de.cosmetiks.net Open in urlscan Pro
2606:4700:3035::ac43:df89 Public Scan

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:13 GMT
an-x-request-uuid: 681180c7-0a40-4564-9751-1c8a740e2e97
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:12 GMT
an-x-request-uuid: 072e6047-c01c-46d3-9097-95c68c229e4a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIQIRc0gDKIS2wunE4f8NnY%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 89CE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk4NzMzMzM3MDk4OTQ1MjM1Nw%3D%3D

170 B
243 B

83ms
80ms

Image
image/png

142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk4NzMzMzM3MDk4OTQ1MjM1Nw%3D%3D

Requested by

Protocol

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:12 GMT
an-x-request-uuid: 7f496e12-4210-4adf-b3ca-565f16568765
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk4NzMzMzM3MDk4OTQ1MjM1Nw%3D%3D
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 74E4 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 57afa3ed8081359c1ba8faaf9f239a6887e19261e5fd2d726122ed50e3145505

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A76E 0
20 B 122ms
121ms Ping
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4710073187115&version=m202402290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A76E 0
20 B 122ms
121ms Ping
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4710073187115&version=m202402290101&ct=119&x=1&cor=658080787492139400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A76E 93 KB
39 KB 115ms
114ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CIihti5pcIOwmpJ3o_910g0RBEUiLAjAyzZI365JSBfPoPKyZEkazrI181QE5pm1efNaiZIW4-4kNL0c_yMIhqzVusvwF99G8JpWcMcTm2PTdpgmTdMhVb2jsXZVo4207y4ni8gvd_DkA5Szk8nd_2vjXiF_rrsqH59zJtgA4nNUl6fLfT0rkDtAmpSEmn5b4Sq0oSVTE4q04xmkDsFZCMzF9u-HbtXx4WxTZXudOermk4yjg&cry=1&dbm_d=AKAmf-CuO4Bn_tLCeg56H1L15Df3ssuFqjygZ09EAG0LWZ-iG4L1gJWtxSWoWWtUB9A7ON_adjasUZcJ0kEkHkd4WEalHl9vcGzskmSKGdnBjSOauFwd2zSt9si0x_pYptiorXUhzGWopswFLNr7KJR-o4pxJZTTz0fHW3gXPWktw_E-r4nCXnUV19-l1i_iKB6TgNRCB_IPxPXPIpXYHofQpbIxOGG024R6xc95uMNsIkCip31CrOsQ3scYRCDnsausrHvY74zpiR7bBQUfVPL8_ndkx85G5DKhy9uqjGq2bCUEAChPOg9eaUaRfxcyoFhFOU6KzcYk0UocYPlVy7Seg_V8Exj0qonccq6vpoasqufy-y0991GaITQ_43rARDqAXIm43BB2UzwUoLAtrOC3_vDvROJWDqRS5Yi_7dT3pbo-MXLQq4CGhIwh3Z4iEqKSoU3Gr49LRhyvcduIqR-04kr7ql3I7ZUPpeY-1QIctI4Cu_UL2-RFJZf6DM_t73z-PbdEwoRgenjYiQGqSZEprWUbQtWwbvS01U0jvL8uny72HXYGrieWP0NNdhdGpC3O_hh5ox0zbQ7CvYPKy1848ZWZzczibn4uw2GO8_D8ftjO_IkHqdm-DeUjurBqvDCzEANwn-hC9hqoLWFOh87AZ2bSv73uM1vmua8pKLYzMUnFkL_nY8X0_p1SVPMAgp2ayepubMlIoUbZ61n0YeIOcp47yDU99tp0_ag5YI7mxUrkmzetnoypv5AeNU6OlIYF3W-yOQiYVLLlnrJ6kfMIQmnZoik_8qa3FWnybjFCcBQaFCtTZ2LkZiIyiRD95RnOhbu6h0naHdsNwlZCGXI_CnUU2Yoyt1e3QuoD45OkEfDlHTwfacDVTqLOSycBxcRBDVwGne_mTKlt6JnEOiMr9f6DMR1UrkCZuhFh9vMdRlQLGVzudt0PtutxNexMfsSTM5vE24QI3B2wCYwr-6Dyx0PJqvLtQxHrB7udOYdXaW7pEWWuxBCxDy2CJvFEi2aghEWGe-Ejp5FKkCfvW-LF8L72B5aJqyggWbGkYYScuN5XNrzoNWyFn36aDdYimc5TRCSdExfPKjcf2XoQLR-3Btbm0uAsthKoZUoRORE5AGjCVykAXHqO943T6ZoSD6c6GD3Bfwt7G6QoD4ZyJCFZHI-mC6MKhOJNXf1VCzgl7OT95dWlRyxGkNnqg84Qk_O-zKuHZBDcBbhrox_DQq66qM-8_zjINh64RqkWhXPYNifDx4qLGWUu7OGCYo5UDPZVP32s6eV_mjjwA5i-V31W4Sn5O0bNqV0x7wLooS38Qu29aEw_fChfbjlPXYCW0vOde7sDnmSWNTw9TdvilOaHb5E9IuymLLy0VBf75JNzSNNMVWsbCOB0tv9uZdOeHE64igrXtw-30-OL7Q6fiKyjuxlSuX2ZjOZ40iH6rjLQRrE8okavU7bpgsffWNJguyi4cKvYdeyUX-f-i8hBNZpe5HyuL-mEVtPAht4PWYMcUW4dojTrR9oc4uh1ve7-t3iqSIVw8NjWesAjKoshwCszUYRYAsjJBNHqQCbb6ySnzAXAK3TNjDJH6wt10HxKGo4dXifIv9iHsh35EC5X1i8bNCO4sb4tSCPlHGbJEifS1i-P3QfbPfshAdZb8MmDSAEXkv_b6L3jHTBv6seZ7oAzhcBSgd_ikzF2XFP8AjjvdrhOFBC4iVGS74n25yweY62SEJaw_L5ni28czgWrYkhw2y83TVtZQjY3qFUOaOnnkxENW8f6Mg79-xBi7-4rnkA_YDuRpahPVvW1Zdvj0jUNMs5FiDnq1LJtuO-NIU6XBma_i5XBx_ywMKlLRfCivG6YWwvHf3TnGKyEXFxLzX0hVZJX8p69ZN3WkOne8nTPSINwOsTNK5LIy5aNjH-8o-CMRpNdqdTJVn-NDGRUeGj8Fe0o6Y6C75C7QrPr1Omr1qtZeUXLmuyZhuLC2PlsWcUb5elCB_XLxkCNnFzqPOFoP8fFinZVH7QHg2gqA5hTVMDU0VCeyg2EDu79l-lILyxaW9GzSYjhh00Kv1N4eeWyYNOdsALD-vShgWscuyitQvZ0Nu6MdAAkiI5V9dQ4Mx6BxeU_kxhysZ9NHjlNdWr8j_LzS1za9-6kduO_5_023CBBmIcYpQby4jtGgXIhnC3wEuKInuaxMvxgY1eZgvNKNUZXEj8g1Zy7Do3YI_NR39qu9OuDUa6-AuHYdA3N-4UzUB7XSUeSEn6kY4lcn8eHFZqTca4PVn20AlasPG2d80sUM1FJqOGgT1ZEGTxuSStPG7xRBc26AJHeTMOKxUgNkF-y4-Ojb93MYDfYr6dJqm_alpGjQ6pI2yhwbStbZPO-TIh7MF2MlGzimMpxadrdnLnVTemLcj6RzBGBFSJBZnVmWb484ScPs71P6T344MrRvFXTgM5wUTwes0LJnfdRaN-yYtKu7j6alN9vYgXPwceHwhMguRwh8YhnTUj4tQV4usTvK0dEtr2Fx-3V7CL2relQ_ySwC4D87bZ8bALG1TtZNBT4FIRg8OrwYoSNcWGX21egD-A_Ax_elvjvNJMNhcZRk6iRRyT5css8AYShG_WruVJ8_L4toxHfuBRyNca24FRKRTwFMhS9zX6UL7UTKNB7bqlwvBcMXfFt21BxUB7Sx283k0L9B0KjlxBSYpfI3OnB1-QZGifAUD4KWF7ARjKgVaekxHWPQW3f82FGTgYpqPAWd1K2HZQsPQh5epDZshiBVK0W-UGp06nhTWfYz3f2MMuEU-Y3LpTmSFWmyf6lkM1ckinIve20axhkV9BG4OSckBAEYT4Q6_b-SRDOt-ziIXmPEC4u8sPFDl_I-zEAbuaaHZzllW_RVHcDC-mGH09R8YwetcndhGLpsIFyhJ53suqs_cC5QeXFfdj2T9LZObJZk9TjQ0sBAFSlFV4BgkUHWAQwFor146B3LJ5EQhTe_aVUS06IVywqrrzHNDjSWBvn8Tq-CQHSAiHTB55Gki-kuOUWTIbrsGGDkqsA4gMubqHpgKTmwhgwXXiIVL8OsLdKdfSJz3egGbfjPscjczDSN_m-tPEhJZjdVM5zMRLo-ymSLSrua2eycrluwwlE9MQQa9o5Ro2zq7e2fXHVGyOlXgDhqFcXUjrp0HtQF4TWu_TC1w_1ZgF_Tuwj3GOScBgF-NhJpY2MvO69XHGharoQHqhSWqPK8qzOkfiLkeb2TM6M1fs5jYziq90IXq8_kapuyJt0SVy4Mb2WVyX3JsbVZUzFTgPXAM5nw5101PUb8NTsgOmtReiSSttMAX1DQjEmBPPTiyNOHXBAPS8Tk9ScgcBUMj6CHQ4ZicRjRGFv7AyQm6A724nwfxYxst3PGsVZWLHuqgBgyPtWiqzqJMO9jTdc-FTsPxa5cXSUPhUOpVpvAa0liwtxJ6nBkU_Q1ZaaN1u_Er_239BkspQx6Y3UPlZH1zzr8SK9gKfLj0XbB8ZStVvDflE_wE77VK6ZrGx5wMUbCAjWi-rdqgZypGW6J8M8hS8UgBjP0obxvGIPIFPsvYNxp1pUyC0RWzGHcZHic4uFfgkKdrbF0-GUHvPW0F445BQeeUHr8d6SPbWieRA5drAvQPnUkM5VrUodJUGjR-niYtJhgPgZFbtNY0X8Lra7ngzOBG4MZak2XQvsiRLYAcMB4_0QZ1n6seMatAKB7b6W4gPshnsCvGHwIHhO2zazzCfF1skr6UVFRivscGjb2oJ0E_TzSE3jMSMQpgyipXQiqPDmgCnNciBo25jayYIOlWd_JnZfaYF7Aub0hISdj_8soqg7NA4csF1J24NLDeYrzYp_ftRvUcuec_nusgrprc4IdywwMuUO0xPTRxY_mi1XGzGWIg8eXY3IbYa6YEPETLaOKmgcpOmb-3-21ldZ_R98aFy6nVusNg8E3xRDVKwcslhR13VwlE2imC2Bv7IPkSsqPNUhyeQW3TIK5xxK&cid=CAQSTwB7FLtqnRd2d_zldCw7yy6OlGd8Gi3J3VAjFQKaxXqeutqhqeDPm2JdwpbvCfIITo9fgYzk2KATOKk_Wt78hlH3kSfvHTjRcGoW8DkKjJIYAQ&dv3_ver=m202402290101&rfl=https%3A%2F%2Fde.cosmetiks.net%2F&ds=l&xdt=1&iif=1&cor=658080787492139400&adk=250412561&idt=225&cac=0&dtd=50

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4b1a57cd9e3cf880920f490d4a9734b194bf1b2cd0b5aa7b8cb4ccc7f260342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8818833347061898&output=html&h=600&slotname=1813637107&adk=3357627370&adf=3433008094&pi=t.ma~as.1813637107&w=300&lmt=1710230771&url=https%3A%2F%2Fde.cosmetiks.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710230771349&bpp=119&bdt=648&idt=617&shv=r20240306&mjsv=m202403070101&ptt=5&saldr=sd&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=4519474484231&frm=20&pv=1&ga_vid=396612234.1710230772&ga_sid=1710230772&ga_hid=2088678729&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1154&ady=1061&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31081575%2C44795922%2C31081690%2C95324161%2C95325785%2C95326936&oid=2&pvsid=4145890288937817&tmod=377771551&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=628
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39585
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 7B68 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4c6ef8b16dd2206f4a58bf4aaf054fedda2fd6e2709fc98d31d4fa277307396

