB 31ms
15ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/img3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16214cd854b5edfe518d841b092c9cf69e65591b2cdaea2496bce9db323500c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9912
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 img1.jpg
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 13 KB
13 KB 35ms
19ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/img1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8360ea047ab33cb96e9fd2d623687cd3a54d3508975469e92082c6cdb5e25742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13493
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 6 KB
6 KB 33ms
17ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd1b3d98da6310891d6a43e04ae081c45da8b04890809bbc9402306b986a7aca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6276
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 7 KB
7 KB 34ms
17ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20f1c786ffa326b4bf742ff1f66f1901712217daced69e2da518dfaefa73fbdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7021
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 logo1.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 3 KB
3 KB 35ms
18ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/logo1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6568c93cdb032daa5e27c1aefcb268be1e64d2aa53f0261ab2d9d104fce4538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3116
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 proposition.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 1 KB
1 KB 37ms
19ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/proposition.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bcc64347d6c014ae65ea6ae0f7e1e632e9a0e7b2177bf262d0bd39c2c1326a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1264
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 caveat.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 1 KB
1 KB 36ms
18ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/caveat.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbbf62620711af60249429337b9251292d7e1c2d98456d84edd0fda3d84cd1f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1066
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 caveatclosebtn.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 236 B
263 B 41ms
22ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/caveatclosebtn.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ccffe7b83fed843a2cef40c555bf6727caced52686f1e14afeb231757a8592c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 236
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 200 caveatopen.png
s0.2mdn.net/sadbundle/346351590727387842/images/ Frame FB5E 2 KB
2 KB 40ms
22ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/images/caveatopen.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1f8bb34d1c9293f4835d697703ea1f9f0d428c9adbd069b07671d0adef8e503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2343
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame CA97 0
0 39ms
23ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS3oHNN7xxHeel1QCG9lF5yX8w8vZiAPYVraM6_g4AIlU_pg2j_jovA9GcDJiJ_IdYHG3fuLD_0ZzgGCPrtxHQthEErXg
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9698 0
0 36ms
23ms Image
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ_pv6C76X-jm4W-iCUcWAONjQHy_LVZr8CLQvYXUnKZrSXW-OEvYPaNZ8Tq7UjY-3kVjKCXNUvsWlSDlVJKAItg5geuA
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame 417E 36 KB
14 KB 25ms
16ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

GET
DATA 200
OK truncated
/ Frame 511C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b4e83392f391af25c7004f17559a0600d4d38676f896079cf7962d43404dde4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame CA97 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 159c4dc8c425f8c2d63849440e69bfae3bf91164441aad1093cdf04b6236297e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9698 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50892014b518ac5fcb616368948439bbf6f6fff38d2add32943242cc625cc407

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 planet.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/ Frame FC8F 14 KB
14 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10489799405306279296/planet.jpg

Requested by

Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

774e454b13692a54421c059a47ba94dc81bb21ee729f9a076548882ae6163b7f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 278595
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14303
x-xss-protection: 0
last-modified: Fri, 02 Aug 2019 06:46:58 GMT
server: sffe
date: Sun, 21 Aug 2022 15:46:03 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 21 Aug 2023 15:46:03 GMT

GET
H3 200 tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A85 105 KB
35 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35824
x-xss-protection: 0
last-modified: Fri, 09 Oct 2015 14:01:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 cssplugin_1.20.0_35574bbb2cf06c392e9036c87b5a8474_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A85 42 KB
16 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/cssplugin_1.20.0_35574bbb2cf06c392e9036c87b5a8474_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b2d1f053c12ae5640ceec86485e4c7c6a7b52645c41dac0d8f1b17e9aac3b1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16670
x-xss-protection: 0
last-modified: Wed, 04 Oct 2017 18:34:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 easepack_1.20.0_f9d13d59407792e37168747225359927_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A85 5 KB
2 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/easepack_1.20.0_f9d13d59407792e37168747225359927_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96ae2513e5fadfa135893b5c3a4450e8b540ad60a12547d80a5fcb9f7af0b587

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2075
x-xss-protection: 0
last-modified: Wed, 04 Oct 2017 18:35:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 timelinemax_1.19.0_4cba7b163d6263b39d53727ed4c7bb6f_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A85 20 KB
6 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/timelinemax_1.19.0_4cba7b163d6263b39d53727ed4c7bb6f_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d29d6e7efbb3390006b58cf4007c217818e80c9ae7a6656cc3ff8fadf809fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5821
x-xss-protection: 0
last-modified: Tue, 06 Sep 2016 20:50:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/6092393553986610343/ Frame 0A85 3 KB
718 B 10ms
9ms Script
application/x-javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6092393553986610343/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05edc6f9f208928500c14213cc91ce2cb0e0a53636a951d34e3f31a195063146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6092393553986610343/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 689
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:22:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:15 GMT

GET
H3 200 tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame FB5E 105 KB
35 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35824
x-xss-protection: 0
last-modified: Fri, 09 Oct 2015 14:01:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 cssplugin_1.20.0_35574bbb2cf06c392e9036c87b5a8474_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame FB5E 42 KB
16 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/cssplugin_1.20.0_35574bbb2cf06c392e9036c87b5a8474_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b2d1f053c12ae5640ceec86485e4c7c6a7b52645c41dac0d8f1b17e9aac3b1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16670
x-xss-protection: 0
last-modified: Wed, 04 Oct 2017 18:34:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 easepack_1.20.0_f9d13d59407792e37168747225359927_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame FB5E 5 KB
2 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/easepack_1.20.0_f9d13d59407792e37168747225359927_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96ae2513e5fadfa135893b5c3a4450e8b540ad60a12547d80a5fcb9f7af0b587

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2075
x-xss-protection: 0
last-modified: Wed, 04 Oct 2017 18:35:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 timelinemax_1.19.0_4cba7b163d6263b39d53727ed4c7bb6f_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame FB5E 20 KB
6 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/timelinemax_1.19.0_4cba7b163d6263b39d53727ed4c7bb6f_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d29d6e7efbb3390006b58cf4007c217818e80c9ae7a6656cc3ff8fadf809fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5821
x-xss-protection: 0
last-modified: Tue, 06 Sep 2016 20:50:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/346351590727387842/ Frame FB5E 3 KB
737 B 8ms
8ms Script
application/x-javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/346351590727387842/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346351590727387842/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a35b54ba96281c3219a08fc301361189dedc07298f8d12f4b7f91f5d0be2c77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346351590727387842/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 09:14:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 702
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 15:21:53 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Aug 2023 09:14:05 GMT

GET
H2 200 geoip Show response
avm.avantisvideo.com/api/v1/ Frame 5724 175 B
927 B 287ms
286ms XHR
application/json 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Requested by

Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

31b6019da0be3ec6fb6d130582695015635ba2ac5316b1b6528b53fc779d327d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
vary: Origin
content-length: 175
x-xss-protection: 0
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
date: Wed, 24 Aug 2022 21:09:18 GMT
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-amz-cf-id: M3DkxpBFtnX_pY7IBavvsl0l8g7-QfzI7Z20vfatnebk8bYJ-T6w6g==

OPTIONS
H2 204 geoip
avm.avantisvideo.com/api/v1/ Frame 0
0 150ms
150ms Preflight 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.123greetings.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://www.123greetings.com
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Wed, 24 Aug 2022 21:09:18 GMT
expect-ct: max-age=0
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-amz-cf-id: QOv42Ghsjh64ZwVIowZazdwlWjSi0rD2Ensqxl4wKwdDAjxbzel_Hg==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

OPTIONS
H2 204 geoip
avm.avantisvideo.com/api/v1/ Frame 0
0 150ms
149ms Preflight 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.123greetings.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://www.123greetings.com
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Wed, 24 Aug 2022 21:09:18 GMT
expect-ct: max-age=0
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-amz-cf-id: Ocw29D41jYkMDluAEzR5QtF9VQUjBuYbNdLWzweE40AGV1k1HlBfCQ==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

GET
H2 200 geoip Show response
avm.avantisvideo.com/api/v1/ Frame 5724 175 B
928 B 291ms
291ms XHR
application/json 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Requested by

Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

31b6019da0be3ec6fb6d130582695015635ba2ac5316b1b6528b53fc779d327d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
vary: Origin
content-length: 175
x-xss-protection: 0
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
date: Wed, 24 Aug 2022 21:09:18 GMT
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-amz-cf-id: cZC7yAprgpwIrY9EEzIgW2WNjltUbCnTe05hykl84_ET9MoPY3uZ8g==

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A867 42 B
64 B 49ms
49ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuNB1NNmlVTqpGdnLq865E6r7PE3tHpdHxP2Pg8HMZWQEOHA6RT7jJUy9XV77n1XGJTsF-sEq0_UYISxs-YrcYT2b8&sig=Cg0ArKJSzOjgQC9If9zvEAE&cid=CAASF-Ro3_qB_5YQ_okMMVjSBgxuoYAYptfn&id=lidar2&mcvt=1131&p=236,970,486,1270&mtos=1131,1131,1131,1131,1131&tos=1131,0,0,0,0&v=20220822&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2334180326&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1661375356754&rpt=685&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4293 42 B
64 B 48ms
48ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstkOsjaNe0WmDxjM2XY05R52r4DP3nTZIHzaC20kyLseRGVhwgE47J9lRVg7CTyXHC_N7n8Xmii94dT8DlDc6IPmHYTxhQXhoUPzFq0Y2W5aQ6kudg3Wi1XUWBMj8kB1rVCFa_hFQ&sai=AMfl-YQjpz4sLIYoQh0B-zxf-ypIsF1QoC702UacL12KdgouU1VyJ42FXBtFFRixSFWwkOzodRiBU7NQOJEPchr3Ej6ViF5a0ImqhWelFKN9X5Xz2QvjC89-rtCM488&sig=Cg0ArKJSzMR9zgMn4jIFEAE&cid=CAASJORoDdMkV__66IK3Lpgsm4aMVAyABXBj-24BUFxbFsiNqX2KUQ&id=lidar2&mcvt=1133&p=239,401,299,869&mtos=1133,1133,1133,1133,1133&tos=1133,0,0,0,0&v=20220822&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=97135718&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1661375356750&rpt=705&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 48 KB
48 KB 25ms
24ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478445
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H2 200 geoip Show response
avm.avantisvideo.com/api/v1/ Frame 008C 175 B
929 B 291ms
291ms XHR
application/json 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Requested by

Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

31b6019da0be3ec6fb6d130582695015635ba2ac5316b1b6528b53fc779d327d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
vary: Origin
content-length: 175
x-xss-protection: 0
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
date: Wed, 24 Aug 2022 21:09:19 GMT
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-amz-cf-id: Umy4A84ivO1kLOyKlJyNvb6MO7L45xHVQnIiL8AepI1BPeZOOmKHrw==

OPTIONS
H2 204 geoip
avm.avantisvideo.com/api/v1/ Frame 0
0 159ms
159ms Preflight 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.123greetings.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://www.123greetings.com
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Wed, 24 Aug 2022 21:09:18 GMT
expect-ct: max-age=0
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-amz-cf-id: sPRnqxGO1JYFbWfPd888BsbgmobCoERHq6JDtstX3xJyM0EQZnpaFw==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7226 43 B
215 B 93ms
92ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=da6541a0-7316-3f96-b625-2eb5f24be1cd&tv=%7Bc:mff4gs,pingTime:-10,time:951,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8V2luMzJ8fEdlY2tvfHwyMDAzMDEwN3x8MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNC4wLjUxMTIuMTAxIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1661375358659%7C%7C60cdb2d19f10147aa5f07bac3e9b99ef%7C%7C5804921a8d3c64b26a083c50aad655e9%7C%7Cc75b217f4bc2c9d23a09056523dbbf0c%7C%7C50fedff9e0219c0ab66c4231b7887c41%7C%7C5ae3f242f4a3e677d53b228bda2dbf1d%7C%7Cfe84950ba8a0f542b00f7d1b642c1660%7C%7C609cbc5a766cdf005e04f20b0c418d99%7C%7C1629390669,im:%7BpWait:63%7D%7D
Requested by: Host: fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:18 GMT
x-server-name: dt20.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

POST
H2 204 /
events1.avantisvideo.com/ Frame 5724 0
34 B 172ms
171ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT

POST
H2 204 /
events1.avantisvideo.com/ Frame 5724 0
34 B 171ms
171ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame B6CA 36 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

POST
H2 204 /
events1.avantisvideo.com/ Frame 008C 0
34 B 173ms
172ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT

GET
H2 200 geoip Show response
avm.avantisvideo.com/api/v1/ Frame 008C 175 B
928 B 148ms
148ms XHR
application/json 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Requested by

Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

31b6019da0be3ec6fb6d130582695015635ba2ac5316b1b6528b53fc779d327d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
vary: Origin
content-length: 175
x-xss-protection: 0
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
date: Wed, 24 Aug 2022 21:09:19 GMT
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-amz-cf-id: FYgUULwWHJ9mEeYaNaPnfAqy-PanZ0JrWa6fBumBOSbB5tg2e8StuQ==

OPTIONS
H2 204 geoip
avm.avantisvideo.com/api/v1/ Frame 0
0 293ms
293ms Preflight 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/geoip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.123greetings.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://www.123greetings.com
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Wed, 24 Aug 2022 21:09:18 GMT
expect-ct: max-age=0
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-amz-cf-id: R4h9j7ll9Okhm59tGx0BVl9J4Woq8YxppSzNsyQAnmJ6HG-dn5wS9g==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

GET
H3 200 8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js Show response
pagead2.googlesyndication.com/bg/ Frame 2138 36 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/8Oc7qVgGezqJSgjjaaCdJlEAdJIIw0tPZxYDqe1tkXI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14092
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Aug 2023 19:37:44 GMT

POST
H2 204 /
events1.avantisvideo.com/ Frame 008C 0
34 B 172ms
171ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:18 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2315 0
26 B 46ms
45ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssbkMF1vbEKbfWua-uu3ndipE-7w3mEES5ktSR8tPnSMpJA-OSMHZDUzLJk5KzM1MGzFkylIyLD2J5cKyLD23O56WzQ068MU1XYEXF8-DRRJtzRf_ojK6qS5FOxMXbsrUP7n42IBLbciNLTB61RgTuf9QpkAnEUhlsx9UDrFNRmONOCSrvfabASHZDWoWRIFlrT1yPnhpsr4di28s2gpZrk29vNbuoQrIKtU2I9iHXLBSgRURhX_34YoSk3KzTnJ5da61fXEJ0p2SU0S99xSHQ5RJA75KWHHqo4Yd-p4KJX9RL2VxQSO9VckCGn6LQD6-XMxE2WWyh8MbEl34udBBpKN_is3NnuOzpHrNAc54rmdyUktPJ3v4cMoCq3hpJpJ2I1ZqMYwvalAJkFo6k81NlHbHGkNCmubaNWqRAyrlvYi7JPOAefxauduD_gf87RXe39BPvLc_ycYAN6Fdc9162TkO_ktsyyRFlTWC0-9hKKr-4wFKpxwCCP9M1AqXiJjNXc9w5Ocb0g0ryUcSnNlRiej2SBGBM7IgLB5DiDNWBi2wyO2Bf4M9C7kjbv5zWhTU_-tLgVpwG3hwjJXkCdjI6vlK-9Z_Aq69iOQEKKDMJgsllrUg44DJ3wBDw31Jc0gGsm2rJox5Cm818PNxBhTnuewJaly89Yjf6M1JO6TqgdZlvt9BOrSfmelJD_lLOcwi8XujNLGU1it6sM_Z-Qio6QNW-EG-_4ee6rCs-NrBS36e1Y4bB_2alyTXx1-HeM_Ni4oTp4ESZma7Cq9qwu0Es_5XYYYYPYe9Tpde1CM5lhNS6Ega-Y_IgZJ37j5fvZ528lM_7P0-z270wE3ZlYz78Gyk2Ku0TbCKf36fAWIx4bBErZNHKiVJ0tB6nRfqrA9Nvggj0KCPvi_sEQbrTbn10MxYxRzNPnF3twFfs8ghklKTc4haChihbOtR_2Bi_6L3uUZ5dBzkoo2WPgXX4TkpR6hAcQTA7Ltxi87FKeyu2M7hIYTsQN5eVvoX4qz23V_gf8Su5lntyJi-2usKDW8ykcZC-YLk3_mJ3PN5KnwH-HaoNSUQf61d0dWzxON7l9YMBNnU_MGDeOvRt138M6hqZaHSNEodk03OGgbWN0M7IAPaIgRv8mp7Zhyxw-M567EPTOMCbZaCSVA1Nbigc79VBbMUAcZTf5f2gOIxQML8taAaoF5uNNetLQtA&sai=AMfl-YQEtKUonHnGDv5YR_81rezOUYZBFt2RgMzEqAWZ41HflP5OxTkH8sVO0OOH6NekMZ0D7-v-v6qlbx69OsfgeyFKhEi17g9CLnr-mtO5DhYhtodnU1dxDZxh23uSnRzmXtbD7j3-NQB0WzedZWjS5Z0v3tAyEwTsTW7Mj20RFQWh8JEfOXx4uIcmT6wYX5rNKuRhrT0ZRdPc3oj-Gg3nvw&sig=Cg0ArKJSzAjCV7M6Lav7EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1616&vt=11&dtpt=942&dett=3&cstd=671&cisv=r20220822.65685&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7226 0
26 B 45ms
45ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssGD8uZiH6lZq0ufI1Hsv_ll-L_OtNyY6HKKmeEDrBODe2clHHWOsi1_ctaHmVfZhanO4uQ3K-dqGSRtE9o8TqzFBAnl2Xe4rhWYGyQSdeFQB6qvhMDVbAvRsZ-Edlu4Sm9-hru9IpD2T57648Q464hgvl3JAuwZo761uA8P4ntNSS2-1917LIiSQK_w1I8DTVTnNiK8Mw--ZInNYxYcaedVnXbHAS1Tauoimg_4taEMR0mcyyG7u8lgkABTFe5M-wSeAQwtV9m0b8AvJ35xw-WeyOxpXhZtCbrBu-hL-YLVBJC4A2EEox8Fxs0DSoKaJ-85Hkt1y2ikoeEi312I13V9XN5pmRa5x7zgUoqg0sVDmI2Sju3h_t1JogX0fpa5ztmaky6_RfOreRsW7-m9uYgQdvbsg3ZoHx8cpwJvES1kmAGL7HWZkM5DfMhKR-CzHXy0WlWSOpmHpOnegv8bsjegR-_mL0bee-i8sG43yu1yVK1zyoHU-ThFLde7ILzsS7dM6rKu_gI35wPQIV_FzaDlrl2iPQqnRBU-75kH6wRgorqFCU_FpMCYY31HtXKWypLD8vH0HWOYo9eiNyvyVKXbVHZnEJo_r04gU_K2nB1WsL8cvhkwKpr0XjKheBJTo4idspZjGp_jdpO8pwioDgKe-rnT37670nD_6JDR0pX99y1uzMYpVruT6hami9izZUkTtBZij7XE8iU8yaJQb-ZtiwhmUVVvq8LacoC8zFCWBb-GruXtsoYY5lfku7UPYoEbicHMQ4KBy3qEJNqRir2SX17vDOWG_eK6N3J8S2OenKT6w8esPEUpYAjb2ym7kxJ7FGXSrK76q2MPSvyvWEuv7srbH1v_HUSOqpv0B1rO5hl76RxVWEFiDIfWyYCBrHhYW16__DyEFgHguvJ6TdnYHHg7Pevyse3brX1mrvmu8DWyH11JrhvRknVVi5SYWBOAH2aFhTlNZuqPrqqhy4zs9XM-aKAkA6xbj7CnuCgdFQdis5jiL0SV5TWsbn0fnOoPYKzdJUMKStt4BzbGImii8R0smL9GWcneNHrq-3FylJXBt5s5Lo47vvbw_5e2lm9FOc5Nu78Xp2Th6peJ_JsjP_isFqh5pSGsYByU3CYRNiXrXvUL7pcb-cwdSBnzGr2w7_yVfkr7gxVeRlpC8ia1-WAWRxWZz3USvUcOtaefM9HIaWYPRmhCMpvY1idz1KhxS4&sai=AMfl-YQeaVno8VoEp4VczOBf1CYgPwDUT5aSVQiSPaUInZJr0y5uNrND347yENYrFO0tNbpHd3TQK1CVRfkOag_EzY2fqrIIb0zX7bDyE4UN396Gd9c_uJ5BO9b3vgY27vsNA9SQT_hd-QFi6KgsmRNYqmeeQuoIYYvoMNDkEriab7jTHga1tNj4o4CAvBaJbd5TC3WP8RY4R8mymMP3KdFTVw&sig=Cg0ArKJSzIVnZjeiuMcfEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1554&vt=11&dtpt=859&dett=3&cstd=693&cisv=r20220822.07546&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Aug 2022 21:09:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2315 42 B
64 B 50ms
50ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuiSybE2tC-o9icaML9zKd8l3xFjRu-MNlYaa-fP82fug4KHWLg0pTbFUoKbMoXn458q7s1c0YBgWsVa07IF79TYv7Pu4Sp35V-UqPtTM4eyo1YR0Kc8GEU7Y-hrzPc01GCs8Dc1g&sai=AMfl-YTVsfszI0NJx_KxnTwX7yVyF81EDXQHiASID4DVZ2MIazG6BTFE1jcbihxQWf_NNK1lmLuI3MiA4zG3f1jv6-7jzgMILkHkvwDA2G3SHGX2XJdENyLY_4FO0B4&sig=Cg0ArKJSzCEphai3UK1dEAE&cid=CAASJORoEBc9jGGrVkeZqhryycNxFpJBz7B5kh36xP6PupeGNNxSKg&id=lidar2&mcvt=1044&p=47,560,137,1288&mtos=1044,1044,1044,1044,1044&tos=1044,0,0,0,0&v=20220822&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2931586391&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1661375356723&rpt=1172&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 video-loader2.1-cr.js Show response
cdn.avantisvideo.com/js/ 115 KB
37 KB 9ms
9ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f85b446cf7c5640aa90f2663bf232af45a2d4ebd65fcf60a3105f400ea8bdac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: R3srv_l_.CCJ9VrYZEKFH47S4Xn_qYV0
content-encoding: gzip
last-modified: Mon, 15 Aug 2022 08:52:18 GMT
server: AmazonS3
age: 15114
etag: W/"e47a13a604e4ac4e6ccdc005c9e93287"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 16:57:26 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 5W0Llmcnmz0acVmaWFXL1FqWihjdJXEQ2j2rlcchmEX3tkzjmWkezQ==

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7226 42 B
64 B 48ms
48ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvoej1WwNV4ZgXhCDm2Fx_fJNh1Dj_ZNgxv0ulj7mHOaduMB-22Om93Gi2gETeEZkbDMWj9LOynnjdIuLgGDKw3zEVwXq7DZhEbdDb_jru18cip8FYbbmTp_7e_0X23IorwI13KQw&sai=AMfl-YTlU7KK8DrlZx26p4knZC0SuzMR0Mv48_fJd-wy7rWoHOHx7WY2yqDZqF7Xincdlyorismmw2jvVTg0NEUIyWzaTWvVwz1cIEPPHfkal64GRdrmTRDde76G1VU&sig=Cg0ArKJSzPoavR6AMiBmEAE&cid=CAASJORoJtX307u2RCgZn1CfBe729a7GUJ5uAKgO5As4xd0y7E5Emw&id=lidar2&mcvt=1022&p=993,970,1243,1270&mtos=0,1022,1022,1022,1022&tos=0,1022,0,0,0&v=20220822&bin=7&avms=nio&bs=0,0&mc=0.83&if=1&vu=1&app=0&itpl=20&adk=912788858&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1661375356758&rpt=1238&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 511C 42 B
64 B 54ms
53ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsst56U0g4hJ9fLZkapSMQmiRk6AUyirtefxHY5NVQfhcrEzNZC7hYXGXrX5BFimpIjSjiFX-IrJDx4UnO3ka2DgeZGb-Hyyt9GQZf9WqCzJ-iqGgHZUoJHDjBWsaicYWs7kpnh90t9T0DuUre6JZgT1x_UBIx_E_pVM&sai=AMfl-YTEPtnOhZX5iGBwi9yb0NGt7aawGm03UtdY8_BxQs_bQXoekryRKSacAR-pRqiXGvf6I0-2xC2hSeQRVBCYYHjALin3S34-rCxjqsnR3xPyNQuaVWtO2phj--0&sig=Cg0ArKJSzEI7jSHIyEAjEAE&cid=CAASF-RoWwB6nNNtUYJ6n4mLMotp7_LBWeSP&id=lidar2&mcvt=1023&p=995,402,1055,870&mtos=1023,1023,1023,1023,1023&tos=1023,0,0,0,0&v=20220822&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=3674860380&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1661375356768&rpt=1193&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B520 0
22 B 44ms
44ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B0B1ke5MGY6iHMpul9u8PsomwmAYAAAAAOAHgBAI&bg=!jI-lj8vNAAYUOm8VNDo7ACkAdvg8Ws7izPCnaquRWKfjIv-PazQdhKqja6bQ3TIGSoDAgMSv7H5LXwIAAAJsUgAAAAFoAQeZAzC39hc6v_s2QBf4brCcpjGEqczisBme_uiFLspt7FDptuXsxYzqkpm8-kvtoOMg9pMu3cv2v4e-NL_AhqvvrO3GrGUFkVx38yIIVYN4l_8sqDkDKq8wvasolQpOO3X4mY09Ge9x6_C8z-_0Tsu1DLdVMmGkHZCa9yGdBkIiBY9RjaiJiftQrbDrKaOq8UyHfbECpli8mNZZJTlRbxskSvQRtzuJSXWIuYssIFa1CNN8VdlcZ92zXLQIE4ZX75ID-4wX-86AtuA_Kk3dFkjD_sxHWQLG84ysFe_q6rG7I_S11HzS4NhYdIXNHd8PU91uIccxPG_zmDECGaGSQcwxC-SDxG3_0_wTTILK4nJycbcgH4JoFl11JiFNhIieGAl7be0W7Sve66BnGLOUr1i0Y2f4rSOiepKqOgxE-g7AD9CgkO0e7mnVfkArXzOYzAnfn2OACIl5hxPT8rEiYX_yHlXQcIM1_r6sQvBhG0Fkl58qK-5pkXzgqeJYJec9iXwqgJBESwLgNVvXkcNCbkRwO3wNM9rEANN0Sp0nAyEMdfRnrOHOssgx4p-eNplJnSrxodR8VvYqScFJFrg8cZfc3yCrQ7JUu9D0ui9RsoImvVU9XbuJEel7N1wnKsm0iXyiFYAsCWQvd_24rGOGt32_rtBWncJm7BIDH84FUC-suRSZ9oilC1wgZ_4VfiJM7g9oailRRuOXIkYrA0pfWT4YR20Szlj_66Ial9RFG2ZnW2hVdiJZHxX32X01c4ZXLh68EZ1J6ziQjxuYfJbGswkoKXToSpMMMn2DvRX8G4FvBanMVyOv3ImLvRrOxtiy7Mw-J6PQDzXcyj0ZDl4Y8SLUBs_ercEPmfNZ-4a01zl0GkPHi8NCdzpi79MGdEWTuQMDR129aA1odmTWo67AoxmTXBma8YQL3ZhA3vyhT-khyNTIP74olaLhPVBhpDlRgBXvHZAtT5H_m444uFssNCtjdAHdQEK7UbWhO9MNp7WNXo4uoi8BOhnAovcu-SEXaqxYlaJpyp-HACYt_Ih7wHFjKhcT4tz68zi6Q2nyo3A6ZunKrkB8cs7fopwheEN2Yb3ePUs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 66A1 0
22 B 44ms
44ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3ltbe5MGY6CKMpul9u8PsomwmAYAAAAAOAHgBAI&bg=!vL-lv_vNAAYUOm8VNDo7ACkAdvg8WrBY-12Y4sTV8k5qiLoplIn6oP_IUiiN1rhtTXuTZlp-0C-rYQIAAAJcUgAAAAFoAQeZA0yPUf6RE-JOH5xRlWMxw11-vq5iPyuXPJjcuoo3AhGEq0ss4iD4zCExPvhmUbfGc-W5CEiUo3c8i50by3UGFI0NarKdlZmEPoAUcRXJB8FyO-9DXha3YOqW9AKP70uTWSgy9HSixZvIQj1wTWLC74xZK9RJ6RYz5roqntYzBg0H3wUzKpZKoX-_W2eZ_GwI5EEoI8piF89v28MkyvJUEhkv60x8SD9yjo2Y2M555LC3CI2R4XhtEmvfgkIYdFnfv5oylsi4lXH_eXAIk0yXlvG5iLbyjzlbUSAhlGkB1iT8N23eD7Esv9yCq2-JUgPDvjCOVtY_Tk7w_kPmc2uZcLpsSgNOEJuYxRKVxascu9v8uxjOexUwz1p2uLNXAfrVoNyn30gpm_cC0pJReJv7azbpiiLz2pSkHkpWgAq3lZNeqI5n0SBd58I0Vbz07E8Vd61dAGwtAANE5nr6kvd6SS00cvm9FEaq-eDVYp_B93INfwomDWxZclv0F5XMLDwtgsOMi0cVLPWMcEozC7AKUTTKf78QZOrozD8W-OSkN969LYDNCuU_Qxcm6h7lat_E9N4xfd3s9wwwT2IqgmCS7sTaaeZCutMvvBGL_7pQF8lFi8A1o0AOUtd-xqW-PmgjeSkOQfnsdlQsBKsyVii34VjS75YKTll7VZ-1rCOxvKmlJWjTuoEywhKmAE_IEXf39-jiAi1JuLbfw3Bs-lvGkMb0r5iliYCbrvQg2cPE323SZaH-GIPhEe_5EMseJgKxx-kJKSaMpspAiwRuAKJ9XU0VtHqsPJLHzRb4gexzpVUzJjz-UUHcS5RZi-ttk2KcukDfxIRM2CjTbhzvOSEvNlQeXgFfZ6W7zxaLcew48zB6ZR5yNNptyeVQLgyu8c3TwgtRtWsdq3q6kCaAQhL2BOiX7LD7fNN_69d3PtGcnA6O85EaE0ytDGAz8NfDVA2_BIpYSfaZlfutjIGVP5_zVwn4HZ5OmPWJXDEfUL4dr4TuOztMN6riS0SCgEIkyosBeciN0i4g7Zb5x9PGdf8JYpSL9rWIyqIFEJYadw4VY1ncI5BnZLcSrAtDeGCM0pZGeDXAzqV-gz0ubHhMzS7vhdcCxvMZbA-400wBM5ee