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK /
track.sunmedia.tv/ 42 B
404 B 305ms
82ms Image
image/gif 212.102.45.225
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.sunmedia.tv/?ap=smptf&it=e6c4e2fe-6602-44a2-bf06-bd9aca1f3fc6&tp=op&pos=0&loop=1&pb=1&dnt=1&rnd=1710230772966
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.45.225 Denver, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: unn-212-102-45-225.cdn77.com
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:13 GMT
TP-Cache: HIT
Last-Modified: Thu, 15 Nov 2018 09:59:07 GMT
Server: nginx
Age: 31783
Vary: Accept-Encoding
Content-Type: image/gif
Cache-control: max-age=0, s-maxage=31536000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
X-Device: desktop

POST
H2 200 / Show response
s.richaudience.com/ex/ 3 KB
2 KB 224ms
73ms Fetch
text/html 64.31.24.174
LIMESTONENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.richaudience.com/ex/
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/inhome/1.46.2/inhome.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.31.24.174 New York, United States, ASN46475 (LIMESTONENETWORKS, US),
Reverse DNS: 174-24-31-64.static.reverse.lstn.net
Software: nginx/1.14.2 /
Resource Hash: e44f6eca4948ad91c36ecdce36f9794ed632f54665e5ef5f7c4ab2e5c2af02ff

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 12 Mar 2024 08:06:13 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
fonts.gstatic.com/s/robotoslab/v34/ Frame 74E4 34 KB
34 KB 284ms
133ms Font
font/woff2 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%20Slab%3A400%2C900%7CGoogle%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:14:17 GMT
x-content-type-options: nosniff
age: 294716
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34328
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 01:54:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Mar 2025 22:14:17 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 74E4 33 KB
34 KB 208ms
63ms Font
font/woff2 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%20Slab%3A400%2C900%7CGoogle%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 18:24:54 GMT
x-content-type-options: nosniff
age: 394879
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Mar 2025 18:24:54 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 74E4
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C6Tiw9AzwZalJjYK88g-BkqCABMjV4o52tvzj5d4RZBABIPOq-gFgyYaAgNyjxBCgAdCkqcgDyAEJqAMByAPLBKoEzgFP0PsyDc_wZWhYUDUY3KoYW9D0qaepKVVdYFxwlKEysmxCByH1ORi...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xeec1302aa4d13e230000000000000000%22,%222%22:%220xfdb845530a5737f30000000000000000%22,%223%22:%220x776ccf...

0
0

264ms
132ms

Fetch
text/css

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xeec1302aa4d13e230000000000000000%22,%222%22:%220xfdb845530a5737f30000000000000000%22,%223%22:%220x776ccf069e327a50000000000000000%22,%224%22:%220x971a6589ce9b6a840000000000000000%22,%225%22:%220xdc21a69457299d350000000000000000%22},%22debug_key%22:%2213600162321586787938%22,%22debug_reporting%22:true,%22destination%22:%22https://atlassian.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22956977744%22],%2222%22:[%22true%22],%224%22:[%2203-12%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226240240152900336113%22}&andc=true

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:13 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xeec1302aa4d13e230000000000000000","2":"0xfdb845530a5737f30000000000000000","3":"0x776ccf069e327a50000000000000000","4":"0x971a6589ce9b6a840000000000000000","5":"0xdc21a69457299d350000000000000000"},"debug_key":"13600162321586787938","debug_reporting":true,"destination":"https://atlassian.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["956977744"],"22":["true"],"4":["03-12"],"6":["true"]},"priority":"500","source_event_id":"6240240152900336113"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 12 Mar 2024 08:06:13 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 12 Mar 2024 08:06:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xeec1302aa4d13e230000000000000000","2":"0xfdb845530a5737f30000000000000000","3":"0x776ccf069e327a50000000000000000","4":"0x971a6589ce9b6a840000000000000000","5":"0xdc21a69457299d350000000000000000"},"debug_key":"13600162321586787938","debug_reporting":true,"destination":"https://atlassian.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["956977744"],"22":["true"],"4":["03-12"],"6":["true"]},"priority":"500","source_event_id":"6240240152900336113"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 7B68
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C4xZX9AzwZc3UBJ_qxtYP8s2deKPLr692u4iP3fER9MK1q64BEAEg86r6AWDJhoCA3KPEEKABksqmvCnIAQGoAwHIA8sEqgTcAU_QfBpRW7t6liOR8loTsotBZkQQYJkgAoa3EWtSlUdEuCL...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xf0cb44dd47eb62a20000000000000000%22,%222%22:%220x50b6ed299f5f293a0000000000000000%22,%223%22:%220x9ab631...

0
0

266ms
134ms

Fetch
text/css

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xf0cb44dd47eb62a20000000000000000%22,%222%22:%220x50b6ed299f5f293a0000000000000000%22,%223%22:%220x9ab63186965a09750000000000000000%22,%224%22:%220xd72b7db8550f91600000000000000000%22,%225%22:%220x408483ee939e1f720000000000000000%22},%22debug_key%22:%2213752473076389815543%22,%22debug_reporting%22:true,%22destination%22:%22https://miami.edu%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211132314898%22],%2222%22:[%22true%22],%224%22:[%2203-12%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%227748603179107833633%22}&andc=true

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:13 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xf0cb44dd47eb62a20000000000000000","2":"0x50b6ed299f5f293a0000000000000000","3":"0x9ab63186965a09750000000000000000","4":"0xd72b7db8550f91600000000000000000","5":"0x408483ee939e1f720000000000000000"},"debug_key":"13752473076389815543","debug_reporting":true,"destination":"https://miami.edu","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11132314898"],"22":["true"],"4":["03-12"],"6":["true"]},"priority":"500","source_event_id":"7748603179107833633"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 12 Mar 2024 08:06:13 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 12 Mar 2024 08:06:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xf0cb44dd47eb62a20000000000000000","2":"0x50b6ed299f5f293a0000000000000000","3":"0x9ab63186965a09750000000000000000","4":"0xd72b7db8550f91600000000000000000","5":"0x408483ee939e1f720000000000000000"},"debug_key":"13752473076389815543","debug_reporting":true,"destination":"https://miami.edu","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11132314898"],"22":["true"],"4":["03-12"],"6":["true"]},"priority":"500","source_event_id":"7748603179107833633"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js Show response
pagead2.googlesyndication.com/bg/ Frame D2BB 51 KB
20 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

296014911d97ff7dfdea28ae20e549275b38bfdfc10971dff75d7afff300188c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20259
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:29:57 GMT

GET
H3 200 KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js Show response
pagead2.googlesyndication.com/bg/ Frame E0C4 51 KB
20 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8818833347061898&output=html&h=600&slotname=1813637107&adk=3357627370&adf=2256998222&pi=t.ma~as.1813637107&w=300&lmt=1710230772&url=https%3A%2F%2Fde.cosmetiks.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710230771354&bpp=117&bdt=653&idt=643&shv=r20240306&mjsv=m202403070101&ptt=5&saldr=sd&abxe=1&prev_fmts=0x0%2C1200x280&prev_slotnames=1813637107&nras=1&correlator=4519474484231&frm=20&pv=1&ga_vid=396612234.1710230772&ga_sid=1710230772&ga_hid=2088678729&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1154&ady=2139&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31081575%2C44795922%2C31081690%2C95324161%2C95325785%2C95326936&oid=2&pvsid=4145890288937817&tmod=377771551&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=1&fsb=1&dtd=665

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

296014911d97ff7dfdea28ae20e549275b38bfdfc10971dff75d7afff300188c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20259
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:29:57 GMT