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 video-loader2-cr.js Show response
cdn.avantisvideo.com/js/ 115 KB
37 KB 7ms
7ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/js/video-loader2-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b2675f2bc3393449a44784c7815f9c36449024e4397d7f174812c42c6bbaa148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: 23HYQ0o2ylfY4CikTtNpDIRIBjFm3stq
content-encoding: gzip
last-modified: Wed, 10 Aug 2022 07:12:05 GMT
server: AmazonS3
age: 50489
etag: W/"34fc05e1a66d53097cb2d428812d10e3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 07:07:51 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: FEtIXW0MDh4W-rN5HOoGGzuSXzraXNTuJL1b8VH2QkvEtCgkwOWHFQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2315 43 B
215 B 95ms
92ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=79e680a6-b2cc-df4f-f367-c2be50febad2&tv=%7Bc:mff4ob,time:1375,type:e,im:%7BpWait:85,pci:%7Btdr:1073%7D,pLoad:1091%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1376,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1370~0%5D,as:%5B197~0.0,1173~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:449,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e*.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h.1141311-65046770%7C1h1%7C1h2%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1e*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2315 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=79e680a6-b2cc-df4f-f367-c2be50febad2&tv=%7Bc:mff4od,pingTime:-10,time:1377,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8V2luMzJ8fEdlY2tvfHwyMDAzMDEwN3x8MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNC4wLjUxMTIuMTAxIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1661375358659%7C%7C60cdb2d19f10147aa5f07bac3e9b99ef%7C%7C5804921a8d3c64b26a083c50aad655e9%7C%7Cc75b217f4bc2c9d23a09056523dbbf0c%7C%7C50fedff9e0219c0ab66c4231b7887c41%7C%7C5ae3f242f4a3e677d53b228bda2dbf1d%7C%7Cfe84950ba8a0f542b00f7d1b642c1660%7C%7C609cbc5a766cdf005e04f20b0c418d99%7C%7C1629390669,sca:%7Bspg:da6541a0-7316-3f96-b625-2eb5f24be1cd%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 t Show response
avm.avantisvideo.com/api/v1/tag/1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53/1/desktop/generate/ 3 KB
3 KB 151ms
150ms XHR
text/plain 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://avm.avantisvideo.com/api/v1/tag/1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53/1/desktop/generate/t?subId=img1&browser=chrome&utm=img1&os=windows&url=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&eu=true&country=DE&hour=21&amp=false

Requested by

Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

f5cc0170d9bebf7d43aa74b381ff2899cc5a3d3fec051e7f7966451db10f0257

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
vary: Origin
content-length: 2771
x-xss-protection: 0
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
date: Wed, 24 Aug 2022 21:09:19 GMT
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.123greetings.com
access-control-allow-credentials: true
x-amz-cf-id: uhZwQrt4ttcVPDrcOsJYGcwixCPIfdRGCZSmzldnPr_eAsqtJAawDw==

OPTIONS
H2 204 t
avm.avantisvideo.com/api/v1/tag/1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53/1/desktop/generate/ Frame 0
0 289ms
289ms Preflight 2600:9000:223e:fc00:3:748e:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:fc00:3:748e:7940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.123greetings.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://www.123greetings.com
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Wed, 24 Aug 2022 21:09:19 GMT
expect-ct: max-age=0
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
x-amz-cf-id: Sdwzyt6uYjOgEhcV719qUJ4YffuaP6EkZXn8ZNynm2cWYvc615hVbQ==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

POST
H2 204 /
events1.avantisvideo.com/ 0
34 B 172ms
172ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:19 GMT

GET
H2 200 video-loader2.1-cr.js Show response
cdn.avantisvideo.com/js/ 115 KB
37 KB 8ms
7ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f85b446cf7c5640aa90f2663bf232af45a2d4ebd65fcf60a3105f400ea8bdac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: R3srv_l_.CCJ9VrYZEKFH47S4Xn_qYV0
content-encoding: gzip
last-modified: Mon, 15 Aug 2022 08:52:18 GMT
server: AmazonS3
age: 15114
etag: W/"e47a13a604e4ac4e6ccdc005c9e93287"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 16:57:26 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Ja78mLDUCeNX72rGVJ8BBmqac3YG0zbP-f9-kbOOkyk_e5deuBYPSQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7226 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=da6541a0-7316-3f96-b625-2eb5f24be1cd&tv=%7Bc:mff4pj,time:1500,type:e,im:%7Bpci:%7Btdr:1159%7D,pLoad:1178%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1500,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1493~0%5D,as:%5B446~0.0,1047~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:159,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h*.1141311-65046770%7C1h1%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1h*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

POST
H2 200 all
csm.eu.criteo.net/ Frame 788C 0
127 B 17ms
17ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 24 Aug 2022 21:09:18 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B6CA 0
22 B 44ms
44ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BNXA3fZMGY7KXAeeO9u8P-dOjyAoAAAAAOAHgBAI&bg=!UlGlURXNAAYUOm8VNDo7ACkAdvg8WqEGZzfiV-SNVP6-acjcuo-kNYJ_Y6uFR8ZMASM9MD6cLQPzOgIAAAGXUgAAAAJoAQeZAx6u9CkKRNueFGbuhj1AoCDUt3tkRHW63APz4T12QFnbDJoKqURBN8KlMBUk3TTN4x4T_YKYl5PRM3HALPcgMdAgodgX4Kn6uVt9dmqrCSlGE7PRp1sGWmyTPbYmJfz_fjLa1LZ1DBTMtHGZ14fh6LLiDAn5rfCsoM7q1AabRtEs9_UT19dwM8EPQMIs2Uk-r94KuO774jtNCB9UBJ_337ukB6SOUJ9R3GQ9tf_gZYJLocVe6swcCO-4YXZxxsj3tNyIrpB7PrIH88ELNyOQYY0It1NwocEDWMQAr5m7WoUfOHcf4dt8JDsVSRpK57CQNRQh99c6kDDDF9TfThK3moS_fZrtKK9UmFeLQ6tbx53BTIy1u8ckLQNuZPeJ2uWoyMrR4E6uERbF1UFTXBsxB-ghPlIr9h-f17oREbyGXfDMk0jHf2GgW6bjslNnFJvYVEPKmxEU-3WZhL0-ItR5hv2PAkcO2lqvxD_c8TMqly4zi7g7xIVG6APWtZQSWqM80dSMuqF-VM9CwdVRynV_K3iD7KMNnPyptnuWJiE-UvZg7ahT87SBTz_mBo6qiyyGe7exRHSaHtENYLU0D4gNM8lRlJDGYhQ6aipHQeSm7_VWKpPFc2s8Di-1NX0-42YnqJrezRGalppLIYEXkzR4v3q_Z-Qm7k6BRIC4hdJJ_mrBUe9tOpQkAmdaC5xCf98dxgiBzWl8wx7-KRP3QpuqObnfgFlBSN7pzrwuH8bPj7w1X4GcJzgD5_ve4gtcy4jHExnSGIfhFIyIlI8fDw2MSPTqMR7q6b-4_S59qZ95OoRy_i7WLLMa_kCTww2PG1FGmpo4IgthOfbHK0bPxzReS1X9mFuFO38S2uv24AmUnSgTefn3dRUeTer2lJNDZN_p4Zl7kHgcHK7CTpsCUlI0WT_ONJzu2FPMykX6ny2iW22yQBLXXE8NF_6F95Yj570Och3-VNXxwYFhZXfLZrV_vflyCLB9CLeJ_t2EIlhTtVbMKQDgS5GvOMrNuSR7hRbD2WCmdNcXHF62s2Q8vB9bLW01QXMO6-zRL4xGr9hKrII

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2138 0
22 B 44ms
44ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgbhofJMGY5PmO8ms9u8Pws-CyAsAAAAAOAHgBAI&bg=!kJOlk9fNAAYUOm8VNDo7ACkAdvg8WiGuf8eVMPE9hMt0289THgiebQ9QAmgmFy8810vHqnpIrT1m9QIAAAF_UgAAAANoAQeZA0lA9IHXHXn0Aw267DY6HsE_o-V0lM18bml35Jg1jlw2bD0RxC9MyD7cVNqqakbkS5FUuOhw4d3Vw0XzFsKD_3fu9j81aVjml3GXXDP9rXg-gwQJmWu7FTb21rhFkKL2fkMBc-rBNkjZexQHXZJ54v-BWS4mdCTAVjeyHGKwg3QE_rTaahDJtHRDh_P90i7fyMr5gnObzTCwLErieaJzUr8k8w2gZNmbmprv0AOdguqSNU-VAtF8eOqtWq8Kg2MQYu4SLFbDWROZ8G6uPqpGy-DWs2mLkoiDt6gLaALg0aE9Oy2L-R6xt0yaK8RysbTj9LhyN1bzC5hyPiw5Kli7C39tTesujWVlv_Q0AHcXnlWIJRrxntosEdKX6TSt7dcrC87ftinVUyVIoc7ljfje_Lutpsqwu5NeEGFWKz1_LGsOTyRnae1bhQuIRcEDtbuHJwC_3IsAfXKoAk3xreR2ZuHjzgDydeDIlyukDiRWimRMJZzvPE8ZbdtnYR_rcD1FzhewgbVJp5ug8kb_Xb-l8L6BD5d3Pn06m3BM4kV7WNwWB2tVnP_24ydWkQmZBaS57ND9iWLeEmcgtlyljTz4OtL3ZRYeEDwON0LyhoBTU8EhQx1iEOTU8y5101tEzZK84g1GaOYbaG8zc-GQfipg7rNapaO8VSR8X7Vf-Qmp7RPTObTwyx-A-tK9bejwvB7sxFcHA_dBeG4p7gR-rVw-JTj4jax5BAB526fsLjkL_iZTUG5vOFAt5AJlvN3FIONZB2lVS2IKEGvBrNzGs6Qn6asbVE2OppxMMXQFUFVj-6qqAZHZZgfi3pOzKJlQTeVqg0qEtpnfZ5EXdVqXbOI2CvMNg3ZdJl_RNQDK6lXijNxgCvVVaaEha5wA6lQGv6hm1TjwxhrkPVB44uIFnON0buLlmpvW5rl5W-Zs69jt7QZBIBL18iJhtA0R8OXTyJx5bOjSjliu4nwWniZsWx_FhHHZtnSm0HMwWTzdL16RlK6dPUvBVj4x2j1zO3LqNEmJjnNwKunf9L6U6WQ_ARYUQrgpn1zBhAHVPEo_1woNUmvS-qGyQyrJF2ZKgH5NJ55Dvh6ptBl1gd9_3G6QzcBMZkXXTSaj02EnLDAY

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 48 KB
48 KB 24ms
23ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478446
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H2 200 3.ef52796c7477ec4eb321-video-loader2.1-cr.js Show response
cdn.avantisvideo.com/js/ 22 KB
8 KB 8ms
7ms Script
application/javascript 2600:9000:2057:a600:1c:38a0:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.avantisvideo.com/js/3.ef52796c7477ec4eb321-video-loader2.1-cr.js
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:a600:1c:38a0:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: df9967e26296ab6659acbbecd377f7933cd3743d50935a5c44c800f90b9c6687

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id: 6v8pusNP91qhc6WfOs2Z_DMNTyQxoq0Q
content-encoding: gzip
last-modified: Mon, 15 Aug 2022 08:52:18 GMT
server: AmazonS3
age: 11004
etag: W/"97f2ecd515fcc6a9d26763251ef08b4f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
date: Wed, 24 Aug 2022 18:06:00 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: XTUasq5aC8BX14huDphep1Uo40sOcjwaG8yW6nPdRBTUt4S9zOWHJQ==

GET
H/1.1 200
OK adb.js Show response
play.aniview.com/59918a0e073ef4782e4e347f/5ebd46100b22d93ee56a465f/ 2 B
765 B 24ms
7ms Script
text/javascript 2a02:26f0:3500:595::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://play.aniview.com/59918a0e073ef4782e4e347f/5ebd46100b22d93ee56a465f/adb.js
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/3.ef52796c7477ec4eb321-video-loader2.1-cr.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:595::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: d8a957038679125d4840554fc43375697e662283121561afdefc2c3fbecaf729

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Unused62: 8096267
Date: Wed, 24 Aug 2022 21:09:19 GMT
X-GUploader-UploadID: ABg5-UyceNYD8FEdWQb3EsKqZxhyLaQsoF5fAeemPciJDGSGGF4ULfrcEwEz_akWP2UPcpXtifCcA1iL2DSxDFRze85Z1ot-ZA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 2
Last-Modified: Thu, 14 May 2020 13:22:36 GMT
Server: UploadServer
ETag: "56f785241d0ed9fe51a8170b9dd50272"
x-goog-hash: crc32c=cz4mSA==
x-goog-generation: 1589462556858294
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type
Cache-Control: public, max-age=1800
x-goog-stored-content-length: 2
Accept-Ranges: bytes
Content-Type: text/javascript
Expires: Wed, 24 Aug 2022 21:39:19 GMT

GET
H2 200 aniview.js Show response
player.aniview.com/script/6.1/ 28 KB
10 KB 125ms
9ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/aniview.js
Requested by: Host: cdn.avantisvideo.com
URL: https://cdn.avantisvideo.com/js/video-loader2.1-cr.js?id=1c35f5e5-f7c0-4c97-8283-6c9f94ba8c53&tagId=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 92aadb0838b3b1b154749a5cd5420e19108ce0ea60beb102d822f7fff9556960

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:19 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdsyMpma_0QDBTLBJ1f8S3UOZFbcTSXMjvmUztyh8J9AdmsG29QhKAz77XybbPkx9nS6UvRIoMySXeQi8g6AIYVT9eUqkz_w
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 9906
last-modified: Wed, 24 Aug 2022 10:31:20 GMT
server: UploadServer
etag: "09838a49c2a3fa2383a6f01fd510cb42"
vary: Accept-Encoding
x-goog-hash: crc32c=H4rfvQ==, md5=CYOKScKj+iODpvAf1RDLQg==
x-goog-generation: 1661337080233802
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 9906
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:19 GMT

GET
H2 200 AVmanager.js Show response
player.aniview.com/script/6.1/ Frame E5E1 388 KB
110 KB 34ms
33ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/aniview.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 32391604d5aeb3b40104ca4916654797346abbeeab52e663216c779df49e7848

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:19 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtSos7KbOLLszfGl_Ud4zDYtK-Kc2ApGc4S0nZDSOhuYiFpOlOK0Lmx_bRrl7D2CiA0rrubTyX50N1-hceaub-TwZPI4rJd
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 112008
last-modified: Wed, 24 Aug 2022 10:31:20 GMT
server: UploadServer
etag: "bf33721661980060bff37cac79c4523d"
vary: Accept-Encoding
x-goog-hash: crc32c=RVkgsw==, md5=vzNyFmGYAGC/83ysecRSPQ==
x-goog-generation: 1661337080137729
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 112008
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:19 GMT

GET
H2 200 AVmanager.js Show response
player.aniview.com/script/6.1/ Frame A51D 388 KB
110 KB 33ms
33ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/aniview.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 32391604d5aeb3b40104ca4916654797346abbeeab52e663216c779df49e7848

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:19 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtSos7KbOLLszfGl_Ud4zDYtK-Kc2ApGc4S0nZDSOhuYiFpOlOK0Lmx_bRrl7D2CiA0rrubTyX50N1-hceaub-TwZPI4rJd
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 112008
last-modified: Wed, 24 Aug 2022 10:31:20 GMT
server: UploadServer
etag: "bf33721661980060bff37cac79c4523d"
vary: Accept-Encoding
x-goog-hash: crc32c=RVkgsw==, md5=vzNyFmGYAGC/83ysecRSPQ==
x-goog-generation: 1661337080137729
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 112008
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:19 GMT

POST
H/1.1 200
OK postback Show response
s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/ 0
145 B 29ms
28ms XHR
text/plain 34.240.212.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.gk.123greetings.com/2/2.66.1/945541/AXhkb7sWEAb83XmL/postback?dt=9455411658248091559000&pd=mkt&mo=0&si=main&ci=945541&sid=AXhkb7sWEAb83XmL&oz_sc=44562ccf9514c56e1d0b0853&oz_df=1661375359968&oz_l=1999&cv=3
Requested by: Host: s.gk.123greetings.com
URL: https://s.gk.123greetings.com/2/2.66.1/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.240.212.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-212-15.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Aug 2022 21:09:19 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 track
track1.aniview.com/ 0
71 B 348ms
100ms Image
text/plain 35.173.69.21

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?r=www.123greetings.com&sn=img1&ic=0&tgt=0&app=&wi=400&he=225&test=&d36=6.2.51&apppkg=&fv=3&proto=https&clsid=997c7f1c-29a9-4be3-a1e2-9e404e7001fc&rando=58&pid=5e5bd02728a06124e30d85c3&cid=5e5bd1f528a0610dd725f7d8&stagid=&stplid=&e=inventory&vi=100&cb=1661375360062
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.69.21 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
track1.aniview.com/ 0
70 B 344ms
102ms Image
text/plain 35.173.69.21

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?r=www.123greetings.com&sn=img1&ic=0&tgt=0&app=&wi=600&he=338&test=3&d36=6.2.51&apppkg=&fv=3&proto=https&clsid=2ea54159-0dd3-49bd-bdb7-0891e123b042&rando=99&pid=5e5bd02728a06124e30d85c3&cid=5ec3e3871f5e5c792c20f9f7&stagid=&stplid=&e=inventory&vi=100&cb=1661375360069
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.69.21 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9e42e2c7cd3ec42f6febe248c715522b2e5f6bc92b389b101fbd33a069ee7ed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 740 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a9054758a4808c97c188f5be469879eef19a2f7cbd9bb0e740cee3199a6c747

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 384 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8030594b4999eca38901464b09383ca988c454a4f7ab6b963be75e6c42da011d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 782 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5028f77ac0afdac1bb66eaeeef41e77cea0f2487a66cb1df354d8680db1bb64e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 395 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f0d7d05ef7ae154e283b8c8e462aeb6e9b5bca53225c42743e2028c34828c08a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 449 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f86a1105ed755e9ae9b75708a5b19d5c478212605b9f8d7c98796b451de18c63

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 577 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d23484cf0f36a73cc699ceffc6da8f0e9ffd6b372dcb615ec942cdc287845505

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 / Show response
go1.aniview.com/api/adserver/tag/ 30 KB
5 KB 346ms
140ms XHR
application/json 18.206.3.164

General

Check archive.org

Show headers Download Go to

Full URL: https://go1.aniview.com/api/adserver/tag/?AV_URL=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4&AV_SUBID=img1&AV_SECURED=1&AV_LANGUAGE=en&AV_PUBLISHERID=5e5bd02728a06124e30d85c3&AV_CHANNELID=5e5bd1f528a0610dd725f7d8&tgt=0&AV_CDIM1=&AV_CDIM2=&AV_CDIM3=&AV_ABT=&pce=1&npx=1&AV_DETDOMAIN=www.123greetings.com&AV_DADPOS=3&d36=6.2.51&responsive=1&sver=2&avtoken=360062&omv=1.0.1&clsid=997c7f1c-29a9-4be3-a1e2-9e404e7001fc&rando=58&AV_WIDTH=400&AV_HEIGHT=225&AV_DNT=0&cb=1661375360108&wfc=1
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.206.3.164 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01374b079615fb13e56bd755f1d1ca178a57d1be4fca759f369b4a6c5154db2f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Sat, 13 Aug 2022 07:22:40 GMT

GET
H2 200 / Show response
go1.aniview.com/api/adserver/tag/3/ 30 KB
5 KB 398ms
199ms XHR
application/json 18.206.3.164

General

Check archive.org

Show headers Download Go to

Full URL: https://go1.aniview.com/api/adserver/tag/3/?AV_URL=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source&utm_medium=newsletter&utm_campaign=Aug22_nl_wk4&AV_SUBID=img1&AV_SECURED=1&AV_LANGUAGE=en&AV_PUBLISHERID=5e5bd02728a06124e30d85c3&AV_CHANNELID=5ec3e3871f5e5c792c20f9f7&tgt=0&AV_CDIM1=&AV_CDIM2=&AV_CDIM3=&AV_ABT=3&pce=1&npx=1&AV_DETDOMAIN=www.123greetings.com&AV_DADPOS=3&d36=6.2.51&responsive=1&sver=2&avtoken=360069&omv=1.0.1&clsid=2ea54159-0dd3-49bd-bdb7-0891e123b042&rando=99&AV_WIDTH=600&AV_HEIGHT=338&AV_DNT=0&cb=1661375360116&wfc=1
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.206.3.164 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d1cd9895fe97a1b69d05f629d44c20b88e3686656d0ed54e7aa39d7f9b13eea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Sat, 13 Aug 2022 07:22:40 GMT

POST
H2 204 /
events1.avantisvideo.com/ 0
34 B 172ms
171ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT

POST
H2 204 /
events1.avantisvideo.com/ 0
34 B 171ms
171ms Ping
text/plain 52.36.72.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events1.avantisvideo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.36.72.203 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-36-72-203.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2315 43 B
215 B 92ms
92ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=79e680a6-b2cc-df4f-f367-c2be50febad2&tv=%7Bc:mff4Gx,pingTime:1,time:2513,type:p,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:23%7D,%7Br:r,w:728,h:90,t:203%7D,%7Bpiv:100,vs:i,r:,t:1489%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1024,o:1489,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1483~0,0~100%5D,as:%5B197~0.0,1286~728.90%5D%7D%7D,%7Bsl:i,t:1489,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1024~100%5D,as:%5B1024~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:126,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e*.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h.1141311-65046770%7C1h1%7C1h2%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1e*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2315 43 B
215 B 93ms
92ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=79e680a6-b2cc-df4f-f367-c2be50febad2&tv=%7Bc:mff4Gx,pingTime:1,time:2513,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:23%7D,%7Br:r,w:728,h:90,t:203%7D,%7Bpiv:100,vs:i,r:,t:1489%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1024,o:1489,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1483~0,0~100%5D,as:%5B197~0.0,1286~728.90%5D%7D%7D,%7Bsl:i,t:1489,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1024~100%5D,as:%5B1024~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:126,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e*.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h.1141311-65046770%7C1h1%7C1h2%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1e*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
x-server-name: dt26.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7226 43 B
215 B 93ms
92ms Image
image/gif 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1141311&asId=da6541a0-7316-3f96-b625-2eb5f24be1cd&tv=%7Bc:mff4I7,pingTime:1,time:2666,type:p,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:26%7D,%7Br:r,w:300,h:250,t:453%7D,%7Bpiv:83,vs:i,r:,t:1636%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1030,o:1636,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1629~0,0~75%5D,as:%5B446~0.0,1183~300.250%5D%7D%7D,%7Bsl:i,t:1636,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:83,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1030~75%5D,as:%5B1030~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:105,fm:tfsRGNf+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b%7C1c%7C1d%7C1e.1141311-65046779%7C1e1%7C1f1%7C1f2%7C1f3%7C1g1%7C1g2%7C1h*.1141311-65046770%7C1h1%7C1i1%7C1i2%7C1i3%7C1j1%7C1j2%7C1j3%7C1k%7C1l1%7C1l2%7C1l3%7C1m1%7C1m2%7C1m3%7C1n1%7C1o1,idMap:1h*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET

cookiesyncendpoint
sync.aniview.com/ Frame A902
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D55%26key%3D%24UID
https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=55&key=4924864200398375348

0
0

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame B8B7 0
0 45ms
15ms Document
text/plain 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/pixel?us_privacy=1---&gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D18%26key%3D%24UID
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
date: Wed, 24 Aug 2022 21:09:20 GMT
pod: X-Sovrn-Pod: ad_ap6ams1

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58543/ Frame B26B 0
0 11ms
11ms Document
text/plain 3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58543/occ?gdpr=1&gdpr_consent=

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.25 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 0
date: Wed, 24 Aug 2022 21:09:20 GMT
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
server: ATS/9.1.10.25
strict-transport-security: max-age=31536000

GET
H2 204 services
sync.technoratimedia.com/ Frame 6791 0
0 328ms
93ms Document
text/plain 129.159.70.95

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=70&uid=1661375360368-929089296316-007184-009-006119&cb=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D3%26key%3D%5BUSER_ID%5D
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 129.159.70.95 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST,GET,HEAD,OPTIONS
access-control-allow-origin: https://www.123greetings.com/
age: 0
date: Wed, 24 Aug 2022 21:09:20 GMT
server: nginx
via: 1.1 varnish
x-varnish: 496656486

GET

cookiesyncendpoint
sync.aniview.com/ Frame 22B9
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=aniview&gdpr=1&gdpr_pd=0&gdpr_consent=&redir=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26bid...
https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=200&key=OPTOUT

0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E3ED 15 KB
6 KB 241ms
8ms Document
text/html 23.35.236.201

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=160993&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D1%26key%3D
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://www.123greetings.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=138986
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Wed, 24 Aug 2022 21:09:20 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 26 Aug 2022 11:45:46 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET

cookiesyncendpoint
sync.aniview.com/ Frame 0449
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D56%26pid%3D59c9148628a0612da3689288%26key%...
https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=56&pid=59c9148628a0612da3689288&key=ae49bf5f-f9d5-42ce-a952-cd45d1548c84

0
0

GET
H2 200 avpb6.27.0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame E5E1 178 KB
54 KB 12ms
11ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 3c94d07090acdd3c44fa5f23a2c957c961c7413129f068acecf17f1402102c4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdt8tY4dcO-kjiGNYc3xE_kkYW1y7VM8HwLxguy3h1hcjFzni0bJUj6Q_4UxInCeVGJ0fBaHL1fEDOkx9pK_Op9m
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 54791
last-modified: Wed, 24 Aug 2022 10:31:20 GMT
server: UploadServer
etag: "af48193aba16d7712529a8995a75eeb9"
vary: Accept-Encoding
x-goog-hash: crc32c=k2tRDg==, md5=r0gZOroW13ElKaiZWnXuuQ==
x-goog-generation: 1661337080794372
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 54791
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 avpb6.27.0a0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame E5E1 73 KB
25 KB 15ms
15ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0a0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 57a18b6c18cc1cb382fc80abd6302ee9c092d472b15d257fd911d942e6def986