POST
H2 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 124ms
122ms Fetch
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8818833347061898
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame A76E 172 KB
61 KB 226ms
64ms Script
text/javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:11:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35674
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Mar 2024 22:11:39 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/ Frame A76E 12 KB
4 KB 63ms
62ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CIihti5pcIOwmpJ3o_910g0RBEUiLAjAyzZI365JSBfPoPKyZEkazrI181QE5pm1efNaiZIW4-4kNL0c_yMIhqzVusvwF99G8JpWcMcTm2PTdpgmTdMhVb2jsXZVo4207y4ni8gvd_DkA5Szk8nd_2vjXiF_rrsqH59zJtgA4nNUl6fLfT0rkDtAmpSEmn5b4Sq0oSVTE4q04xmkDsFZCMzF9u-HbtXx4WxTZXudOermk4yjg&cry=1&dbm_d=AKAmf-CuO4Bn_tLCeg56H1L15Df3ssuFqjygZ09EAG0LWZ-iG4L1gJWtxSWoWWtUB9A7ON_adjasUZcJ0kEkHkd4WEalHl9vcGzskmSKGdnBjSOauFwd2zSt9si0x_pYptiorXUhzGWopswFLNr7KJR-o4pxJZTTz0fHW3gXPWktw_E-r4nCXnUV19-l1i_iKB6TgNRCB_IPxPXPIpXYHofQpbIxOGG024R6xc95uMNsIkCip31CrOsQ3scYRCDnsausrHvY74zpiR7bBQUfVPL8_ndkx85G5DKhy9uqjGq2bCUEAChPOg9eaUaRfxcyoFhFOU6KzcYk0UocYPlVy7Seg_V8Exj0qonccq6vpoasqufy-y0991GaITQ_43rARDqAXIm43BB2UzwUoLAtrOC3_vDvROJWDqRS5Yi_7dT3pbo-MXLQq4CGhIwh3Z4iEqKSoU3Gr49LRhyvcduIqR-04kr7ql3I7ZUPpeY-1QIctI4Cu_UL2-RFJZf6DM_t73z-PbdEwoRgenjYiQGqSZEprWUbQtWwbvS01U0jvL8uny72HXYGrieWP0NNdhdGpC3O_hh5ox0zbQ7CvYPKy1848ZWZzczibn4uw2GO8_D8ftjO_IkHqdm-DeUjurBqvDCzEANwn-hC9hqoLWFOh87AZ2bSv73uM1vmua8pKLYzMUnFkL_nY8X0_p1SVPMAgp2ayepubMlIoUbZ61n0YeIOcp47yDU99tp0_ag5YI7mxUrkmzetnoypv5AeNU6OlIYF3W-yOQiYVLLlnrJ6kfMIQmnZoik_8qa3FWnybjFCcBQaFCtTZ2LkZiIyiRD95RnOhbu6h0naHdsNwlZCGXI_CnUU2Yoyt1e3QuoD45OkEfDlHTwfacDVTqLOSycBxcRBDVwGne_mTKlt6JnEOiMr9f6DMR1UrkCZuhFh9vMdRlQLGVzudt0PtutxNexMfsSTM5vE24QI3B2wCYwr-6Dyx0PJqvLtQxHrB7udOYdXaW7pEWWuxBCxDy2CJvFEi2aghEWGe-Ejp5FKkCfvW-LF8L72B5aJqyggWbGkYYScuN5XNrzoNWyFn36aDdYimc5TRCSdExfPKjcf2XoQLR-3Btbm0uAsthKoZUoRORE5AGjCVykAXHqO943T6ZoSD6c6GD3Bfwt7G6QoD4ZyJCFZHI-mC6MKhOJNXf1VCzgl7OT95dWlRyxGkNnqg84Qk_O-zKuHZBDcBbhrox_DQq66qM-8_zjINh64RqkWhXPYNifDx4qLGWUu7OGCYo5UDPZVP32s6eV_mjjwA5i-V31W4Sn5O0bNqV0x7wLooS38Qu29aEw_fChfbjlPXYCW0vOde7sDnmSWNTw9TdvilOaHb5E9IuymLLy0VBf75JNzSNNMVWsbCOB0tv9uZdOeHE64igrXtw-30-OL7Q6fiKyjuxlSuX2ZjOZ40iH6rjLQRrE8okavU7bpgsffWNJguyi4cKvYdeyUX-f-i8hBNZpe5HyuL-mEVtPAht4PWYMcUW4dojTrR9oc4uh1ve7-t3iqSIVw8NjWesAjKoshwCszUYRYAsjJBNHqQCbb6ySnzAXAK3TNjDJH6wt10HxKGo4dXifIv9iHsh35EC5X1i8bNCO4sb4tSCPlHGbJEifS1i-P3QfbPfshAdZb8MmDSAEXkv_b6L3jHTBv6seZ7oAzhcBSgd_ikzF2XFP8AjjvdrhOFBC4iVGS74n25yweY62SEJaw_L5ni28czgWrYkhw2y83TVtZQjY3qFUOaOnnkxENW8f6Mg79-xBi7-4rnkA_YDuRpahPVvW1Zdvj0jUNMs5FiDnq1LJtuO-NIU6XBma_i5XBx_ywMKlLRfCivG6YWwvHf3TnGKyEXFxLzX0hVZJX8p69ZN3WkOne8nTPSINwOsTNK5LIy5aNjH-8o-CMRpNdqdTJVn-NDGRUeGj8Fe0o6Y6C75C7QrPr1Omr1qtZeUXLmuyZhuLC2PlsWcUb5elCB_XLxkCNnFzqPOFoP8fFinZVH7QHg2gqA5hTVMDU0VCeyg2EDu79l-lILyxaW9GzSYjhh00Kv1N4eeWyYNOdsALD-vShgWscuyitQvZ0Nu6MdAAkiI5V9dQ4Mx6BxeU_kxhysZ9NHjlNdWr8j_LzS1za9-6kduO_5_023CBBmIcYpQby4jtGgXIhnC3wEuKInuaxMvxgY1eZgvNKNUZXEj8g1Zy7Do3YI_NR39qu9OuDUa6-AuHYdA3N-4UzUB7XSUeSEn6kY4lcn8eHFZqTca4PVn20AlasPG2d80sUM1FJqOGgT1ZEGTxuSStPG7xRBc26AJHeTMOKxUgNkF-y4-Ojb93MYDfYr6dJqm_alpGjQ6pI2yhwbStbZPO-TIh7MF2MlGzimMpxadrdnLnVTemLcj6RzBGBFSJBZnVmWb484ScPs71P6T344MrRvFXTgM5wUTwes0LJnfdRaN-yYtKu7j6alN9vYgXPwceHwhMguRwh8YhnTUj4tQV4usTvK0dEtr2Fx-3V7CL2relQ_ySwC4D87bZ8bALG1TtZNBT4FIRg8OrwYoSNcWGX21egD-A_Ax_elvjvNJMNhcZRk6iRRyT5css8AYShG_WruVJ8_L4toxHfuBRyNca24FRKRTwFMhS9zX6UL7UTKNB7bqlwvBcMXfFt21BxUB7Sx283k0L9B0KjlxBSYpfI3OnB1-QZGifAUD4KWF7ARjKgVaekxHWPQW3f82FGTgYpqPAWd1K2HZQsPQh5epDZshiBVK0W-UGp06nhTWfYz3f2MMuEU-Y3LpTmSFWmyf6lkM1ckinIve20axhkV9BG4OSckBAEYT4Q6_b-SRDOt-ziIXmPEC4u8sPFDl_I-zEAbuaaHZzllW_RVHcDC-mGH09R8YwetcndhGLpsIFyhJ53suqs_cC5QeXFfdj2T9LZObJZk9TjQ0sBAFSlFV4BgkUHWAQwFor146B3LJ5EQhTe_aVUS06IVywqrrzHNDjSWBvn8Tq-CQHSAiHTB55Gki-kuOUWTIbrsGGDkqsA4gMubqHpgKTmwhgwXXiIVL8OsLdKdfSJz3egGbfjPscjczDSN_m-tPEhJZjdVM5zMRLo-ymSLSrua2eycrluwwlE9MQQa9o5Ro2zq7e2fXHVGyOlXgDhqFcXUjrp0HtQF4TWu_TC1w_1ZgF_Tuwj3GOScBgF-NhJpY2MvO69XHGharoQHqhSWqPK8qzOkfiLkeb2TM6M1fs5jYziq90IXq8_kapuyJt0SVy4Mb2WVyX3JsbVZUzFTgPXAM5nw5101PUb8NTsgOmtReiSSttMAX1DQjEmBPPTiyNOHXBAPS8Tk9ScgcBUMj6CHQ4ZicRjRGFv7AyQm6A724nwfxYxst3PGsVZWLHuqgBgyPtWiqzqJMO9jTdc-FTsPxa5cXSUPhUOpVpvAa0liwtxJ6nBkU_Q1ZaaN1u_Er_239BkspQx6Y3UPlZH1zzr8SK9gKfLj0XbB8ZStVvDflE_wE77VK6ZrGx5wMUbCAjWi-rdqgZypGW6J8M8hS8UgBjP0obxvGIPIFPsvYNxp1pUyC0RWzGHcZHic4uFfgkKdrbF0-GUHvPW0F445BQeeUHr8d6SPbWieRA5drAvQPnUkM5VrUodJUGjR-niYtJhgPgZFbtNY0X8Lra7ngzOBG4MZak2XQvsiRLYAcMB4_0QZ1n6seMatAKB7b6W4gPshnsCvGHwIHhO2zazzCfF1skr6UVFRivscGjb2oJ0E_TzSE3jMSMQpgyipXQiqPDmgCnNciBo25jayYIOlWd_JnZfaYF7Aub0hISdj_8soqg7NA4csF1J24NLDeYrzYp_ftRvUcuec_nusgrprc4IdywwMuUO0xPTRxY_mi1XGzGWIg8eXY3IbYa6YEPETLaOKmgcpOmb-3-21ldZ_R98aFy6nVusNg8E3xRDVKwcslhR13VwlE2imC2Bv7IPkSsqPNUhyeQW3TIK5xxK&cid=CAQSTwB7FLtqnRd2d_zldCw7yy6OlGd8Gi3J3VAjFQKaxXqeutqhqeDPm2JdwpbvCfIITo9fgYzk2KATOKk_Wt78hlH3kSfvHTjRcGoW8DkKjJIYAQ&dv3_ver=m202402290101&rfl=https%3A%2F%2Fde.cosmetiks.net%2F&ds=l&xdt=1&iif=1&cor=658080787492139400&adk=250412561&idt=225&cac=0&dtd=50

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 08:19:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85627
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 08:19:06 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240306/r20110914/ Frame A76E 30 KB
11 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240306/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7d7ccd1b1b1900c730b760fa8b3b5748a073ecdedbd7710e04fbf03cd42afd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:20:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35164
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11520
x-xss-protection: 0
server: cafe
etag: 9162932350781899495
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 22:20:09 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame A76E 41 KB
14 KB 66ms
64ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 19:42:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 476598
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 06 Mar 2025 19:42:55 GMT

GET
DATA 200
OK truncated
/ Frame A76E 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4471e67df3f1b14a13de8180153ffef6607b90713dca69cb12d775fa4633274

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/ Frame 234A 9 KB
4 KB 65ms
64ms Document
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403070101/show_ads_impl_fy2021.js?bust=31081690

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 38560
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Mar 2024 21:23:33 GMT
etag: 5035419970550746386
expires: Mon, 25 Mar 2024 21:23:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/ Frame 5C93 9 KB
4 KB 74ms
71ms Document
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403070101/show_ads_impl_fy2021.js?bust=31081690

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 38560
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Mar 2024 21:23:33 GMT
etag: 5035419970550746386
expires: Mon, 25 Mar 2024 21:23:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/ Frame 4285 9 KB
4 KB 71ms
68ms Document
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403070101/show_ads_impl_fy2021.js?bust=31081690

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 38560
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Mar 2024 21:23:33 GMT
etag: 5035419970550746386
expires: Mon, 25 Mar 2024 21:23:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxWOMGUfnS02jwTPJHLGgsZht0rddLV3DwmeorLmQzfaG2GiIXY9o7PyskMFG-YVyG2TUrhbl56mh_4Pq28hReRUlJx5lRdMaVqeuLhkugObhVKA2oWva2jF7TrMMo5OjDPeagBZFQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 110ms
106ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWOMGUfnS02jwTPJHLGgsZht0rddLV3DwmeorLmQzfaG2GiIXY9o7PyskMFG-YVyG2TUrhbl56mh_4Pq28hReRUlJx5lRdMaVqeuLhkugObhVKA2oWva2jF7TrMMo5OjDPeagBZFQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzEwMjMwNzczLDMwMDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9kZS5jb3NtZXRpa3MubmV0LyIsbnVsbCxbWzgsInM3aGlHcm9NdnhVIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzIwLCJbbnVsbCxudWxsLFs5NTMyNzA4MF0sNSwyXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.s7hiGroMvxU.es5.O/am=wA/d=1/rs=AJlcJMyM_jr8RvrXE105utb8YiWSdMrSNA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1259cd75337ce37a8e8506ba109556fd3ee46450a6c49040b3885342ec59f2d7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KB8ra8lRDmZjNmVBCRo7DQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:13 GMT
content-security-policy: script-src 'report-sample' 'nonce-KB8ra8lRDmZjNmVBCRo7DQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjStHikmJw0ZBiOO90h-k6ENcyPGNqBWIDjedMFkD87stLJp6vL5kkgFgDiHf4eLDwrZvOqgLEuuuns4YCcczz6awpQOyUPoM1CIh96mewxgDxyQXnWS8CsRAPx9eZB9azCcz4PnkdIwDyyS46"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 290ms
121ms Preflight
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:13 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 287ms
123ms Preflight
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:13 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame D1B2 12 KB
1 KB 81ms
80ms Stylesheet
text/css 2607:f8b0:4006:80a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%7CGoogle%20Sans%3A400

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4d536a2aa16a3de990b9b61587dd0785b5a9ba49c4f196bb6357d0fbf489b8cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Mar 2024 08:06:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Mar 2024 07:14:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Mar 2024 08:06:13 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame D1B2 2 KB
822 B 67ms
66ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 05:13:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10373
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Mar 2024 05:13:20 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/ Frame D1B2 23 KB
9 KB 68ms
67ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/abg_lite_fy2021.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:13:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 22:13:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FAFC 143 B
166 B 129ms
124ms Document
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 2354
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 07:26:59 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame D1B2 3 KB
1 KB 69ms
65ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/window_focus_fy2021.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 20:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41471
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 20:35:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame D1B2 20 KB
8 KB 116ms
111ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:18:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35263
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 22:18:30 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame D1B2 207 KB
63 KB 95ms
90ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6afee967915e87f217a98c38c9d5ed411a339eac603c3f25364fea36cff27b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 07:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1871
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64070
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 12 Mar 2024 08:35:02 GMT

GET
H2 200 18f18197045a700707108b7faa532a76.js Show response
www.gstatic.com/mysidia/ Frame D1B2 36 KB
15 KB 69ms
67ms Script
text/javascript 2607:f8b0:4006:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/18f18197045a700707108b7faa532a76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c52cf3e31821ac82e857940e065f9372854d00fe9cbcb855017e2ad66d64542

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:23:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 294148
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15138
x-xss-protection: 0
last-modified: Fri, 08 Mar 2024 01:00:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 06 Jun 2024 22:23:45 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/ Frame 234A 15 KB
6 KB 116ms
115ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a1433553dad10b1617e945447ce8d2a7a4ce6542ad50fdb8b563f85560cbc3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 05:28:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9442
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6454
x-xss-protection: 0
server: cafe
etag: 9518204868993021864
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Mar 2024 05:28:51 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 234A 205 B
519 B 72ms
70ms Image
image/png 2607:f8b0:4006:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 09:01:03 GMT
x-content-type-options: nosniff
age: 515110
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 06 Mar 2025 09:01:03 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 234A 604 B
696 B 76ms
74ms Image
image/png 2607:f8b0:4006:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:17:11 GMT
x-content-type-options: nosniff
age: 294542
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 08 Mar 2025 22:17:11 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/ Frame 234A 22 KB
9 KB 115ms
114ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5efd17aa9600929f5517878dd267b6fdfeca37478d6987b5d75caec4f1e4b1a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 19:23:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45771
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9093
x-xss-protection: 0
server: cafe
etag: 981128176822753981
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 19:23:22 GMT

GET
H/1.1 200
OK /
track.sunmedia.tv/ 42 B
404 B 84ms
82ms Image
image/gif 212.102.45.225
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.sunmedia.tv/?ap=smptf&it=e6c4e2fe-6602-44a2-bf06-bd9aca1f3fc6&tp=ef&pos=0&loop=1&pb=1&rnd=1710230773699
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.45.225 Denver, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: unn-212-102-45-225.cdn77.com
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:13 GMT
TP-Cache: HIT
Last-Modified: Thu, 15 Nov 2018 09:59:07 GMT
Server: nginx
Age: 31783
Vary: Accept-Encoding
Content-Type: image/gif
Cache-control: max-age=0, s-maxage=31536000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
X-Device: desktop

GET
H3 200 css
fonts.googleapis.com/ 717 B
370 B 80ms
79ms Stylesheet
text/css 2607:f8b0:4006:80a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato

Requested by

Host: client
URL: about:client

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

77d9907ca853ab885fd7a35a29faaf4206b8fe47347cd9c12391d64451ad6f37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Mar 2024 08:06:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Mar 2024 07:14:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Mar 2024 08:06:13 GMT

GET
H2 200 / Show response
sync.richaudience.com/DF2886F390D432DF0C8E98D69702ED6F/ 301 B
398 B 764ms
165ms Script
text/javascript 162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.richaudience.com/DF2886F390D432DF0C8E98D69702ED6F/
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: c509e5b66c0a95ce4608a351d7aae756351eca5be1010c41c95d5797a998610f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:05:45 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
content-type: text/javascript;charset=UTF-8

GET
H2 200 pandg-sdk.js Show response
pghub.io/js/ 17 KB
5 KB 120ms
35ms Script
application/javascript 35.241.45.217
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pghub.io/js/pandg-sdk.js
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.217 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 217.45.241.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 27961ab8c37cddad89230364167c048c6377a80e38542a5ffbca600faf4098ea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 07:40:52 GMT
content-encoding: gzip
age: 1521
x-guploader-uploadid: ABPtcPquZk0UUSajKD35_F_5gQe392kd3DcjsJFbFyoZfceD1dlR3GcWuPGkGSUB4svJe0Wh_Z07gRb8kA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5009
last-modified: Mon, 05 Jun 2023 16:36:50 GMT
server: UploadServer
etag: "47a886353056caf33a998c6041e20896"
vary: Accept-Encoding
x-goog-generation: 1685983010517890
x-goog-hash: crc32c=aHj4lg==, md5=R6iGNTBWyvM6mYxgQeIIlg==
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
cache-control: public,max-age=3600
x-goog-stored-content-length: 5009
accept-ranges: bytes
content-type: application/javascript

GET
H/1.1 200
OK sm-prebid.js Show response
static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/ Frame 3E46 577 KB
181 KB 130ms
130ms Script
application/javascript 51.81.154.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/inhome/1.46.2/inhome.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 51.81.154.83 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS: ns1005224.ip-51-81-154.us
Software: nginx /
Resource Hash: 35cdb025d1718d610959fde36114e09f2d3b569ea70f50ab77cb3badfbb3681c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:13 GMT
Content-Encoding: gzip
TP-Cache: HIT
Last-Modified: Wed, 31 Jan 2024 15:33:59 GMT
Server: nginx
Age: 49749
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 184854
X-Device: mobile

GET
H/1.1 200
OK /
track.sunmedia.tv/ 42 B
404 B 127ms
85ms Image
image/gif 212.102.45.225
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.sunmedia.tv/?ap=smptf&it=e6c4e2fe-6602-44a2-bf06-bd9aca1f3fc6&tp=req&pos=0&loop=1&pb=1&rnd=1710230773711
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.45.225 Denver, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: unn-212-102-45-225.cdn77.com
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:13 GMT
TP-Cache: HIT
Last-Modified: Thu, 15 Nov 2018 09:59:07 GMT
Server: nginx
Age: 31783
Vary: Accept-Encoding
Content-Type: image/gif
Cache-control: max-age=0, s-maxage=31536000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
X-Device: desktop

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 2623 38 KB
13 KB 69ms
67ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 294958
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Mar 2024 22:10:15 GMT
expires: Sat, 08 Mar 2025 22:10:15 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/ Frame 5C93 23 KB
9 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:13:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 22:13:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7561 143 B
166 B 82ms
79ms Document
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 2354
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 07:26:59 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame 5C93 3 KB
1 KB 78ms
76ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 20:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41471
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 20:35:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame 5C93 20 KB
8 KB 93ms
90ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:18:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35263
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 22:18:30 GMT

GET
H3 200 15566663368169019705
tpc.googlesyndication.com/simgad/ Frame 5C93 31 KB
31 KB 93ms
90ms Image
image/png 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15566663368169019705?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnuA6z1ziUt_jezM4I_ZH2IyTYqlw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d33bec513457fb67bd104c622c0c02fa140bf2c3e60afffad3f91083ebb70d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 07:06:02 GMT
x-content-type-options: nosniff
age: 3611
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31551
x-xss-protection: 0
last-modified: Mon, 30 Oct 2023 11:29:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 12 Mar 2025 07:06:02 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 5C93 207 KB
63 KB 78ms
75ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6afee967915e87f217a98c38c9d5ed411a339eac603c3f25364fea36cff27b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 07:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1871
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64070
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 12 Mar 2024 08:35:02 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame 5C93 36 KB
14 KB 99ms
97ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ad5f1dc06e90eea91c3839cf0b767b877f89d92eed940ac50b7c1eb05982050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 10:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14569
x-xss-protection: 0
server: cafe
etag: 13248958906723212501
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 10:22:31 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/ Frame 4285 23 KB
9 KB 107ms
106ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:13:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 22:13:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 67D8 143 B
166 B 71ms
66ms Document
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 2354
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 07:26:59 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame 4285 3 KB
1 KB 108ms
107ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 20:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41471
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 20:35:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame 4285 20 KB
8 KB 70ms
66ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:18:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35263
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 22:18:30 GMT

GET
H3 200 3758202564062770125
tpc.googlesyndication.com/simgad/ Frame 4285 22 KB
22 KB 110ms
107ms Image
image/png 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3758202564062770125?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkft_ZH477Zv2Cq9N2ukASrsy5fiQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05edc14da568c6aa41ac14889a772aa33380b9f36a4da8cfd3f954c970f1d383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:11:55 GMT
x-content-type-options: nosniff
age: 294858
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22182
x-xss-protection: 0
last-modified: Mon, 30 Oct 2023 11:28:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 08 Mar 2025 22:11:55 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 4285 207 KB
63 KB 70ms
65ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6afee967915e87f217a98c38c9d5ed411a339eac603c3f25364fea36cff27b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 07:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1871
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64070
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 12 Mar 2024 08:35:02 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/ Frame 4285 36 KB
14 KB 123ms
118ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240306/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ad5f1dc06e90eea91c3839cf0b767b877f89d92eed940ac50b7c1eb05982050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 10:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14569
x-xss-protection: 0
server: cafe
etag: 13248958906723212501
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 10:22:31 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15717895156372064762/ Frame D4BA 90 KB
23 KB 223ms
83ms Document
text/html 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

087f803d562ba3819b8e2032e338addac5eb53ac5fcd9459a520f59ec41c96c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:14 GMT
expires: Wed, 12 Mar 2025 08:06:14 GMT
last-modified: Wed, 14 Feb 2024 22:09:09 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A76E 0
0 282ms
132ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsspg3mrcVBBq4SsHRDyYTU29K1ahHQRmO9YXjhvjyF3aAENr82h_7wK5Ck3QPn2nlAAt4YJCzHI1Y0ljRTgJSH6z3BQOqTtSmNqDvbx-CsGO-7oh34Irtc-vcJuhgqv7WkgXz1YizeunxnbkDOeQr-KUwnSMUIe8_yKuLWCdLRr9qqCJohMUrl1acdWeKn72ByGcrLyxUj2IiLV-axZcIJPVMYBvzPgIUCD4iJflcIfz4DpsqPmdmJvpR9DC18-oFvkvMFjGICarerUKojM1hCeat_Cflh-MvwOXYhG6NNqKjU7QhrRPkpWfQMDGtFIuS_irxs8hj0ZCmj2C7kWxTXxviSDTx29FDDSv49caD5EQlI1uzjaXYLrsgqbEQI8As-Mtdei4CH9hO-Wp98ltN1tOnWaS7I55csQeaq6mNXmKsz-tzcL1k6UcCYAntaaENLxQdom2cy-DNgcEUZj3vGFR6pvzIgAvVWEI9OhKm12fCQQFc-W-0x33mkaDtXp3lptjeHhSvaZbBscEg1Txo5P76g51i3-awLvwyfHAcjZSvfivxTbO6p6Z5C6ZYoogsQrf31rmPZDR5h2vx06eM45Gzu-0ZNQwdJK0Inh_lERjPHlcyogmYyqsoGi4iJGxkW4kkxkGudRAHdtYihaP3uq8Z4X8-FxVUIXhaZppa5hPwDuMwjot0M157uEdqNNWiYS1vrLhIq2Kjo5Rbf4a0rCZaXFN7kjLmTvYW7Djx6LmsQCSFQAYXjWviPNR2l5aeCd3z1IA9_u_kysuhEDkwOLpNcztcnhJDVVLqGHLN4P4n4RIof0MpFKfHYG7PCtFCh-jRmfNVr8I3wcTcIjx_wqeOXRZTt8AAbLnWJcZSV_bBVmYDtTiWCljc6qBw2Kra_O_hse-OVRRqWcMFn7d-8WqbkeajMMquyOvUVr_dDBOYdVISm9d-snfjeRdepkArHE8g-OEX5kYTT7a8BYmVJdMWP_WtaPx1ADAZ91eLrRLzEOdQaApP30DDY-HkSgS5WejNsceW74VpVtp6jNTkDeW-BPK3HCyblCkAObhFPidTo5omuI_w7my00a5XJuC861sVQ-yt4Rda15IxZF3drov0YcMkZz7VCOAZiSaQ3YkdEe848g5Z-maGa3D8ZgEEJtxbNGzpw6DDx_dVOMqtj0aeB3L4Qig41FivdTQxlHaLzBsv5P6-YZyHJr_8VzpN6XILwrqy_pucylbNIgYOuArzgNAKcXrU8T5ueam3-i5IRfGPOkaC27f-LGwBmPKmGVy5sSI9sTdmPUQqkaJAwImrhlEeFB4EZkYuBt_OuPlvrjNiOIoCE34USFJbznMp_v-hWqU8OAP36RhC_kwj21bDhQ-T-KmiSQ7NtLpLR9NoHuIfmjr-VqVB8yvJsrCK4RCc8M21ej9gdJnmCIGRkXQA&sai=AMfl-YTiHQRGd4v00e4wq5Jnc_CkthPBgJ3b5obO-K2LsgWZuMFDgSjjcLWV9Evb2aQkTclwqTJPxGM4mu_6DLPnhNCJ5gLw34jNqw1RIPet0qwfDtj46nXzIIDTrEKBPCyMcUdGxRIulfYI2TBAXEsDToFzqBnkf6VjJ_a04je_ReM0lLCrsDsGQi8pOw6MB8BPK-efWD7mACz5y_8IOZaMbdLXbQPAP3rR9COyxF4tzw9i3aSRwEMfXr4P6CMG4sWlV_hMztnPF3QK_ZwSQIAetp_PT4xhD7zrrO85gvdE-w&sig=Cg0ArKJSzCKv5_eG-G7SEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=817&cbvp=1&cstd=800&cisv=r20240306.61185&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 12 Mar 2024 08:06:14 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 12 Mar 2024 08:06:14 GMT

GET
H3 200 AGSKWxUE4XFDsNcbisWmHmcne44HIiKY-AOGZB_oSrlKswjhRAyfxbqhxczVIjojhwJ-96qo4qorROcxePK9j7McdZdSw_vp78h4SCB-2niDWgH66XQ_0UZrBfvrtnjvpgKZ5Gua3KoWfA== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 106ms
104ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUE4XFDsNcbisWmHmcne44HIiKY-AOGZB_oSrlKswjhRAyfxbqhxczVIjojhwJ-96qo4qorROcxePK9j7McdZdSw_vp78h4SCB-2niDWgH66XQ_0UZrBfvrtnjvpgKZ5Gua3KoWfA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzEwMjMwNzczLDk5NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVzIl0sImh0dHBzOi8vZGUuY29zbWV0aWtzLm5ldC8iLG51bGwsW1s4LCJzN2hpR3JvTXZ4VSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsyMCwiW251bGwsbnVsbCxbOTUzMjcwODBdLDUsMl0iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4ad4a0e3414150a57ae979c0f031ca14dac5c20ef7997b98fdc33af99f09cbaf