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdvBaoACUNKgrI9m60UqYwfS--xPTE4eZkuT7rTIAXixZZuW8BLtEc5ytX2u_vEIO301UIVTlVkSZjdlmBjIC3h5Mg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 24663
last-modified: Wed, 24 Aug 2022 10:31:21 GMT
server: UploadServer
etag: "a4f14cbae4c6fc5672b499b33c5e73a5"
vary: Accept-Encoding
x-goog-hash: crc32c=iuBUqA==, md5=pPFMuuTG/FZytJmzPF5zpQ==
x-goog-generation: 1661337080927641
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 24663
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 avpb6.27.0a1.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame E5E1 71 KB
22 KB 20ms
19ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0a1.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 9ff07ed2c891ed887a0e9eb61461ca9c00277a27fd98d73e40d60b91b2eb86f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtjRg15JXefmN7PJxwQL5fD3a-uL2tcnHUpiemeLUc-rkOS0S2UW8aBdHzGfEBYZjbLMYqSSfi3o2UMwaOjv8yWzw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 22126
last-modified: Wed, 24 Aug 2022 10:31:21 GMT
server: UploadServer
etag: "3502a80d97e87aca03fb073d2e77b0f3"
vary: Accept-Encoding
x-goog-hash: crc32c=d5hNcQ==, md5=NQKoDZfoesoD+wc9Lnew8w==
x-goog-generation: 1661337080859842
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 22126
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 avpb6.27.0a3.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame E5E1 66 KB
20 KB 23ms
23ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0a3.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 737ecccfd5058eeb7a46e5ea9616822be78a60668342b22f2fcfae3130f7d8c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtwsmTDdwj9LpN0hE3ZC94VHYXE8Z3N2UPR9me-hDja3dUoGtJvqoe3v51zMxpE_2cZqmKvD8IZaAzQqAm6IwZsJ3MnfAd_
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 20155
last-modified: Wed, 24 Aug 2022 10:31:21 GMT
server: UploadServer
etag: "960798e77f6b33f32993b4b2cd8fc311"
vary: Accept-Encoding
x-goog-hash: crc32c=awWTIQ==, md5=lgeY539rM/Mpk7SyzY/DEQ==
x-goog-generation: 1661337080869276
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 20155
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 adServe.do Show response
web.ssp.yahoo.com/admax/ 240 B
546 B 356ms
137ms Fetch
text/xml 18.156.195.47

General

Check archive.org

Show headers Download Go to

Full URL: https://web.ssp.yahoo.com/admax/adServe.do?dcn=8a969558018080038b3c07fe379f0081&pos=8a969558018080038b3c07ff3c3d0083&secure=1&euconsent=&gdpr=1&us_privacy=1---&d(id24)=&ht=225&wd=400&reserve=4.8&req(url)=123greetings.com&schain=1.0,1!avantisvideo.com,8079,1,,,!aniview.com,59918a0e073ef4782e4e347f,1,,,&cbb=1375360475&imp_id=9004aa61-9793-46c5-9340-272bd581a327
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 -, , ASN (),
Reverse DNS
Software: ATS/9.1.10.25 /
Resource Hash: 1dbfeb07cd50a1857b9576b5415f8a4c6ef010279666f39448fa0aa125d433b7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
server: ATS/9.1.10.25
age: 0
access-control-allow-methods: GET,POST
content-type: text/xml;charset=utf-8
access-control-allow-origin: https://www.123greetings.com
access-control-expose-headers: X-Nexage-AdTid
cache-control: no-store, no-cache, must-revalidate, max-age=0, no-transform, post-check=0, pre-check=0
access-control-allow-credentials: true
content-length: 240
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK ptv Show response
ib.adnxs.com/ 85 B
1 KB 131ms
130ms Fetch
application/xml 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ptv?id=19012622&referrer=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source&us_privacy=1---&cbb=1375360477&imp_id=9004aa61-9793-46c5-9340-272bd581a327

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

b2effcb18f514a7896e737bdda537f2ef3b5bb989eb247f4ab2aa3facf1148ea

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:20 GMT
X-Proxy-Origin: 80.255.10.202; 80.255.10.202; 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6ffd167f-828a-4a3f-9cb6-4ab5e2fce657
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.123greetings.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/xml; charset=utf-8
Content-Length: 85
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 track
track1.aniview.com/ 0
70 B 108ms
107ms Image
text/plain 35.173.69.21

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?d=Chrome&cou=DE&cos=Windows&r=www.123greetings.com&rs=www.123greetings.com&sid=91395&t=1661375360&cip=80.255.10.202&sn=img1&tgt=0&osv=10&bv=104.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=5e5bd02728a06124e30d85c3&test=&aafaid=&proto=https&uid=1661375360368-929089296316-007184-009-006119&cha=0.7&stagid=&stplid=&d35=&d36=6.2.51&cb=58176249475&d39=&d65=&apppkg=&d9=1000&AV_WIDTH=400&AV_HEIGHT=225&&ppid=5e5bd02728a06124e30d85c3&nid=59918a0e073ef4782e4e347f&pcid=5e5bd1f528a0610dd725f7d8&ncid=5e8b3e740cd6ad6132403f66&pasid=5e8b42ae145a8138e61d4a85&e=request&cb=1661375360478&asid=6102687900a33569ec0d3097%2C60e594da4123720f2e250d24%2C628b7da850e97943a83f7d3b%2C626a7b5c1576bc4c20574e49%2C62d3f4e0d8665b0ec66c9327%2C62b86e392f65d47a516f6f3b%2C5e9030afdc817965520eb855%2C626a7b7bc98a5f17f9370c17%2C6114f48c04b3691b08691b7c%2C6114f476dd0eb2621e735342&ofpr=%2C%2C1.3%2C0.35%2C0.2%2C0.2%2C%2C0.15%2C0.13%2C0.12&fpo=%2C%2C%2C%2C%2C%2C%2C%2C%2C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.69.21 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
track1.aniview.com/ 0
70 B 106ms
106ms Image
text/plain 35.173.69.21

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?d=Chrome&cou=DE&cos=Windows&r=www.123greetings.com&rs=www.123greetings.com&sid=91395&t=1661375360&cip=80.255.10.202&sn=img1&tgt=0&osv=10&bv=104.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=5e5bd02728a06124e30d85c3&test=&aafaid=&proto=https&uid=1661375360368-929089296316-007184-009-006119&cha=0.7&stagid=&stplid=&d35=&d36=6.2.51&cb=58176249475&d39=&d65=&apppkg=&d9=1000&AV_WIDTH=400&AV_HEIGHT=225&&copid=59918a0e073ef4782e4e347f&nid=59c9148628a0612da3689288&cocid=5e8b3e740cd6ad6132403f66&ncid=6252cd490f4ad400b27f24ae&coasid=628cec03ef40666330025114&e=request&cb=1661375360478&asid=62b1a8beecf705053613baa5%2C6250243f0f4db040a1785fc9%2C62a704a4e22df13bef59f407%2C6252bf57e35a4e32222ec526&ofpr=%2C5%2C%2C4&fpo=%2C%2C%2C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.69.21 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H/1.1 206
Partial Content 12523.mp3
i.123g.us/c/eaug_nationalwaffle_day/mp3/ 48 KB
48 KB 34ms
29ms Media
audio/mpeg 8.238.176.252
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.238.176.252 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d

Request headers

Referer: https://www.123greetings.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 27 Jul 2022 04:41:53 GMT
Last-Modified: Fri, 03 Dec 2021 05:24:08 GMT
Server: Apache/2.2.15 (CentOS)
Age: 2478447
ETag: "c03f-5d2371dc46e00"
Content-Type: audio/mpeg
Content-Range: bytes 0-49214/49215
Cache-Control: max-age=900
Connection: keep-alive
Content-Length: 49215
jake_test: Test_Pass
Expires: Wed, 27 Jul 2022 04:56:53 GMT

GET
H2 200 avpb6.27.0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame A51D 178 KB
54 KB 11ms
10ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 3c94d07090acdd3c44fa5f23a2c957c961c7413129f068acecf17f1402102c4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdt8tY4dcO-kjiGNYc3xE_kkYW1y7VM8HwLxguy3h1hcjFzni0bJUj6Q_4UxInCeVGJ0fBaHL1fEDOkx9pK_Op9m
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 54791
last-modified: Wed, 24 Aug 2022 10:31:20 GMT
server: UploadServer
etag: "af48193aba16d7712529a8995a75eeb9"
vary: Accept-Encoding
x-goog-hash: crc32c=k2tRDg==, md5=r0gZOroW13ElKaiZWnXuuQ==
x-goog-generation: 1661337080794372
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 54791
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 avpb6.27.0a0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame A51D 73 KB
25 KB 13ms
12ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0a0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 57a18b6c18cc1cb382fc80abd6302ee9c092d472b15d257fd911d942e6def986

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdvBaoACUNKgrI9m60UqYwfS--xPTE4eZkuT7rTIAXixZZuW8BLtEc5ytX2u_vEIO301UIVTlVkSZjdlmBjIC3h5Mg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 24663
last-modified: Wed, 24 Aug 2022 10:31:21 GMT
server: UploadServer
etag: "a4f14cbae4c6fc5672b499b33c5e73a5"
vary: Accept-Encoding
x-goog-hash: crc32c=iuBUqA==, md5=pPFMuuTG/FZytJmzPF5zpQ==
x-goog-generation: 1661337080927641
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 24663
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 avpb6.27.0a1.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame A51D 71 KB
22 KB 15ms
14ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0a1.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 9ff07ed2c891ed887a0e9eb61461ca9c00277a27fd98d73e40d60b91b2eb86f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtjRg15JXefmN7PJxwQL5fD3a-uL2tcnHUpiemeLUc-rkOS0S2UW8aBdHzGfEBYZjbLMYqSSfi3o2UMwaOjv8yWzw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 22126
last-modified: Wed, 24 Aug 2022 10:31:21 GMT
server: UploadServer
etag: "3502a80d97e87aca03fb073d2e77b0f3"
vary: Accept-Encoding
x-goog-hash: crc32c=d5hNcQ==, md5=NQKoDZfoesoD+wc9Lnew8w==
x-goog-generation: 1661337080859842
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 22126
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 avpb6.27.0a3.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame A51D 66 KB
20 KB 17ms
17ms Script
application/javascript 2a02:26f0:3500:58c::2c79

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0a3.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:58c::2c79 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 737ecccfd5058eeb7a46e5ea9616822be78a60668342b22f2fcfae3130f7d8c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtwsmTDdwj9LpN0hE3ZC94VHYXE8Z3N2UPR9me-hDja3dUoGtJvqoe3v51zMxpE_2cZqmKvD8IZaAzQqAm6IwZsJ3MnfAd_
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 20155
last-modified: Wed, 24 Aug 2022 10:31:21 GMT
server: UploadServer
etag: "960798e77f6b33f32993b4b2cd8fc311"
vary: Accept-Encoding
x-goog-hash: crc32c=awWTIQ==, md5=lgeY539rM/Mpk7SyzY/DEQ==
x-goog-generation: 1661337080869276
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 20155
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 24 Aug 2022 21:14:20 GMT

GET
H2 200 adServe.do Show response
web.ssp.yahoo.com/admax/ 240 B
276 B 318ms
149ms Fetch
text/xml 18.156.195.47

General

Check archive.org

Show headers Download Go to

Full URL: https://web.ssp.yahoo.com/admax/adServe.do?dcn=8a969558018080038b3c07fe379f0081&pos=8a969558018080038b3c07ff3c3d0083&secure=1&euconsent=&gdpr=1&us_privacy=1---&d(id24)=&ht=338&wd=600&reserve=4.8&req(url)=123greetings.com&schain=1.0,1!avantisvideo.com,8079,1,,,!aniview.com,59918a0e073ef4782e4e347f,1,,,&cbb=1375360530&imp_id=8e3cfdfa-7240-4bce-8c9b-fdd0c8719058
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 -, , ASN (),
Reverse DNS
Software: ATS/9.1.10.25 /
Resource Hash: 1dbfeb07cd50a1857b9576b5415f8a4c6ef010279666f39448fa0aa125d433b7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
server: ATS/9.1.10.25
age: 0
access-control-allow-methods: GET,POST
content-type: text/xml;charset=utf-8
access-control-allow-origin: https://www.123greetings.com
access-control-expose-headers: X-Nexage-AdTid
cache-control: no-store, no-cache, must-revalidate, max-age=0, no-transform, post-check=0, pre-check=0
access-control-allow-credentials: true
content-length: 240
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK ptv Show response
ib.adnxs.com/ 85 B
1 KB 126ms
126ms Fetch
application/xml 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=5e5bd02728a06124e30d85c3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

b2effcb18f514a7896e737bdda537f2ef3b5bb989eb247f4ab2aa3facf1148ea

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Aug 2022 21:09:20 GMT
X-Proxy-Origin: 80.255.10.202; 80.255.10.202; 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5da0c92f-6d06-4727-baa5-519a3446216a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.123greetings.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/xml; charset=utf-8
Content-Length: 85
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 track
track1.aniview.com/ 0
70 B 102ms
102ms Image
text/plain 35.173.69.21

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?d=Chrome&cou=DE&cos=Windows&r=www.123greetings.com&rs=www.123greetings.com&sid=24517&t=1661375360&cip=80.255.10.202&sn=img1&tgt=0&osv=10&bv=104.0&brn=Chrome&wi=600&he=338&app=&AV_PUBLISHERID=5e5bd02728a06124e30d85c3&test=3&aafaid=&proto=https&uid=1661375360368-984087307316-007502-013-004696&cha=0.7&stagid=&stplid=&d35=&d36=6.2.51&cb=96395663481&d39=&d65=&apppkg=&d9=1000&AV_WIDTH=600&AV_HEIGHT=338&&ppid=5e5bd02728a06124e30d85c3&nid=59918a0e073ef4782e4e347f&pcid=5ec3e3871f5e5c792c20f9f7&ncid=5e8b3e740cd6ad6132403f66&pasid=5e8b42ae145a8138e61d4a85&e=request&cb=1661375360532&asid=6102687900a33569ec0d3097%2C60e594da4123720f2e250d24%2C628b7da850e97943a83f7d3b%2C626a7b5c1576bc4c20574e49%2C62d3f4e0d8665b0ec66c9327%2C62b86e392f65d47a516f6f3b%2C5e9030afdc817965520eb855%2C626a7b7bc98a5f17f9370c17%2C6114f48c04b3691b08691b7c%2C6114f476dd0eb2621e735342&ofpr=%2C%2C1.3%2C0.35%2C0.2%2C0.2%2C%2C0.15%2C0.13%2C0.12&fpo=%2C%2C%2C%2C%2C%2C%2C%2C%2C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.69.21 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
track1.aniview.com/ 0
70 B 102ms
101ms Image
text/plain 35.173.69.21