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-67g39Ia0AjJiCPkAmZkJeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
content-security-policy: script-src 'report-sample' 'nonce-67g39Ia0AjJiCPkAmZkJeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjytDikmII0JBiUAzbyXTe6Q7TdSCuZXjG1ArEBhrPmSyA-N2Xl0w8X18ySQCxBhDv8PFg4Vs3nVUFiHXXT2cNBeKY59NZU4DYKX0GaxAQ-9TPYI0B4lMLzrNeAmIhbo5vMw-sZxPYcLZLBgBQrC7Q"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 74E4 42 B
64 B 132ms
128ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstGZMoa2ffih8NMHVbAUn47WVyQ9F-zDlEOdb3JmQxiKdc54L57_5HOUebNXc1hyRkLOwte2nPWvw7qYtX1Vmm6SHYaTz_N2ukaMVEFapsJjLTPQBspCk92nMnmgweAWHp2o59CKQAA5Cu0GXOcdbjdE5yaQ5GClTC-QGdc9glhfYWJoSZikoxlr9NV8zk&sai=AMfl-YQ3f_ukPawfzHWmq5Mj834mLt25tPqsU91-Y0gBbIpdkyYBzfRcUxBGHY9Vojj_p-7yVXOYzJosDLtE8Eb6hzNo68Y9M7wkbPk5pxQuSnY_YJZGgeoCap1Jy0x2-RjDrj4p9_Zr02Va_CM6hbam&sig=Cg0ArKJSzNIuxOo26qN_EAE&cid=CAQSTgB7FLtqNDr39uZllTdHWvUd0WtwqA6IvZEroyxiPhGcvm2ULPP7q2k5VB_ip_haaUOGBTrZ9QHl2O1Ca3p6OE6QC8feT_fZkbkqAx-JUxgB&id=lidar2&mcvt=1071&p=0,0,280,1200&mtos=1071,1071,1071,1071,1071&tos=1071,0,0,0,0&v=20240306&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=4203156479&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=616357200&rst=1710230771953&rpt=1086&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FAFC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

86ms
83ms

Document
text/html

2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:14 GMT
expires: Tue, 12 Mar 2024 08:06:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:14 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js Show response
pagead2.googlesyndication.com/bg/ Frame 2623 51 KB
20 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

296014911d97ff7dfdea28ae20e549275b38bfdfc10971dff75d7afff300188c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20259
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:29:57 GMT

GET
DATA 200
OK truncated
/ Frame 4285 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2546d5b4d0e15c2a61f2a8afabf51ce4eca868a10b8b50e08897966e3a5bb047

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js Show response
pagead2.googlesyndication.com/bg/ Frame DBC1 51 KB
20 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

296014911d97ff7dfdea28ae20e549275b38bfdfc10971dff75d7afff300188c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20259
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:29:57 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 3E46 0
116 B 230ms
65ms Fetch 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://de.cosmetiks.net
date: Tue, 12 Mar 2024 08:06:13 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 pb Show response
ad.360yield.com/ Frame 3E46 0
102 B 238ms
58ms Fetch 34.206.244.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/pb
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.206.244.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-244-148.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://de.cosmetiks.net
date: Tue, 12 Mar 2024 08:06:14 GMT
access-control-allow-credentials: true

POST
H2 204 pb Show response
ad.360yield.com/ Frame 3E46 0
101 B 239ms
60ms Fetch 34.206.244.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/pb
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.206.244.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-244-148.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://de.cosmetiks.net
date: Tue, 12 Mar 2024 08:06:14 GMT
access-control-allow-credentials: true

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 3E46 0
179 B 448ms
151ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://de.cosmetiks.net
date: Tue, 12 Mar 2024 08:06:14 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame 3E46 37 B
511 B 86ms
78ms Fetch
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=844716
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d28f485e144c23af73f34767e043a23c28b797bfc5e63ae3a192360dd0097d6d

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ebug4eAYtOZvqw0bTcEe626108w8aHe%2BEPCT1N82UkKmoQzAjkQgHddcZ9RucxyIQX37SuvVsp4xKESafpvgA57V%2F566nSOP5mnzr73Bf0RIjQyUi0VnYlFAVmDufn0e%2FDwlH4d0"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 863248a40fbc74a6-MIA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ Frame 3E46 15 B
413 B 213ms
68ms Fetch
application/json 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip232.ip-51-222-239.net

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://de.cosmetiks.net
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 204 / Show response
prebid.smilewanted.com/ Frame 3E46 0
309 B 265ms
167ms Fetch 2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 863248a49b118dca-MIA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 204 / Show response
prebid.smilewanted.com/ Frame 3E46 0
35 B 265ms
168ms Fetch 2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 863248a49b128dca-MIA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 3E46 16 KB
8 KB 368ms
367ms Fetch
application/json 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-25-230-144.us-west-2.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

570c3c588884686ff7b1acd0fc2fef6118b756051b0aee381d2022a0ad72f573

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
content-encoding: gzip
an-x-request-uuid: 54353b0d-8ea1-4e48-a2f1-8f2a6a51aa09
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 3E46 875 B
2 KB 514ms
138ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: cc1ff19bcab6afdf6a3a34f8dce43cbedc9ce3bcc141ca503f6de217029582e6

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://de.cosmetiks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 3E46 1 KB
2 KB 539ms
164ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: 3b513fbc1baef7567a5a2e4a3b3b91381a3ad88a38a76334fd764e621d09daf8

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://de.cosmetiks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame 3E46 918 B
1 KB 457ms
293ms Fetch
application/json 147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 513666ff687c8ddc295f36ee69793b43b2c7c9e971b557584b77eb487c02bd3a

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 228
content-length: 468

POST
H2 200 / Show response
shb.richaudience.com/hb/ Frame 3E46 0
232 B 362ms
140ms Fetch
text/html 208.115.232.150
LIMESTONENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://shb.richaudience.com/hb/
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 208.115.232.150 Los Angeles, United States, ASN46475 (LIMESTONENETWORKS, US),
Reverse DNS: 150-232-115-208.static.reverse.lstn.net
Software: nginx/1.14.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://de.cosmetiks.net
access-control-allow-credentials: true

POST
H2 200 / Show response
shb.richaudience.com/hb/ Frame 3E46 0
231 B 503ms
282ms Fetch
text/html 208.115.232.150
LIMESTONENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://shb.richaudience.com/hb/
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 208.115.232.150 Los Angeles, United States, ASN46475 (LIMESTONENETWORKS, US),
Reverse DNS: 150-232-115-208.static.reverse.lstn.net
Software: nginx/1.14.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://de.cosmetiks.net
access-control-allow-credentials: true

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ Frame 3E46 357 B
876 B 416ms
152ms Fetch
application/json 52.25.230.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fde.cosmetiks.net%2F&PageUrl=https%3A%2F%2Fde.cosmetiks.net%2F&PageReferrer=https%3A%2F%2Fde.cosmetiks.net%2F&CanonicalUrl=https%3A%2F%2Fde.cosmetiks.net%2F%2F%253E%253Clink%2520rel%3D

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.25.230.144 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

c396cef6c6b9ff80ef550ced36b7fb4ef4228b296b712b9aef12ea11e29f4ddb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
via: kong/2.8.3
x-content-type-options: nosniff
x-kong-proxy-latency: 0
p3p: CP="CAO PSA OUR"
x-kong-upstream-latency: 38
content-length: 357
pragma: no-cache
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 bid Show response
ap.lijit.com/rtb/ Frame 3E46 24 B
371 B 211ms
60ms Fetch
application/json 54.146.199.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_8.33.0
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.146.199.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-199-125.compute-1.amazonaws.com
Software: /
Resource Hash: 53b06c8300e3ec742582fb35464ccacbb89e7c760575be8a2f6ff2739666e6e9

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
vary: Accept-Encoding, User-Agent
access-control-allow-methods: GET, POST, DELETE, PUT
content-type: application/json
access-control-allow-origin: https://de.cosmetiks.net
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
content-length: 24

POST
H2 204 openrtb Show response
adx.adform.net/adx/ Frame 3E46 0
532 B 583ms
178ms Fetch 37.157.6.254
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H/1.1 200
OK / Show response
pub.admanmedia.com/ Frame 3E46 2 B
384 B 253ms
84ms Fetch
application/json 8.2.110.31
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://pub.admanmedia.com/?c=o&m=multi

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

8.2.110.31 , United States, ASN46636 (NATCOWEB, US),

Reverse DNS

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	DENY

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 12 Mar 2024 08:06:14 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx
X-Frame-Options: DENY
Content-Type: application/json
Access-Control-Allow-Origin: https://de.cosmetiks.net
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 22

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame 3E46 403 B
917 B 259ms
62ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=22328&site_id=324792&zone_id=1686040&size_id=15&alt_size_ids=2%2C10%2C43%2C67%2C117%2C198&p_pos=atf&gdpr=0&rp_schain=1.0,1!sunmedia.tv,3041f07a-a484-4265-9e48-8a1a9660a195,1,,,&eid_pubcid.org=075b8593-0307-4e1b-9113-c5955694bca8%5E1&rf=https%3A%2F%2Fde.cosmetiks.net%2F&tg_i.domain=de.cosmetiks.net&tg_i.page=https%3A%2F%2Fde.cosmetiks.net%2F&tg_i.pbadslot=adu1&tk_flint=pbjs_lite_v8.33.0&l_pb_bid_id=448a99958defce9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.14127308081013168
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 26a829b29e02228a5766ab803e883904eb68e9fd8cbf70469f89080ce0ad2038

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 403
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame 3E46 403 B
742 B 257ms
63ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=22328&site_id=324792&zone_id=1686042&size_id=15&alt_size_ids=2%2C10%2C43%2C67%2C117%2C198&p_pos=atf&gdpr=0&rp_schain=1.0,1!sunmedia.tv,3041f07a-a484-4265-9e48-8a1a9660a195,1,,,&eid_pubcid.org=075b8593-0307-4e1b-9113-c5955694bca8%5E1&rf=https%3A%2F%2Fde.cosmetiks.net%2F&tg_i.domain=de.cosmetiks.net&tg_i.page=https%3A%2F%2Fde.cosmetiks.net%2F&tg_i.pbadslot=adu2&tk_flint=pbjs_lite_v8.33.0&l_pb_bid_id=45628b1c9d1e736&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.20845786155091361
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b0ea83a508ea8eeb89fe75e086fa37e9eb930ec85e6e555f4d6f17c458b999ba

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:14 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 403
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK / Show response
pub.admanmedia.com/ Frame 3E46 2 B
384 B 249ms
91ms Fetch
application/json 8.2.110.31
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://pub.admanmedia.com/?c=o&m=multi

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

8.2.110.31 , United States, ASN46636 (NATCOWEB, US),

Reverse DNS

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	DENY

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 12 Mar 2024 08:06:14 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx
X-Frame-Options: DENY
Content-Type: application/json
Access-Control-Allow-Origin: https://de.cosmetiks.net
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 22

POST
H2 200 bid Show response
ap.lijit.com/rtb/ Frame 3E46 24 B
369 B 196ms
62ms Fetch
application/json 54.146.199.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_8.33.0
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.146.199.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-199-125.compute-1.amazonaws.com
Software: /
Resource Hash: ca7c3c7e9e28652ed01836ba68edd7fc75d3af643ebebfdcb87d0abb25bda2ca

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
vary: Accept-Encoding, User-Agent
access-control-allow-methods: GET, POST, DELETE, PUT
content-type: application/json
access-control-allow-origin: https://de.cosmetiks.net
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
content-length: 24

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ Frame 3E46 564 B
665 B 292ms
125ms Fetch
application/json 34.235.214.237
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.235.214.237 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-214-237.compute-1.amazonaws.com
Software: /
Resource Hash: b9daac67fce47a8a9a97a52b5b57580a20d00a8a700276198463ae054cc93e47

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
content-encoding: gzip
x-openrtb-version: 2.5
content-type: application/json; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 363

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame D4BA 120 KB
41 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:18:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35273
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Mar 2024 22:18:21 GMT

GET
H2

200

tag Show response
pandg.tapad.com/ Frame 5F8A
Redirect Chain

https://feed.pghub.io/tag?gdpr=0&gdpr_consent=1&referrer_url=&page_url=https%3A%2F%2Fde.cosmetiks.net%2F&owner=P%26G&bp_id=sunmedia&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22b...
https://pandg.tapad.com/tag?gdpr=0&gdpr_consent=1&referrer_url=&page_url=https%3A%2F%2Fde.cosmetiks.net%2F&owner=P%26G&bp_id=sunmedia&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%2...