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?d=Chrome&cou=DE&cos=Windows&r=www.123greetings.com&rs=www.123greetings.com&sid=24517&t=1661375360&cip=80.255.10.202&sn=img1&tgt=0&osv=10&bv=104.0&brn=Chrome&wi=600&he=338&app=&AV_PUBLISHERID=5e5bd02728a06124e30d85c3&test=3&aafaid=&proto=https&uid=1661375360368-984087307316-007502-013-004696&cha=0.7&stagid=&stplid=&d35=&d36=6.2.51&cb=96395663481&d39=&d65=&apppkg=&d9=1000&AV_WIDTH=600&AV_HEIGHT=338&&copid=59918a0e073ef4782e4e347f&nid=59c9148628a0612da3689288&cocid=5e8b3e740cd6ad6132403f66&ncid=6252cd490f4ad400b27f24ae&coasid=628cec03ef40666330025114&e=request&cb=1661375360532&asid=62b1a8beecf705053613baa5%2C6250243f0f4db040a1785fc9%2C62a704a4e22df13bef59f407%2C6252bf57e35a4e32222ec526&ofpr=%2C5%2C%2C4&fpo=%2C%2C%2C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.69.21 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.123greetings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

OPTIONS
H2 200 PBJS
c2shb.pubgw.yahoo.com/admax/bid/partners/ Frame 0
0 34ms
10ms Preflight 52.28.203.152

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 -, , ASN (),
Reverse DNS
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://www.123greetings.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.123greetings.com
access-control-max-age: 600
age: 0
content-length: 0
date: Wed, 24 Aug 2022 21:09:20 GMT
server: ATS/9.1.10.25

GET tag
p4dt2-ha1hf.ads.tremorhub.com/ad/ 0
0

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 36 B
311 B 125ms
100ms XHR
application/json 104.18.18.126

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=512884&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%223c9944d5a819e4%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A1%2C%22allu%22%3A1%2C%22ren%22%3Atrue%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%224fcc0be4f0a91c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22512884%22%2C%22fl%22%3A%22p%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A60%2C%22api%22%3A%5B2%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A4%7D%2C%22bidfloor%22%3A0.12%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22avantisvideo.com%22%2C%22sid%22%3A%228079%22%2C%22hp%22%3A1%7D%5D%2C%22ver%22%3A%221.0%22%7D%7D%7D%7D
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dc9230f4c046615ef7549ab15ca40b8b2aa811251c8bb1049d817c77909656e

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 36
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=adn3ojsG%2FDATRExj%2BdJbgdlFUVF5vYkMKYNWkpNVrB4IZpoW1Wx6sNUxNDx8ybzkVqG7yReaSouLHbAjutKSRJvKwsUhgIWQCyUbFVJVoC8l70P5njif9TctHBqtXoo%2FugY%2F34qu"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 73ff1184cf358fc8-FRA
expires: 0

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
110 B 97ms
95ms XHR
text/plain 18.156.195.47

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 -, , ASN (),
Reverse DNS
Software: ATS/9.1.10.25 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.123greetings.com
date: Wed, 24 Aug 2022 21:09:20 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 184 B
410 B 34ms
12ms XHR
application/json 18.195.44.243

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.44.243 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b0e383dabe4181f3ddda94f647e13c70ebd2e9c197a3c76db4f5accad3d0d37

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.96.0
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 173
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
142 B 100ms
30ms XHR
text/plain 13.38.220.224

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.38.220.224 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.123greetings.com
date: Wed, 24 Aug 2022 21:09:20 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
414 B 29ms
11ms XHR
application/json 18.195.44.243

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.44.243 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f759c3bab951e2d100836674898661df8c0da89d8849d8e679cfa98620eb7042

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.96.0
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 176
expires: 0

POST prebid
ib.adnxs.com/ut/v3/ 0
0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
412 B 30ms
16ms XHR
application/json 18.195.44.243

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.44.243 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69f133775d99422e513d7d2bf86de55856fa87e7eeac9567a74e558d15580cbd

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.96.0
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 175
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
367 B 10ms
9ms XHR
application/json 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://www.123greetings.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame E3ED 0
39 B 14ms
12ms Script
text/plain 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=78862432&p=160993&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=160993&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D1661375360368-929089296316-007184-009-006119%26biddername%3D1%26key%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 21:09:19 GMT
content-length: 0

OPTIONS
H2 200 PBJS
c2shb.pubgw.yahoo.com/admax/bid/partners/ Frame 0
0 14ms
13ms Preflight 52.28.203.152

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 -, , ASN (),
Reverse DNS
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://www.123greetings.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.123greetings.com
access-control-max-age: 600
age: 0
content-length: 0
date: Wed, 24 Aug 2022 21:09:20 GMT
server: ATS/9.1.10.25

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 184 B
412 B 15ms
14ms XHR
application/json 18.195.44.243

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.44.243 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e62243041dbfd26161afc80c9cbd99f5753187c32c7a28c02f32ef675e4b9df

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.96.0
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 175
expires: 0

POST
H2 204 PBJS
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
19 B 94ms
92ms XHR
text/plain 18.156.195.47

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 -, , ASN (),
Reverse DNS
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Referer: https://www.123greetings.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.123greetings.com
date: Wed, 24 Aug 2022 21:09:20 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

GET tag
p4dt2-ha1hf.ads.tremorhub.com/ad/ 0
0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
367 B 11ms
10ms XHR
application/json 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://www.123greetings.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 36 B
638 B 63ms
63ms XHR
application/json 104.18.18.126

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=512884&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2297aa78d512847e%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A1%2C%22allu%22%3A1%2C%22ren%22%3Atrue%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22102930587de69c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22512884%22%2C%22fl%22%3A%22p%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A60%2C%22api%22%3A%5B2%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B600%2C338%5D%5D%2C%22w%22%3A600%2C%22h%22%3A338%2C%22placement%22%3A4%7D%2C%22bidfloor%22%3A0.12%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22avantisvideo.com%22%2C%22sid%22%3A%228079%22%2C%22hp%22%3A1%7D%5D%2C%22complete%22%3A1%7D%7D%7D%7D
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: c09f33d1ada011f955ecbb6c30a9a28269e58850ed9e65b242e95b6d774c11d7

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 24 Aug 2022 21:09:20 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 36
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9KW9stAgQc3yERe%2FanouhoL%2BTiGfQcF1tMS25cKHTUjx9Qrl1PTCbTm1DTrq%2FVw440DY9sUEh7krD4m1vW7WpbqyJQAHL8uuTsThb1hw3oybsMGlqZKuhjcB9uGL4MU3l7pT2Z2K"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 73ff11850f5d8fc8-FRA
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
413 B 13ms
13ms XHR
application/json 18.195.44.243

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.44.243 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e5012650ad47a4687a89264d7b4163bcabbb841a09ceaea66de6603282062bd9

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.96.0
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 176
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
412 B 12ms
12ms XHR
application/json 18.195.44.243

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb6.27.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.44.243 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64865dff81e4a487a912a3238693f0942b3e43a2594e72d4adc5e1f921e4a789

Request headers

Referer: https://www.123greetings.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Aug 2022 21:09:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.96.0
content-type: application/json
access-control-allow-origin: https://www.123greetings.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 175
expires: 0

POST translator
hbopenbid.pubmatic.com/ 0
0

POST prebid
ib.adnxs.com/ut/v3/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEPaflv8e1GFX0Q6du4fLsJ4&google_cver=1&google_push=AehlK4D0RKHDNv-QzHUmtqA0X_sFYBB0DzTl6NpCZt9CZAwsQwAMsEpaOD31J951A3Ume9bxRJwPvhmkq1SEAe3StgVFRtj44MOL

Domain: sync.aniview.com
URL: https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=55&key=4924864200398375348

Domain: sync.aniview.com
URL: https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=200&key=OPTOUT

Domain: sync.aniview.com
URL: https://sync.aniview.com/cookiesyncendpoint?auid=1661375360368-929089296316-007184-009-006119&biddername=56&pid=59c9148628a0612da3689288&key=ae49bf5f-f9d5-42ce-a952-cd45d1548c84

Domain: p4dt2-ha1hf.ads.tremorhub.com
URL: https://p4dt2-ha1hf.ads.tremorhub.com/ad/tag?adCode=p4dt2-3dhcf&playerWidth=400&playerHeight=225&srcPageUrl=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&supplyCode=p4dt2-ha1hf&mediaId=VideoId&schain=1.0,1!avantisvideo.com,8079,1,,,!spotim.market,isp_avantis,1,,,&transactionId=a00c1b86-3c4f-427e-ab88-ab1fb52263b9&floor=USD:0.2&referrer=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&hb=1&fmt=json

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/ut/v3/prebid

Domain: p4dt2-ha1hf.ads.tremorhub.com
URL: https://p4dt2-ha1hf.ads.tremorhub.com/ad/tag?adCode=p4dt2-3dhcf&playerWidth=600&playerHeight=338&srcPageUrl=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&supplyCode=p4dt2-ha1hf&mediaId=VideoId&schain=1.0,1!avantisvideo.com,8079,1,,,!spotim.market,isp_avantis,1,,,&transactionId=24ea0dd5-061e-4eab-acb1-a2f6aebe1964&floor=USD:0.2&referrer=https%3A%2F%2Fwww.123greetings.com%2Fevents%2Fnational_waffle_day%2Fbeing_with_you_makes_me_waffley_happy.html%3Futm_source%3Dimg1%26utm_medium%3Dnewsletter%26utm_campaign%3DAug22_nl_wk4&hb=1&fmt=json

Domain: hbopenbid.pubmatic.com
URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/ut/v3/prebid

Verdicts & Comments Add Verdict or Comment

503 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

37 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.123greetings.com/	1969-12-31 23:59:59	Name: utm_source Value: img1
.123greetings.com/	1970-01-20 06:12:47	Name: RV_cardIds Value: 347889
.123greetings.com/	1970-01-20 05:31:01	Name: custom_mus Value: //i.123g.us/c/eaug_nationalwaffle_day/mp3/12523.mp3
.123greetings.com/	1970-01-20 15:05:35	Name: _ga_47Q5QDHYDP Value: GS1.1.1661375354.1.0.1661375354.0.0.0
.123greetings.com/	1970-01-20 15:05:35	Name: _ga Value: GA1.2.943555116.1661375355
.123greetings.com/	1970-01-20 05:31:01	Name: _gid Value: GA1.2.1752293059.1661375355
.123greetings.com/	1970-01-20 05:29:35	Name: _gat_gtag_UA_5085183_1 Value: 1
www.123greetings.com/	1970-01-20 05:29:35	Name: config_data Value: CADB=1\|CLG=1\|CBR=1\|CUB=1\|CCC=1\|CFLC=1\|CPFR=1\|CBRR=1\|TCP=1\|TAP=1\|TCAP=1\|TRE=1\|QkDshLgd=0\|FBCon=0
.trkn.us/	1970-01-20 14:15:11	Name: barometric[cuid] Value: cuid_962a4416-3614-49e6-a785-56979637ed15
www.123greetings.com/	1970-01-20 14:15:11	Name: country Value: DE
.123greetings.com/	1970-01-20 14:15:11	Name: visitor_id Value: 14914247122367208202
.123greetings.com/	1969-12-31 23:59:59	Name: cnFbAtkn Value:
.doubleclick.net/	1970-01-20 14:51:11	Name: IDE Value: AHWqTUn7oCoo0CnG5jXPgh0JUi94Hs6c6mCRD0BtwnxhQRlGrvX8VI1NuyrKBItvVFs
.123greetings.com/	1970-01-20 14:51:11	Name: __gads Value: ID=327c1cddf6b829da:T=1661375354:S=ALNI_MbRI8Iy4ucueDTojCRD1c9LWRdHjA
.casalemedia.com/	1970-01-20 14:15:11	Name: CMID Value: YwaTfZIp4Z2xk1Kly3OOnAAA
.casalemedia.com/	1970-01-20 07:39:11	Name: CMPS Value: 1218
.casalemedia.com/	1970-01-20 07:39:11	Name: CMPRO Value: 1218
.adnxs.com/	1970-01-20 07:39:11	Name: uuid2 Value: 4924864200398375348
.adnxs.com/	1970-01-20 07:39:11	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In=r%<+G!]tbPl1M>e)ZlrFUfJ+tGXxoX^06ZWHKrhfAfIs<Z2azAUg0Y-_KBD2_^%J83If)y3KL9D3I?+YIBKg^
.yahoo.com/	1970-01-20 14:15:32	Name: A3 Value: d=AQABBH2TBmMCEFt6apwXyiS0A5MIPeKSzHEFEgEBAQHkB2MQYwAAAAAA_eMAAA&S=AQAAAp5zleVe0E8xP0_DoqTNC9Q
.adform.net/	1970-01-20 06:14:13	Name: C Value: 1
.adform.net/	1970-01-20 06:55:59	Name: uid Value: 8230702458281038667
.quantserve.com/	1970-01-20 07:39:11	Name: d Value: EEkBCQH3JoEA
.quantserve.com/	1970-01-20 14:59:49	Name: mc Value: 6306937d-da3c6-c0fe5-803f1
.analytics.yahoo.com/	1970-01-20 14:15:11	Name: IDSYNC Value: 18yx~26rx
.adfarm1.adition.com/	1970-01-20 07:39:11	Name: UserID1 Value: 7135552824716556431
.mathtag.com/	1970-01-20 14:55:30	Name: uuid Value: 21d16306-937d-4a00-a457-5b6bcffe728e
.3lift.com/	1970-01-20 07:39:11	Name: tluid Value: 1313076965149012767056
.blismedia.com/	1970-01-20 14:15:15	Name: b Value: 6306937DE15B3F3815AA87FABLIS
.turn.com/	1970-01-20 09:48:47	Name: uid Value: 3445937270972278497
.innovid.com/	1970-01-20 07:39:11	Name: uuid Value: 1b62cb9d-f0a2-4475-9c64-3e42c6683bc7-20220824 17:09:18
.doubleclick.net/	1970-01-20 05:29:38	Name: DSID Value: NO_DATA
.mathtag.com/	1970-01-20 06:12:47	Name: mt_mop Value: 4:1661375358
.lijit.com/	1970-01-20 14:15:11	Name: ljt_reader Value: FM41uGZHwDPZMbehRCq5Zbcl
.casalemedia.com/	1970-01-20 07:39:11	Name: CMTS Value: 1185
.travelaudience.com/	1970-01-20 14:59:49	Name: _tracker Value: %7B%22UUID%22%3A%2239CA2791-20EE-48BA-BDCF-A686D65C2AE5%22%7D
.tribalfusion.com/	1970-01-20 07:39:11	Name: ANON_ID Value: aynsIHRwEfFS2QVorqfgKSwIuJnncQZdUZdHEbnCYUR2QCQZayDZbMWRxbmM80aZcX6mG4sk7Xa2qBZcDTBKw9vIcUTpun