593 B
1 KB

145ms
56ms

Document
text/html

34.102.243.38
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://pandg.tapad.com/tag?gdpr=0&gdpr_consent=1&referrer_url=&page_url=https%3A%2F%2Fde.cosmetiks.net%2F&owner=P%26G&bp_id=sunmedia&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js&data=%7B%22category%22%3A%22Hobbies%20and%20Interests%22%7D

Requested by

Host: pghub.io
URL: https://pghub.io/js/pandg-sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.243.38 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

38.243.102.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

316fab573868330908ac6cd479ab8e9e89f9ff2a0b24d93c697a6548b1757047

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';img-src https://*.tapad.com https://match.adsrvr.org
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-WoW64
access-control-allow-origin: *
access-control-max-age: 300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-store
content-security-policy: default-src 'none';img-src https://*.tapad.com https://match.adsrvr.org
content-type: text/html;charset=utf-8
date: Tue, 12 Mar 2024 08:06:14 GMT
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
server: Jetty(11.0.13)
strict-transport-security: max-age=31536000
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-store
content-length: 0
date: Tue, 12 Mar 2024 08:06:14 GMT
location: https://pandg.tapad.com/tag?gdpr=0&gdpr_consent=1&referrer_url=&page_url=https%3A%2F%2Fde.cosmetiks.net%2F&owner=P%26G&bp_id=sunmedia&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js&data=%7B%22category%22%3A%22Hobbies%20and%20Interests%22%7D
server: Jetty(11.0.13)
strict-transport-security: max-age=31536000
via: 1.1 google

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7561
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

90ms
87ms

Document
text/html

2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:14 GMT
expires: Tue, 12 Mar 2024 08:06:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:14 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 67D8
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

88ms
84ms

Document
text/html

2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:14 GMT
expires: Tue, 12 Mar 2024 08:06:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:14 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 4285
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CsvhN8wzwZczwO63BoPMPmeKxoATu0KaydPqG6YamEmQQASDzqvoBYMmGgIDco8QQoAH309ynAsgBAqgDAcgDyQSqBNABT9ARqQwKMAG7NYqZCRCKZIvRHqqfeC74aVC7BdyTTndyB5tQBt1...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x22a2c88a0b413b610000000000000000%22,%222%22:%220xa6ffda0892b8c5c60000000000000000%22,%223%22:%220x2f6325...

0
0

125ms
121ms

Fetch
text/css

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x22a2c88a0b413b610000000000000000%22,%222%22:%220xa6ffda0892b8c5c60000000000000000%22,%223%22:%220x2f63259cad38d5150000000000000000%22,%224%22:%220x46cba02cd8dd525f0000000000000000%22,%225%22:%220x97d872359015520c0000000000000000%22},%22debug_key%22:%229165440657814087235%22,%22debug_reporting%22:true,%22destination%22:%22https://userway.org%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22620177911%22],%2222%22:[%22true%22],%224%22:[%2203-12%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2217430846490799810017%22}&andc=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:14 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x22a2c88a0b413b610000000000000000","2":"0xa6ffda0892b8c5c60000000000000000","3":"0x2f63259cad38d5150000000000000000","4":"0x46cba02cd8dd525f0000000000000000","5":"0x97d872359015520c0000000000000000"},"debug_key":"9165440657814087235","debug_reporting":true,"destination":"https://userway.org","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["620177911"],"22":["true"],"4":["03-12"],"6":["true"]},"priority":"500","source_event_id":"17430846490799810017"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 12 Mar 2024 08:06:14 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 12 Mar 2024 08:06:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x22a2c88a0b413b610000000000000000","2":"0xa6ffda0892b8c5c60000000000000000","3":"0x2f63259cad38d5150000000000000000","4":"0x46cba02cd8dd525f0000000000000000","5":"0x97d872359015520c0000000000000000"},"debug_key":"9165440657814087235","debug_reporting":true,"destination":"https://userway.org","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["620177911"],"22":["true"],"4":["03-12"],"6":["true"]},"priority":"500","source_event_id":"17430846490799810017"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

/ Show response
sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/ Frame 87D4
Redirect Chain

https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384
https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1

2 KB
1 KB

163ms
161ms

Document
text/html

162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/DF2886F390D432DF0C8E98D69702ED6F/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 94dbeb70631677ea41dcc08f7fbe1fb8a4d5c1480196a70ebc87a97f45393e7d

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:05:46 GMT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server: nginx/1.14.1
x-powered-by: PHP/8.2.4

Redirect headers

content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:05:46 GMT
location: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server: nginx/1.14.1
x-powered-by: PHP/8.2.4

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 124ms
123ms Preflight
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:14 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 preload.jpg
s0.2mdn.net/sadbundle/15717895156372064762/ Frame D4BA 3 KB
3 KB 65ms
65ms Image
image/jpeg 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15717895156372064762/preload.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11c19322da0d5ba717f281542aad3d364fde06fd9b0df43c068510951fd0db07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Thu, 06 Mar 2025 09:04:42 GMT
date: Wed, 06 Mar 2024 09:04:42 GMT
x-content-type-options: nosniff
age: 514892
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3555
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:09:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2

200

receive
pixel.tapad.com/idsync/ex/ Frame 5F8A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=aad7f838-49fe-454a-b9db-bd86dea9f137%252C%252C%25257B%252522architecture%252522%25253A%252522%252522%25252C%252522bitness...
https://match.adsrvr.org/track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=aad7f838-49fe-454a-b9db-bd86dea9f137%252C%252C%25257B%252522architecture%252522%25253A%252522%252522%25252C%252522bitness...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=50b14d87-5347-4d9e-be83-599baad62bba&ttd_puid=aad7f838-49fe-454a-b9db-bd86dea9f137%2C%2C%257B%2522architecture%2522%253A%...

95 B
766 B

148ms
56ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=50b14d87-5347-4d9e-be83-599baad62bba&ttd_puid=aad7f838-49fe-454a-b9db-bd86dea9f137%2C%2C%257B%2522architecture%2522%253A%2522%2522%252C%2522bitness%2522%253A%2522%2522%252C%2522brands%2522%253A%255B%255D%252C%2522fullVersionList%2522%253A%255B%255D%252C%2522mobile%2522%253Afalse%252C%2522model%2522%253A%2522%2522%252C%2522platform%2522%253A%2522%2522%252C%2522platformVersion%2522%253A%2522%2522%257D

Requested by

Host: pandg.tapad.com
URL: https://pandg.tapad.com/tag?gdpr=0&gdpr_consent=1&referrer_url=&page_url=https%3A%2F%2Fde.cosmetiks.net%2F&owner=P%26G&bp_id=sunmedia&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js&data=%7B%22category%22%3A%22Hobbies%20and%20Interests%22%7D

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pandg.tapad.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=50b14d87-5347-4d9e-be83-599baad62bba&ttd_puid=aad7f838-49fe-454a-b9db-bd86dea9f137%2C%2C%257B%2522architecture%2522%253A%2522%2522%252C%2522bitness%2522%253A%2522%2522%252C%2522brands%2522%253A%255B%255D%252C%2522fullVersionList%2522%253A%255B%255D%252C%2522mobile%2522%253Afalse%252C%2522model%2522%253A%2522%2522%252C%2522platform%2522%253A%2522%2522%252C%2522platformVersion%2522%253A%2522%2522%257D
date: Tue, 12 Mar 2024 08:06:15 GMT
server: Kestrel
content-length: 987

GET
H3 200 KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js Show response
pagead2.googlesyndication.com/bg/ Frame E566 51 KB
20 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

296014911d97ff7dfdea28ae20e549275b38bfdfc10971dff75d7afff300188c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20259
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:29:57 GMT

GET
H3 200 KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js Show response
pagead2.googlesyndication.com/bg/ Frame 200B 51 KB
20 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240306/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

296014911d97ff7dfdea28ae20e549275b38bfdfc10971dff75d7afff300188c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20259
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:29:57 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A76E 0
0 127ms
125ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsspg3mrcVBBq4SsHRDyYTU29K1ahHQRmO9YXjhvjyF3aAENr82h_7wK5Ck3QPn2nlAAt4YJCzHI1Y0ljRTgJSH6z3BQOqTtSmNqDvbx-CsGO-7oh34Irtc-vcJuhgqv7WkgXz1YizeunxnbkDOeQr-KUwnSMUIe8_yKuLWCdLRr9qqCJohMUrl1acdWeKn72ByGcrLyxUj2IiLV-axZcIJPVMYBvzPgIUCD4iJflcIfz4DpsqPmdmJvpR9DC18-oFvkvMFjGICarerUKojM1hCeat_Cflh-MvwOXYhG6NNqKjU7QhrRPkpWfQMDGtFIuS_irxs8hj0ZCmj2C7kWxTXxviSDTx29FDDSv49caD5EQlI1uzjaXYLrsgqbEQI8As-Mtdei4CH9hO-Wp98ltN1tOnWaS7I55csQeaq6mNXmKsz-tzcL1k6UcCYAntaaENLxQdom2cy-DNgcEUZj3vGFR6pvzIgAvVWEI9OhKm12fCQQFc-W-0x33mkaDtXp3lptjeHhSvaZbBscEg1Txo5P76g51i3-awLvwyfHAcjZSvfivxTbO6p6Z5C6ZYoogsQrf31rmPZDR5h2vx06eM45Gzu-0ZNQwdJK0Inh_lERjPHlcyogmYyqsoGi4iJGxkW4kkxkGudRAHdtYihaP3uq8Z4X8-FxVUIXhaZppa5hPwDuMwjot0M157uEdqNNWiYS1vrLhIq2Kjo5Rbf4a0rCZaXFN7kjLmTvYW7Djx6LmsQCSFQAYXjWviPNR2l5aeCd3z1IA9_u_kysuhEDkwOLpNcztcnhJDVVLqGHLN4P4n4RIof0MpFKfHYG7PCtFCh-jRmfNVr8I3wcTcIjx_wqeOXRZTt8AAbLnWJcZSV_bBVmYDtTiWCljc6qBw2Kra_O_hse-OVRRqWcMFn7d-8WqbkeajMMquyOvUVr_dDBOYdVISm9d-snfjeRdepkArHE8g-OEX5kYTT7a8BYmVJdMWP_WtaPx1ADAZ91eLrRLzEOdQaApP30DDY-HkSgS5WejNsceW74VpVtp6jNTkDeW-BPK3HCyblCkAObhFPidTo5omuI_w7my00a5XJuC861sVQ-yt4Rda15IxZF3drov0YcMkZz7VCOAZiSaQ3YkdEe848g5Z-maGa3D8ZgEEJtxbNGzpw6DDx_dVOMqtj0aeB3L4Qig41FivdTQxlHaLzBsv5P6-YZyHJr_8VzpN6XILwrqy_pucylbNIgYOuArzgNAKcXrU8T5ueam3-i5IRfGPOkaC27f-LGwBmPKmGVy5sSI9sTdmPUQqkaJAwImrhlEeFB4EZkYuBt_OuPlvrjNiOIoCE34USFJbznMp_v-hWqU8OAP36RhC_kwj21bDhQ-T-KmiSQ7NtLpLR9NoHuIfmjr-VqVB8yvJsrCK4RCc8M21ej9gdJnmCIGRkXQA&sai=AMfl-YTiHQRGd4v00e4wq5Jnc_CkthPBgJ3b5obO-K2LsgWZuMFDgSjjcLWV9Evb2aQkTclwqTJPxGM4mu_6DLPnhNCJ5gLw34jNqw1RIPet0qwfDtj46nXzIIDTrEKBPCyMcUdGxRIulfYI2TBAXEsDToFzqBnkf6VjJ_a04je_ReM0lLCrsDsGQi8pOw6MB8BPK-efWD7mACz5y_8IOZaMbdLXbQPAP3rR9COyxF4tzw9i3aSRwEMfXr4P6CMG4sWlV_hMztnPF3QK_ZwSQIAetp_PT4xhD7zrrO85gvdE-w&sig=Cg0ArKJSzCKv5_eG-G7SEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1833&vt=11&dtpt=1016&dett=3&cstd=800&cisv=r20240306.61185&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 12 Mar 2024 08:06:15 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D4BA 8 KB
6 KB 141ms
140ms XHR
application/json 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a5be9ce4aa420c2e820742ff2f415b141a99012d4f042380cc7433613f2c285

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5936
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A76E 42 B
64 B 127ms
126ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu98kvtWxXvbFg96yO6USS3LtXjI-VCRjaUtrxtCMK_EbBqrq_zzXx7-rcNEw6NATQ0wuu-ihsSKXnKE637iXSoWobqJNkLd_6ZNDrGnFyk9MpIp9lAPz40BlilGxRuT8GGROIUQiOgGLTl1hSuzxj5c6adiy_Fy94&sai=AMfl-YTywEmTADf0H5jrNiE-pJZNsPeKEYb8tupbtV7bNpTHxjg84Cji8degF_-4IY8NfNvuBpG3cqT1OayzrWybzx4OKHeElUlYhwdYFXJAZTGTk1HjoqE6zcz4pt1eEoCDxst4hQ2MOsLcmQ4vR58QBw&sig=Cg0ArKJSzOcOcJc5-hp3EAE&cid=CAQSTwB7FLtqnRd2d_zldCw7yy6OlGd8Gi3J3VAjFQKaxXqeutqhqeDPm2JdwpbvCfIITo9fgYzk2KATOKk_Wt78hlH3kSfvHTjRcGoW8DkKjJIYAQ&id=lidar2&mcvt=1029&p=0,259,40,300&mtos=1029,1029,1029,1029,1029&tos=1029,0,0,0,0&v=20240306&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3357627370&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=616357300&rst=1710230771980&rpt=1345&met=ie&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 58B2 18 KB
8 KB 232ms
63ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 07:24:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2504
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 12 Mar 2024 08:24:31 GMT

GET
H2

200

controller
ssl.connextra.com/servlet/ Frame 58B2
Redirect Chain

https://ssl.connextra.com/WynnResorts/selector/image?client=WynnResorts&placement=DDM_APN_TOU_US_ImpressionPixel_1x1&_cb=221984084&apnauc=6993879095038092100&bidid=6993879095038092100&dspid=3bc1d7fd2e
https://ssl.connextra.com/servlet/controller?service=DDM_TOU_US_ImpresionPixel_1x1&pubhost=de.cosmetiks.net&image=image%2Fgif&client=WynnResorts&placement=DDM_APN_TOU_US_ImpressionPixel_1x1&_cb=221...

128 B
275 B

68ms
66ms

Image
image/gif

23.0.197.94
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/servlet/controller?service=DDM_TOU_US_ImpresionPixel_1x1&pubhost=de.cosmetiks.net&image=image%2Fgif&client=WynnResorts&placement=DDM_APN_TOU_US_ImpressionPixel_1x1&_cb=221984084&apnauc=6993879095038092100&bidid=6993879095038092100&dspid=3bc1d7fd2e
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Server: 23.0.197.94 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-0-197-94.deploy.static.akamaitechnologies.com
Software: istio-envoy /
Resource Hash: db592f36d581483ef74106fdf01c54e34c5ad062505cbb679dc78eacf4b88765

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Tue, 12 Mar 2024 08:06:44 GMT
date: Tue, 12 Mar 2024 08:06:15 GMT
x-envoy-upstream-service-time: 9
x-served-by: adserver-green-6
server: istio-envoy
content-length: 128
content-type: image/gif

Redirect headers

x-served-by: adserver-green-3
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
server: istio-envoy
vary: *
p3p: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
location: https://ssl.connextra.com:443/servlet/controller?service=DDM_TOU_US_ImpresionPixel_1x1&pubhost=de.cosmetiks.net&image=image%2Fgif&client=WynnResorts&placement=DDM_APN_TOU_US_ImpressionPixel_1x1&_cb=221984084&apnauc=6993879095038092100&bidid=6993879095038092100&dspid=3bc1d7fd2e
cache-control: max-age=0, no-cache, no-store
x-envoy-upstream-service-time: 3
content-length: 0
expires: Tue, 12 Mar 2024 08:06:15 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/243/ Frame 58B2 80 KB
28 KB 130ms
33ms Script
application/x-javascript 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/243/trk.js
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 82da873956888d3a0a1db331a301c9b95de6937c0acf64c33a2c9fc711b7fb54

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Expires: Thu, 06 Mar 2025 13:25:27 GMT
Date: Tue, 12 Mar 2024 08:06:15 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 499247
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27680
X-Served-By: cache-lga21945-LGA, cache-mia-kmia1760040-MIA
Last-Modified: Wed, 06 Mar 2024 13:23:40 GMT
Server: AkamaiNetStorage
X-Timer: S1710230775.165662,VS0,VE0
ETag: "8ddbd8bafc2492a69e46a808a5e2a727:1709731420.917212"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 29, 390307

GET
H2 200 it
nym1-ib.adnxs.com/ Frame 58B2 0
968 B 74ms
68ms Image
text/html 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fde.cosmetiks.net%252F%252F%253E%253Clink+rel%253D&e=wqT_3QK_F_SsAr8LAAADANYABQEI9pnArwYQxMaarrX_z4dhGMW47OC-pZvKGyo2CT8rWj3h0O0_Ef6k3UwjV-E_GQAAAKCZmQtAIf1Ju7H09ec_KbYQ5KCEmfQ_MQAAAKBH4do_MOeR1Ag4rwlAmDlIAlCQlsfsAVi-235gAGi7_wR4w8wFgAEBigEDVVNEkgEDVVNEmAGsAqAB2ASoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDk3MDM3MjIsIDApO3VmKCdpJywgOTc0NjEwMywgMCk7dWYoJ2cnLCAyNDYwODczNiwgMCk7dWYoJ3MnLCAyOTUzNDk2ODQsIDApO3VmKCdyJywgNDk2MDkzOTY4LCAwKTuSApkPIWhYdUJCd2pvbjdzY0VKQ1d4LXdCR0FBZ3Z0dC1NQUU0QUVBQVNKZzVVT2VSMUFoWUFHRGxBbWdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQXFnQkFyQUJBTGtCRnpvclhJbVo5RF9CQVJjNksxeUptZlFfeVFFQUFBQUFBQUR3UDlrQkFBQUFBQUFBOERfZ0FiZnQwZ1QxQVFvZ1EwQ1lBZ0NnQWdLMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3R2lBdzRJdnFmVU5oQUVHQUV0WTNlaU9LSURFd2pjay1RMUVBb1lBUzFmRzZZX01nTjFibkdpQXc0SWc3bktOUkFMR0FJdEFBQUFBTG9EQ1U1WlRUSTZOVFU0T2VBRDgwV0FCUFhieHcySUJQbmJ4dzJRQkFHWUJBU3FCS1lIQ1BfX19fX19fX19fX3dFUV9fX19fX19fX19fX0FSal9fX19fX19fX19fOEJJUF9fX19fX18BFRR3RW9DREQBCg0BDDhCT1ANCwEBCHdGQQEHEQEIQVVqEQsUX19fOEJVNiwAAFkBFhEBBEFXNlgAAGE2LAAAdxEoAQEYQVhnQmdBSAELDQEIOEJpOhAAAGs6EAAgbUFHNjk1UUJvOhgAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQACAwQUhua2RRSTI6GAAANDoQAAA2OhAAADg6EAAcLUFIdUhvQUMN4QUBCEFZZzYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAEWUEuFQIhADYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAEGVBREFPOhQAAGY6NAAAZjogAAhZQUUl7Q0BCEFZZzYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAIWUFGDfsFAQhBWWc2EAAAWjogAABaOiAAKGJvRUdnanRDQkVBCQEQRFFQeGsJCwEBJENDb203QVJ3UVEBDgRBQQEgBDhrES0BEBRZQkFEeEIBCw0BXGlBWFZLNUFGc3J0NG1BVzAyLXFNQWFrRg0fFEE4RC14QhFPFEFBQXdRVQEHCQEATQkoHGdBa2Y3VF9SLigAADIVKPBDRHdQLUFGN08wSDhBWGdfOTBMLUFXcW90QUVnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkEd5ABCHc8EQmsJiAEBAEMdGHBMZ0dDdmdIbU5NSS1BZVMxQWo0QjZQWENQZ0hsZgUUREM5d2lCQ0twZTByS0ltZlFfaQHGSEFnQZoCmQEhcGhkUnZBam9uN3P5nVxMN2JmaUFBS0FBeDJfbC1hcngwN3o4NkMuoQYUVUR6UlVrAY8hbQh3UDEdlQBGERgMQUFBRxEYDERRUDIdGABIERgcQUFBSGdBaVEREPDtRHdQdy4u2AKeAuAC1_Re6gIlaHR0cHM6Ly9kZS5jb3NtZXRpa3MubmV0Ly8-PGxpbmsgcmVsPYADAIgDAZADAJgDF6ADAaoDAMAD2ATIAwDYA7r3lAHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQNMzguMTMyLjExOC43MqgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABPqksiLIBADSBA43MzIwI05ZTTI6NTU4OdoEAggB4AQB8ASQlsfsAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAEPuNgFAeAFAfAFzf1A-gUECAAQAJAGAJgGAKIGDjExOTkjTllNMjo1MjYzuAYAwQYAATMsAPA_0AapJdoGFgoQBRAdAWAQABgA4AYB8gaHAQiyu3gSgAFvQlNFY1ZvIWvYREFBa0NCUUVJLS1mV0N4Q0RfYkFDR0tYbHRBSWdCeWdBUU55UThRUkl6dXV4RFZEelJWaVBLWDGdKa0AZzWtBEFBATdAQUpBQkFKb0JBZ2dBcUFFQXMuIABQQS4ugAcBiAcAoAcByAfDzAXSBw0JCa8EM0ABrAjaBwYB9PB3GADgBwDqBwIIAPAHrIGHA4oIRwpDAAABjjGyoPBhDz_7VcajRP-0xTZr9mQfzxMkk5gFf-GRHFHSZaWA17umrfgu_Ux_ivXy4ZFafScuXHgGkL6KCO8MmRABlQgAAIA_mAgBwAieAtIIDgiBgoSIkKDAgAEQABgA&s=c8fe5c943cf3e3ab018b599875dafc453873e31b

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
an-x-request-uuid: 2fad6783-fa29-461f-ba2c-e667f5922704
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

beacon.js Show response
sb.scorecardresearch.com/internal-cs/default/
Redirect Chain

https://sb.scorecardresearch.com/cs/21892462/beacon.js
https://sb.scorecardresearch.com/internal-cs/default/beacon.js

4 KB
2 KB

63ms
62ms

Script
application/javascript

108.139.47.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-cs/default/beacon.js
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Server: 108.139.47.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-33.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 84e5aa85594b35c4b60787f4a97e2e1eb369dacbe23d8154f61f60bb0343d465

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 18:21:08 GMT
content-encoding: gzip
via: 1.1 f577ca8c3771798c088df2efc06d2bc4.cloudfront.net (CloudFront)
last-modified: Thu, 07 Dec 2023 12:02:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P1
age: 49507
x-amz-server-side-encryption: AES256
etag: W/"77ff4ede4693897337a38594321529a3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: mJ-DiuZqsP_80nqQIF5R7eMt-jB2NaGxclep7B5JnFKa7NDWw3Z82w==

Redirect headers

date: Tue, 12 Mar 2024 08:06:15 GMT
via: 1.1 f577ca8c3771798c088df2efc06d2bc4.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: JFK50-P1
x-cache: Miss from cloudfront
location: /internal-cs/default/beacon.js
content-length: 0
x-amz-cf-id: g5oq45udCXQ3L-n09QEN6mwwhbY2aREKCeoe8rrYihgHw0aJE74a0Q==