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
worker	error	URL: blob:https://www.123greetings.com/b59f571f-0c6c-4793-ad60-7ac426ead975 Message: Mixed Content: The page at 'blob:https://www.123greetings.com/b59f571f-0c6c-4793-ad60-7ac426ead975' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'chrome-extension://eppiocemhmnlbhjplcgkofciiegomcon/content/safecheck-notification/notification-iframe/index.html'. This request has been blocked; the content must be served over HTTPS.
worker	error	URL: blob:https://www.123greetings.com/b59f571f-0c6c-4793-ad60-7ac426ead975 Message: Mixed Content: The page at 'blob:https://www.123greetings.com/b59f571f-0c6c-4793-ad60-7ac426ead975' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'chrome-extension://cplklnmnlbnpmjogncfgfijoopmnlemp/skin/logo24.png'. This request has been blocked; the content must be served over HTTPS.
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.
other	warning	URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html(Line 11) Message: Origin trial controlled feature not enabled: 'attribution-reporting'.
other	warning	URL: https://cdn.ampproject.org/rtv/012208081650000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
security	error	URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html(Line 12) Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/2308844050242602212/220407_deinenacht_v1_p_ODB_GDN_468x60.html".
security	error	URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html(Line 12) Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/10489799405306279296/Eleq_300x250.html".
security	error	URL: https://fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html(Line 12) Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/15554702494583891371/300x250_EN/index.html".
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEPaflv8e1GFX0Q6du4fLsJ4&google_cver=1&google_push=AehlK4D0RKHDNv-QzHUmtqA0X_sFYBB0DzTl6NpCZt9CZAwsQwAMsEpaOD31J951A3Ume9bxRJwPvhmkq1SEAe3StgVFRtj44MOL Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
ad.turn.com
ads.eu.criteo.com
ads.pubmatic.com
ads.travelaudience.com
adservice.google.com
adservice.google.de
ag.innovid.com
ap.lijit.com
apis.google.com
assets.pinterest.com
avm.avantisvideo.com
c.123g.us
c1.adform.net
c2shb.pubgw.yahoo.com
cat.nl.eu.criteo.com
cdn.ampproject.org
cdn.avantisvideo.com
cdn1.avantisvideo.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
csm.eu.criteo.net
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
dt.adsafeprotected.com
eb2.3lift.com
events1.avantisvideo.com
fada400d4cb2977aeda16f86125aaf9c.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
go1.aniview.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.123g.us
i.ytimg.com
ib.adnxs.com
image6.pubmatic.com
log.pinterest.com
match.adsrvr.org
onetag-sys.com
p4dt2-ha1hf.ads.tremorhub.com
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
pixel.rubiconproject.com
play.aniview.com
player.aniview.com
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
r.turn.com
region1.google-analytics.com
rtb.fr.eu.criteo.com
rtb.openx.net
s.ad.smaato.net
s.gk.123greetings.com
s.tribalfusion.com
s0.2mdn.net
s3.amazonaws.com
securepubads.g.doubleclick.net
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
static.adsafeprotected.com
static.avantisvideo.com
static.criteo.net
stats.g.doubleclick.net
sync.aniview.com
sync.mathtag.com
sync.teads.tv
sync.technoratimedia.com
tpc.googlesyndication.com
tr.blismedia.com
track1.aniview.com
trkn.us
ups.analytics.yahoo.com
us-u.openx.net
web.ssp.yahoo.com
www.123greetings.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.jpada.com
x.123g.us
googlecm.hit.gemius.pl
hbopenbid.pubmatic.com
ib.adnxs.com
p4dt2-ha1hf.ads.tremorhub.com
sync.aniview.com
104.18.18.126
104.18.19.126
129.159.70.95
13.38.220.224
142.250.185.66
142.250.186.130
142.250.186.34
151.101.128.84
178.250.0.162
178.250.2.135
178.250.2.148
18.156.195.47
18.195.44.243
18.206.3.164
184.72.244.154
185.29.132.245
185.86.139.94
198.47.127.19
2001:4860:4802:32::178
2001:4860:4802:34::36
2001:678:cb4:bbbb::11
216.52.2.30
23.35.236.201
23.35.237.56
2600:1f18:1aca:4282:66a7:18bc:d1f9:4f18
2600:9000:2057:a600:1c:38a0:8a40:93a1
2600:9000:223e:fc00:3:748e:7940:93a1
2600:9000:223f:200:1b:5138:8a40:93a1
2600:9000:223f:6600:8:48e:53c0:93a1
2600:9000:2250:7a00:8:9ed9:9c40:93a1
2606:4700:4400::6812:230b
2606:4700::6811:190e
2620:116:800d:21:ef75:8280:f209:5ba1
2a00:1450:4001:801::2003
2a00:1450:4001:801::2004
2a00:1450:4001:801::2016
2a00:1450:4001:803::2008
2a00:1450:4001:80b::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:811::2006
2a00:1450:4001:812::2001
2a00:1450:4001:813::2002
2a00:1450:4001:813::200a
2a00:1450:4001:828::2001
2a00:1450:4001:828::2003
2a00:1450:4001:830::2001
2a00:1450:4001:830::200e
2a00:1450:4001:831::2002
2a00:1450:400c:c00::9a
2a02:2638:1::3
2a02:2638:1::4
2a02:2638::2
2a02:26f0:3500:58c::2c79
2a02:26f0:3500:595::2c79
2a03:2880:f007:8:face:b00c:0:1
2a03:2880:f107:83:face:b00c:0:25de
2a04:4e42:41::84
2a05:d018:d29:3605:a43d:cfec:dc69:3aee
2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb
3.126.56.137
34.240.212.15
34.254.17.167
34.96.105.8
34.98.64.218
35.173.69.21
35.186.253.211
35.190.0.66
37.157.4.28
37.252.172.250
51.89.9.254
52.223.40.198
52.28.203.152
52.36.72.203
54.231.224.232
54.243.255.136
69.173.144.139
76.223.111.18
8.238.176.252
8.241.45.124
85.114.159.93
99.86.4.71
00167e4286a9c4aee1aa2596925a7655770ab38a3ce62343610f895705c78184
001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343
01374b079615fb13e56bd755f1d1ca178a57d1be4fca759f369b4a6c5154db2f
018d1ca70b337096cbdd1c407a2543d66ecb31f70cb14b5e9614737d7676f5d5
0436ee4374f7ac4600ae1cfe8f988c6337667986ad567d95ea05bb45ddf52848
047bf1d6aacbf20c071e62c73a1eb72dd3385f14caebb74d22890cef92c64f48
05edc6f9f208928500c14213cc91ce2cb0e0a53636a951d34e3f31a195063146
08b6918c8b01473efd085f2c8f49afc2072e39b4dbc40c85216896e3c743495b
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0aab059870f012f12f3e3fe550c62b6d8cef07be8d509a0ce69df144e7fdfe1c
0ae485367eb0862700624f4b18563586fe0fd2ecd7abd1efb8a4896ead71fdd3
0ae74371a872da00743b4c907dc6b5ea22377f13ede1ac75055a55f50676dba8
0b54c8343995dadbb7020528bcd0bca9287694f0abbbfe982da9bdd16d6d64ad
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0b8cbcb59cf389b8ca11449ce132c6bff62acd77bae98e239a28ed826d28db89
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
0ce879cfe7244a0a086ea8a95996d7ac5838d30a9b1cd8e85f045f51c41d0df8
0d4f6e28cf855271fabcd5fccb24e71ef842e3ffa3c33795d9ddd9d3a1e3a46b
0f5ca0a34974048b141ab16c85540d298814604ae1e649023e29659888c212f6
0fc1c5579296e05807e4a3ed8052d821166c556e9e39138c11dfbc0578a29256
0fe5f0a7225b1396ee1ac5ca2ead3bbb66f4cd4dd09b7e5f1ea49fc1668af9e5
106de2465907b3815cb65b5964f59834c9b576be8bcdd2f67886e04baf53e7e7
110f1014ca6f6bf90b90246a95e4a0debdf95f5adb09a74dabd3df247d410db4
11a589116a1e20917c76f2b0af9cd0eb518c98cba15fac04719be0bf111b1b6f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12ba93c7b0114439929f7ac0efcdc60e6eee9da57a2fe6ce68bb969f00f4a54e
13486bde37037de547c6d03d4cd9d8d35a911b25f1dc83341245b3bf12997b8f
13d4667177bf9777b7d9a0ce216beb8f877f4836ae8e234e689547abcbad7837
159c4dc8c425f8c2d63849440e69bfae3bf91164441aad1093cdf04b6236297e
16214cd854b5edfe518d841b092c9cf69e65591b2cdaea2496bce9db323500c6
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
186456f68e798b6aeb8c250949d5568673a796257bfbb9ca6744c2c00d78c324
19fd57aa8d7877c0da46db560ce9c8cbce09ffcf6af7299a932bb04a041183d8
1a35b54ba96281c3219a08fc301361189dedc07298f8d12f4b7f91f5d0be2c77
1aede1b27429a9ec1b3539e2451b7904806532630861c83294cfc576611758db
1af3d023238f654c9be5b0d33c51317620cedc7dd026b08ae7383629c976d9ae
1b2d1f053c12ae5640ceec86485e4c7c6a7b52645c41dac0d8f1b17e9aac3b1d
1d1cd9895fe97a1b69d05f629d44c20b88e3686656d0ed54e7aa39d7f9b13eea
1d232f039a1f639bd3e6a120c7577292d428d95b950e0cfdfbaa0422334ef4c3
1d29d6e7efbb3390006b58cf4007c217818e80c9ae7a6656cc3ff8fadf809fe2
1dbfeb07cd50a1857b9576b5415f8a4c6ef010279666f39448fa0aa125d433b7
1e14ddde632bad66a3f79d6dc2c6a212d3b1b5cd8100cb6b73984b8797c5ed86
20c9691d6a91376627c5141a980f1ccaff0ee01663d71425675ac0829762080a
20f0315c97ff7007f2e7a94d659e094a7efc01b8306da53987538c1101489e0e
20f1c786ffa326b4bf742ff1f66f1901712217daced69e2da518dfaefa73fbdf
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285
24302eeb5b736bcc9f610299a37ac5dcf7e5b4c11591489fe9ad89f1533bd09b
24374f583eeb0c88723c3cb830828d5798ce87144c8ce4e32076df4786f72848
24dad537459cfd0087916c12cf4ad6c26e87dca870e76646d9d3fe753ae60d38
254d41d323b97e21b036ccf367f7dc18d8ea96daaf756167bac6f0ebbf8fbcd1
25865b28d8300f5c86ba998f59742a08ae08af54a3cfafc046f8089e009eb046
25a3bd032da353d8b8fc7d6307a434172a21e5cf3d86c859a23d1bd3a2db4693
27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4
2a82c3690dae9aba60c0df9449ec207f73213f07cb0c620a99dc3167f4e93935
2aa499a3091dda7e928c1945d710f743afeb98bc154b78fca1b9290a95fb3539
2c9af50bf0b620338c52663395cc61108370bebfa8a25b9b1ece94ede1c74eb6
2d94a090aaa1d4e8ff711a478d0c1bc1a91f0d196503683ead7308f88c048b1e
2e4386cf56ad2612f0ad0526372b3d1cd96d6ecb3f32836f141aa28207b3907e
2efc0670c8661b4d73ab1a09dc1767e7904ad6ce7312552ebc30f6b80e9825b5
2f121e168a9baaeab6c2607a5c7ea788955724717d26ae30b6e40c503c5981b8
2f296cc0389eb0abafa4eaf9aa9696d7848b3a241fce03bc78982dc0d22243b9
2f7e194d4373d3e45bac4568781254590d984e585b4fada6efa331a377d53791
30e6c841d3da47b009a6f175c3d038b5a4de09c52254c3e350f6033592c2bc80
313051fadb0a877488f704ab08601d3d46207b0818e62d5128494ea36463add5
31b6019da0be3ec6fb6d130582695015635ba2ac5316b1b6528b53fc779d327d
32391604d5aeb3b40104ca4916654797346abbeeab52e663216c779df49e7848
3246e28fbfaef4ec1f67bf5e0064391c91e6f97f62d61ba5e4d2e01765538d3d
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
33be66f63aca50629829ad77a1b1def4d69887f267ec408420286cd0138dd587
35276e401d27d1f4ceb5f451cd11b25ff453808d2152e338e07b4b25978f25a2
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
364ca1274b834154b9e92f69807a6a4652f63698fcb76548d7d4b6bdfe6b3743
39f066d84bc1d1bb9d217e769b3812732a12c3ff611fa0e2a22ae6c81a30f445
3c94d07090acdd3c44fa5f23a2c957c961c7413129f068acecf17f1402102c4d
3ce91e27c75f26017876adeda75acc652f5d48f9875d6db451b2ab3547c3ba64
3db1636e511eda3c40e26595b191a9db98ee2170d1e5c3274e2d664c9e371aaf
3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de
3fcca84d7025351471c7f04b8641ce8b95b439566c382f2a72476a173609d373
41c7f77cb564e20029d53084a16a3f1ba3da49f2d2c08c610584a5020dc9aaf4
4330d4072d013510b91ca5648f210b614c2e4e8ecbea94a1f8a8373aa6068532
4420a2dc2da2e15ec5b200647ae2f44777913780a7158cd66af274ab0907f79a
444fc949343083bf7be5163f23255044d67bce2f1f6b0c47382f508c594cf5b4
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4a409076ca2553d234ff017fd0d2dcae6105cb2d3c691e73cdd8847c5dc62239
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4cec06082fc8040f97866722fa0665dcc2eb8b0703712a36411f0840d37b7bdd
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e40f0f6c712e1fee5160f07dd299f0e3597d477098ac926702d43553c8c64b4
4e697f80bfa436d6e9bbbca8506192023dd8284b4a0c8d52a4629f5140a20359
5028f77ac0afdac1bb66eaeeef41e77cea0f2487a66cb1df354d8680db1bb64e
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50892014b518ac5fcb616368948439bbf6f6fff38d2add32943242cc625cc407
512264732ddbe17805b120cc3876938cad3b5b330c39d71a795e61ff99a57a7f
54516fff8a9e3907172f96f8e51bba682cd29253dce254f199b4132372e56381
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
57a18b6c18cc1cb382fc80abd6302ee9c092d472b15d257fd911d942e6def986
57ffcb4f7a5e82c3f6d27f241098b76bb638c87f1af1a2fe02ecb72bf1f2809d
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5ced7e6e0093af5c4242071f4d334809fed7d85374a3f9a7bd9c785d7ef147aa
5e3b717b0e63024c5bcd43346a8b1817889634306aa164574eb3d653d6087378
5f52f8f6c9d11dfff0b979fe99e83d6eb65f850c25542626f7d7987ca2478543
5f80fa2132d722dd124412c74cfc1084f4991195f7cfba1f34c9ccdd2e2fd28f
5fad4e36641f765661b0ed167547736ef4684f7a6995e515848a25aea36974d8
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6382a5009f2d1613d7c5b239d04fd7dd4ec4c3854c50e47dc7004a5d9f4c71c8
645f3114d7724d4edcb038ce63c5587379515238cfa2e334819d1230063df902
64865dff81e4a487a912a3238693f0942b3e43a2594e72d4adc5e1f921e4a789
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
664837d2bb88ac17d1bc3d9c3e65cb23adf2ba6051d2c48dfe9c3dac555eb66e
69303f97bf43e5d9fd7a0c8e6b5f4b49de4466684c7e2b8e2108de98e5c98483
69812ad8e013a18d150c24955514568522513d93ef5178540ac6d2cbea28bcb0
69f133775d99422e513d7d2bf86de55856fa87e7eeac9567a74e558d15580cbd
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6dc9230f4c046615ef7549ab15ca40b8b2aa811251c8bb1049d817c77909656e
6fe34c9211ca6293192fd2cc5a21a10b61a20354720231788fa2eacccc1a9b47
70fa25d0cd4744b6b91054ad55e3e931dad31cc85915b13e33e4e674426c7cc1
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
734f9af6d0f8e6633f5898a8c29ae88c0194d4e398ce773c159e4478af3e3443
737ecccfd5058eeb7a46e5ea9616822be78a60668342b22f2fcfae3130f7d8c1
74953950ae3ae1c6142dcfad80f766b6b344e6ad6cbc4a2a961f32aa17ae501b
7694c67b7b768c34067735a92d9c60a6c3cc709a37047008b16c8ee5cfaa235f
774e454b13692a54421c059a47ba94dc81bb21ee729f9a076548882ae6163b7f
7a9054758a4808c97c188f5be469879eef19a2f7cbd9bb0e740cee3199a6c747
7ae9fa1fbc1caad812a3b620f407059e9f071e29025dc32793f390dcf9fc69b4
7ee6edca912233b18504a48459d37c8840c3d2067c93652bf1401041c53595e5
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
801fef12e66f08f92702dc8da7fbc6a7b7a1ced535e5ce16aa0dd3ff86670925
8030594b4999eca38901464b09383ca988c454a4f7ab6b963be75e6c42da011d
81113214da7b946424bed9da1f2713c0e7280b577feb58cdc17ff672143aced7
8118f9caab521097310cbd5980732e472a431511536759da6a7f475e2f9b1c2b
83147c4cf00c61d77d068152fdb541e2ca7761e0990682db23e77fb7affdceb4
8360ea047ab33cb96e9fd2d623687cd3a54d3508975469e92082c6cdb5e25742
83d0f26ea04c4e488bd17ac03327efe9888f2f5231038ae4f0c05b8979ead096
848fe19ed492948709b881f504ce2eb6274baa694606ca88eb9b2990a2460caf
84dc6bf66da590275c5bf7eb6c01f0d85a5265b82c6114c25b9cfea42fa21611
86c8cd9f4420596a39db2861c16e8431bd515f695010ffe3ee388e7ae8fdc915
89b03d4a2f2ca3d04df1fda63a5247ef31cea689a0ca553e353122ab3d22b646
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8b909b0ca962aaa8e304102c11c95a5902b6250dbb270625e822bea12330f9a4
8bc37b48e4a372d1a1ea6699c4b0efaa3027148a4d5876db261a571881cb40fb
8d200dc372fb333c0ca488fba2a569a686cbf5f1ba0cc0544a4a8c96a4f91de3
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e08ec01ec1f7c75dd7fb608523af7f7a31b5db23636bfbb9e98d4f831ab30ca
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
902565ce7f27f6e504ee3790458fa3e9137a1c2b3d63d58ce6cd2fbcbf9db7ca
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
92aadb0838b3b1b154749a5cd5420e19108ce0ea60beb102d822f7fff9556960
939f233d46c8791222267d77e29d924882274eb346c609ff6551061396a25ddc
94146c0f666aa2a10834c4330172d530237db2313392b4ff4a28fdef63ff5106
945a33503b53b703efe23a85d5c3d51e7005d80b72da282674e1c1c381ef74e5
958bc2d27d930acc97b8f783e9f6135ec27f060f8775d93d8990246af63cd87b
96ae2513e5fadfa135893b5c3a4450e8b540ad60a12547d80a5fcb9f7af0b587
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b0e383dabe4181f3ddda94f647e13c70ebd2e9c197a3c76db4f5accad3d0d37
9b4e83392f391af25c7004f17559a0600d4d38676f896079cf7962d43404dde4
9ccffe7b83fed843a2cef40c555bf6727caced52686f1e14afeb231757a8592c
9e62243041dbfd26161afc80c9cbd99f5753187c32c7a28c02f32ef675e4b9df
9f85b446cf7c5640aa90f2663bf232af45a2d4ebd65fcf60a3105f400ea8bdac
9ff07ed2c891ed887a0e9eb61461ca9c00277a27fd98d73e40d60b91b2eb86f0
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a375f0868f27f673a2142c3790a5ddd77cbc1eecc13e63dca666d03cc8b4571a
a392ae9e21158d254aec9aea96b1b069627a8c6f0f34303aa07e603f38d38294
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4f8d308a537be4d8442135addd3a1637ad70c831ec8d6fb21b460dc392031e3
a6c367683b30312c52b7a31c0f72fd4208c9f8e99f183dfbe31a2a1bea648e5f
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a877d18de61f68a6bf3f8240fa730e23e2d80ffbc4b5e1293e5697dc6a585d96
aa3f278b3647a176dd5cb4ffb54e695a9cfd09c0455f88d78e568456cf66972d
abfaa28e509b104c2edc0bd048809340d5e006ec872e1966baff8383ff8a0e22
acceeca10c7bd430647a047c76f082e90d69ab3ef3c10aa2589ca680d0cd2ead
acd6695490b21ed0065476de6d0fa24e8e38f1e4c398e0c9df578340cbf31fbc
ad296f39ad4411e513f1cb6a7779759b4854b8d5e885502ff79b37c1b644daef
b1254df573d769a6c40d4a8a8649832a9f5494c28ec4c1c9ec48df9013940e1d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1aa412377e37f25c55971ab7419530d954c8b59d533b316a759adba698a624e
b2675f2bc3393449a44784c7815f9c36449024e4397d7f174812c42c6bbaa148
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
b2effcb18f514a7896e737bdda537f2ef3b5bb989eb247f4ab2aa3facf1148ea
b4820095dbb33dffee5026491f08575d5adcb7e3cab956061f0cffb5052d78c6
b61929b14eb6529451dbcb5f5434188969f68cc02057d563a9db3b9591b92d44
b7fa2ddd090d2a9539192c0d37a35999ec91e51d6b212ce5f86c62d525964b01
b88b2f1daf7a6b9f69e1b505ff6eaa2700f6220a1f8702d40c87d0ed4010bd97
b93dce41ccddbfaaaf2dc9127d9b64c442edc15200ce6b46e08c45d94e3ade2d
ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10
ba98e735ce0f8021ed850e1cfd1e5f20049e17ac90b3bea352b04324d045c233
bb68aae18ecd5bcf816bb98cf5bb19c7e9fd1431b1519f746a9fd3aeb5d57e0d
bcc64347d6c014ae65ea6ae0f7e1e632e9a0e7b2177bf262d0bd39c2c1326a64
bf419273c67644558beea89b3ca478ffe4b98c7984f7982c2f70383464eeae1b
c09f33d1ada011f955ecbb6c30a9a28269e58850ed9e65b242e95b6d774c11d7
c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619
c1fc7e03c8804a8d3df2989093ca36911e9d117dd7d465bc12b80115306f67a4
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c40c9c0117af4abd3ab87c81eb1725c442ec682095d29cc8bc2206e3e5ac1c23
c578b55eeae09926dd782092c3f676412cf65f4d7f156f5d62b4b17307184716
c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f
c9e42e2c7cd3ec42f6febe248c715522b2e5f6bc92b389b101fbd33a069ee7ed
ca1deb7814e81701ef63e86adea51765e595b29cca0a0fa53c302216140ce3be
cafd612ebd6bc497a7a05d3dfef133a0b793f1e04e277b31c424d6d8892a1d48
cbbf62620711af60249429337b9251292d7e1c2d98456d84edd0fda3d84cd1f9
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d0fbf06f675663f1ec793289e8eaa4dcc4eb791f90e6311ed809b506e88f3a3e
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
d1ffd03b86922298b77c8df77a267845dccf197515ce5e5fa3fa17f1d60ad25a
d23484cf0f36a73cc699ceffc6da8f0e9ffd6b372dcb615ec942cdc287845505
d296131da814e68033b8f973cd34aeaf058191c99e1a265b5569d6f7d0074aad
d2e5722cf0b8d8df31200550801d755733c56d9ca2758b7041fbed009e0c9d08
d37a1d0a9caf1a7ab47cf71e03cb92dbce54797914e91c6ad6bf88dabd0814ca
d64b11edc21383e374eaec1bc29e92192b3e91cccf7e4237cb61c9a9026f2f96
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d811a4d5d35ec8ca928a06493c58f91f92756f2415b818bfb864526426a08588
d8a957038679125d4840554fc43375697e662283121561afdefc2c3fbecaf729
d8c568b0ac5ae86b080bf1e75f3354cdec6226ebaf5cb59071749c6d368d89f1
db35772a9d9328cabf6f36476859ec322b7c9701bc82d5c8e2754280cc916143
dd1b3d98da6310891d6a43e04ae081c45da8b04890809bbc9402306b986a7aca
de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
deb5946ae375e1c7811c512493649f280c39699948e68c8de5fa5cb83e855942
df9967e26296ab6659acbbecd377f7933cd3743d50935a5c44c800f90b9c6687
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e1f8bb34d1c9293f4835d697703ea1f9f0d428c9adbd069b07671d0adef8e503
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73
e4e791ca4ccfdf6fffd9961ea63b4b7e6faa1a364fd6b55eb8b091d8b25992d6
e5012650ad47a4687a89264d7b4163bcabbb841a09ceaea66de6603282062bd9
e567f904425b2e20b19ea7dfec04e43cf3e36b9f4d830bc41c95b14b9e866bbf
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6568c93cdb032daa5e27c1aefcb268be1e64d2aa53f0261ab2d9d104fce4538
e95aedd1d541d298db3c600fb7629d10277e4241e4d380970bfed9d4fc8bcecb
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ec61d9fd1b3609a3a53f377ed07059c3dc7d2cb1502022e0623b4ebc1ea0f35e
ed1c2c6b7b77b966dd42dbec5cda78e14595383a75aa465912cbd75c0e2dc569
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8ad2c4661595931d8bef75c3809b86672e880e7d0b6730c6b9dac5e524b110
f0a76a678ec2c5059f902cc43c97b0de8cb0e7fed2b8bfbfbc3bb34e8739b8b1
f0d7d05ef7ae154e283b8c8e462aeb6e9b5bca53225c42743e2028c34828c08a
f0e73ba958067b3a894a08e369a09d265100749208c34b4f671603a9ed6d9172
f1cd5b14882e11f3d2fdb4aba6032814e064c61db98ac5bec88113789ff5c773
f48f1b088976f2de3bb46a5c5bc609160ef0a6f919109e08f784596b0a93b7d8
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f5cc0170d9bebf7d43aa74b381ff2899cc5a3d3fec051e7f7966451db10f0257
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f759c3bab951e2d100836674898661df8c0da89d8849d8e679cfa98620eb7042
f86a1105ed755e9ae9b75708a5b19d5c478212605b9f8d7c98796b451de18c63
f8749b37272182407219f5d8208f812bd74b9fa10e7877b1ddbe1963b794bc51
f8df5652cde6aa3f3eadedb348b5d51d636291f6d7dbbf97cfde4bc1adc580d6
f964612ea368ffe1d612a004f0a0e05453155fa7cb27dff624e5ada25c6847fb
fa9c76ffeb56e65f15e8b9f9e450234fad7c4b5abb33dc212a3d620d0f08d47f
fb7989597f1a10a56bd83de6a26eefec44a0c704979fb5e06f02195bc9cebfce
fe945596e10212d0c1b709c293cf76a10727c57fde6a31f3f0e66be1fa4f5634

www.123greetings.com Open in urlscan Pro 184.72.244.154 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

524 Requests

90 %HTTPS

47 %IPv6

52 Domains

91 Subdomains

73 IPs

9 Countries

9167 kBTransfer

17447 kBSize

37 Cookies

12 Outgoing links

Page URL History

Redirected requests

524 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 18 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.123greetings.com Open in urlscan Pro
184.72.244.154 Public Scan

Screenshot
Live screenshot

Full Image

524
Requests

90 %
HTTPS

47 %
IPv6

52
Domains

91
Subdomains

73
IPs

9
Countries

9167 kB
Transfer

17447 kB
Size

37
Cookies

524 HTTP transactions
18 data transactions