GET
H2 200 /
t.richaudience.com/ex/Tm9Da25HSHpuZmJod1d0VkQ5eTU4ek9xakJTR25VMGdrQjhyb3d0Q1Nva2EwUXNBU0dBbCt1QkJkS25lY1hMemY1RW9UNXlDSmkxV2tibSsrWlJvMjhDN3Q4UTA1aWdUWWIwOW9PSjlZT1A0SVNiSFg4SWJTVHJ6M3Y0MHZnZVloaTZ... 43 B
224 B 547ms
175ms Image
image/gif 65.108.231.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.richaudience.com/ex/Tm9Da25HSHpuZmJod1d0VkQ5eTU4ek9xakJTR25VMGdrQjhyb3d0Q1Nva2EwUXNBU0dBbCt1QkJkS25lY1hMemY1RW9UNXlDSmkxV2tibSsrWlJvMjhDN3Q4UTA1aWdUWWIwOW9PSjlZT1A0SVNiSFg4SWJTVHJ6M3Y0MHZnZVloaTZMMHYzK0VsZWF5SmhBS21MMEhtTEhkRERZSHh3NFl4dWczZVJCV21LR2xXNlJsNkFsWW56Qm9RRmFQc3JQRzRabXBxRXQzcEhKSkg3MXVTaDBkMGswUjE5RDJHQ2Q4U1VMR0FzZ1d0UDdBVnFrdmthZE1sRmVpV1NpTEZxNG8zanNTVit4NjRkdWQyUUQxR3R5b3QwR0dvYnMvb0xDMnRXUEZvVVBuaXMyNnpsS25UdWhMb3cvYnU5cVdybGg5MnBrUTNJMzkxeVl4OWdublFnUVhwQjlib1dqck4zcHJzZjc3bVVncWhLNTRtK0Vnb0ZMdEZHOTVKTFN2Y1U5THF0Mk9ialNLbzljaFF5RUtJU1Y0S0Myc0RpUldtUnVUMi84bkFUSXMzK0xqc2J3ZmV2NHlHdEM5Y3lteGdEL0k1TjFEU29EbnZVODJOc2Ftc3ZIdVFHT25nTmpLUmNhUDdSN2RPYnhvTzBVS25Sa0xXcXVJK21wd3VERzVIZis1RHYxYWJHb1hIQ3JmWUl1VHR6ZnUzZ2RDaU1mTWNXK29jdTZHdisvQWUzRUxHRGJjNXFSeGFKWHVUWERiZzVqYVBBc0V1OUdaZkFib1Z1VUlnY1I4MzM5UGZqVjZndS9tL0ZWcStYcmVIVTB6MTFzdFQxdHBSc01wMHBrTmVwQWhzM3F0d1hMUFdualMxS1FjVEFNS2RDSC9wbVRQYWV5cW9DNlRwUmVwMi9ES1RuUnd4QmwxRmgzbHhGMlpNYjFEUVJQUm9yQUhrYUk2bHQzR0lWNmI2Nkc4RGNVSE40YXFnUzJiMVZGamw4aUNCaGszMktSdFAvYjk3aUc3djlZdXVpeEZuTnBpNnBRZHZ2b2lVVjY1WTJVOElFTE8rQ1o3ZnNsVGJEZjBEWlFwK3k5bHRYeTUwQUcvWWFZQnRNNzU1ZnhlZTRzQ00zREdyUDlwZUlmZzdRTjBpMXVpbVlOSEZqUEpnY0pjQjkzeEViT1NyalRYSFU1OC9rbWZveTVGMDc0WGZYVHYyLzJKV29Ib2xDQjExNmViUnNTMFkvSENRS3JBcFVGUC8xSHY0eU9aSURvR0k0MDFqZz0%3D/1/?e=20&subtype=3&dem_int=1&dt=3&tc=1&bidder_name=[BIDDER_NAME]&advd=&did=&auid=1cae5c42-6dfc-4f7b-bfb8-ffd73f599a64&gdpr=0&gdpr_consent=&rev=0.541887&curr=USD&errcode=&crid=&rnd=1710230775045
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.108.231.149 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.231.108.65.clients.your-server.de
Software: nginx/1.14.1 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 12 Mar 2024 08:06:15 GMT
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
last-modified: Tuesday, 12-Mar-2024 08:06:15 GMT
server: nginx/1.14.1
content-type: image/gif

GET
H/1.1 200
OK /
track.sunmedia.tv/ 42 B
404 B 84ms
83ms Image
image/gif 212.102.45.225
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.sunmedia.tv/?ap=smptf&it=e6c4e2fe-6602-44a2-bf06-bd9aca1f3fc6&tp=imp&pos=0&loop=1&pb=1&pbt=d&pbid=dvd0&rnd=1710230775055
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.45.225 Denver, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: unn-212-102-45-225.cdn77.com
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:15 GMT
TP-Cache: HIT
Last-Modified: Thu, 15 Nov 2018 09:59:07 GMT
Server: nginx
Age: 31784
Vary: Accept-Encoding
Content-Type: image/gif
Cache-control: max-age=0, s-maxage=31536000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
X-Device: desktop

GET
H2

200

p2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=21892462&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=908167518&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct...
https://sb.scorecardresearch.com/p2?c1=2&c2=21892462&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=908167518&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_c...

43 B
300 B

76ms
75ms

Image
image/gif

108.139.47.33
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=21892462&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=908167518&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=1000000001&c4=*null&c6=*null&ns_ts=5050754&gdpr=0&gdpr_consent=1
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Server: 108.139.47.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-33.jfk50.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
via: 1.1 f577ca8c3771798c088df2efc06d2bc4.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: JFK50-P1
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: LSyJ5cuZGDKUK8XEeNr4d-WHFs3WY1vqPOw2m3Gx31HgD8oEdjdKgA==

Redirect headers

date: Tue, 12 Mar 2024 08:06:15 GMT
via: 1.1 f577ca8c3771798c088df2efc06d2bc4.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: JFK50-P1
x-cache: Miss from cloudfront
location: /p2?c1=2&c2=21892462&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=908167518&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=1000000001&c4=*null&c6=*null&ns_ts=5050754&gdpr=0&gdpr_consent=1
content-length: 0
x-amz-cf-id: 07ADwmVuI-fC_lp8Qz4pTDlauSrJKnxrD16opIdRUzwsqBnQK7eFAw==

GET
H2 200 /
t.richaudience.com/ex/Tm9Da25HSHpuZmJod1d0VkQ5eTU4ek9xakJTR25VMGdrQjhyb3d0Q1Nva2EwUXNBU0dBbCt1QkJkS25lY1hMemY1RW9UNXlDSmkxV2tibSsrWlJvMjhDN3Q4UTA1aWdUWWIwOW9PSjlZT1A0SVNiSFg4SWJTVHJ6M3Y0MHZnZVloaTZ... 43 B
225 B 542ms
173ms Image
image/gif 65.108.231.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.richaudience.com/ex/Tm9Da25HSHpuZmJod1d0VkQ5eTU4ek9xakJTR25VMGdrQjhyb3d0Q1Nva2EwUXNBU0dBbCt1QkJkS25lY1hMemY1RW9UNXlDSmkxV2tibSsrWlJvMjhDN3Q4UTA1aWdUWWIwOW9PSjlZT1A0SVNiSFg4SWJTVHJ6M3Y0MHZnZVloaTZMMHYzK0VsZWF5SmhBS21MMEhtTEhkRERZSHh3NFl4dWczZVJCV21LR2xXNlJsNkFsWW56Qm9RRmFQc3JQRzRabXBxRXQzcEhKSkg3MXVTaDBkMGswUjE5RDJHQ2Q4U1VMR0FzZ1d0UDdBVnFrdmthZE1sRmVpV1NpTEZxNG8zanNTVit4NjRkdWQyUUQxR3R5b3QwR0dvYnMvb0xDMnRXUEZvVVBuaXMyNnpsS25UdWhMb3cvYnU5cVdybGg5MnBrUTNJMzkxeVl4OWdublFnUVhwQjlib1dqck4zcHJzZjc3bVVncWhLNTRtK0Vnb0ZMdEZHOTVKTFN2Y1U5THF0Mk9ialNLbzljaFF5RUtJU1Y0S0Myc0RpUldtUnVUMi84bkFUSXMzK0xqc2J3ZmV2NHlHdEM5Y3lteGdEL0k1TjFEU29EbnZVODJOc2Ftc3ZIdVFHT25nTmpLUmNhUDdSN2RPYnhvTzBVS25Sa0xXcXVJK21wd3VERzVIZis1RHYxYWJHb1hIQ3JmWUl1VHR6ZnUzZ2RDaU1mTWNXK29jdTZHdisvQWUzRUxHRGJjNXFSeGFKWHVUWERiZzVqYVBBc0V1OUdaZkFib1Z1VUlnY1I4MzM5UGZqVjZndS9tL0ZWcStYcmVIVTB6MTFzdFQxdHBSc01wMHBrTmVwQWhzM3F0d1hMUFdualMxS1FjVEFNS2RDSC9wbVRQYWV5cW9DNlRwUmVwMi9ES1RuUnd4QmwxRmgzbHhGMlpNYjFEUVJQUm9yQUhrYUk2bHQzR0lWNmI2Nkc4RGNVSE40YXFnUzJiMVZGamw4aUNCaGszMktSdFAvYjk3aUc3djlZdXVpeEZuTnBpNnBRZHZ2b2lVVjY1WTJVOElFTE8rQ1o3ZnNsVGJEZjBEWlFwK3k5bHRYeTUwQUcvWWFZQnRNNzU1ZnhlZTRzQ00zREdyUDlwZUlmZzdRTjBpMXVpbVlOSEZqUEpnY0pjQjkzeEViT1NyalRYSFU1OC9rbWZveTVGMDc0WGZYVHYyLzJKV29Ib2xDQjExNmViUnNTMFkvSENRS3JBcFVGUC8xSHY0eU9aSURvR0k0MDFqZz0%3D/1/?e=1&subtype=3&dem_int=1&dt=3&tc=1&bidder_name=[BIDDER_NAME]&advd=&did=&auid=1cae5c42-6dfc-4f7b-bfb8-ffd73f599a64&gdpr=0&gdpr_consent=&rev=0.541887&curr=USD&errcode=&crid=&rnd=1710230775058
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.108.231.149 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.231.108.65.clients.your-server.de
Software: nginx/1.14.1 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 12 Mar 2024 08:06:15 GMT
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
last-modified: Tuesday, 12-Mar-2024 08:06:15 GMT
server: nginx/1.14.1
content-type: image/gif

GET
H3 200 replay.png
s0.2mdn.net/sadbundle/15717895156372064762/ Frame D4BA 517 B
545 B 74ms
72ms Image
image/png 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15717895156372064762/replay.png

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

182fc11158c66dbbd0432664c2967f118f3a5e57b7e5fb28822376e8dbe365db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:10:50 GMT
date: Fri, 08 Mar 2024 22:10:50 GMT
x-content-type-options: nosniff
age: 294925
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 517
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:09:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 poster.jpg
s0.2mdn.net/sadbundle/15717895156372064762/ Frame D4BA 70 KB
70 KB 67ms
65ms Image
image/jpeg 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15717895156372064762/poster.jpg

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08476c61d0405d65c3ef5290c505d96f97b85febb966650ca20e7c508a8522cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:21:29 GMT
date: Fri, 08 Mar 2024 22:21:29 GMT
x-content-type-options: nosniff
age: 294286
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72152
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:09:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H/1.1

206
Partial Content

3
r3---sn-vgqsrnzd.c.2mdn.net/videoplayback/id/3f2b5e9cda4ae3cb/itag/18/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1741766772/sparams/acao,ctier,expire,id,i... Frame D4BA
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/3f2b5e9cda4ae3cb/itag/18/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1741766772/sparams/ip,ipbits,expire,id,itag,sou...
https://r5---sn-q4fl6n6d.c.2mdn.net/videoplayback/id/3f2b5e9cda4ae3cb/itag/18/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1741766772/sparams/acao,ctier,exp...
https://r3---sn-vgqsrnzd.c.2mdn.net/videoplayback/id/3f2b5e9cda4ae3cb/itag/18/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1741766772/sparams/acao,ctier,exp...

414 KB
414 KB

247ms
68ms

Media
video/mp4

2607:f8b0:4009:24::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-vgqsrnzd.c.2mdn.net/videoplayback/id/3f2b5e9cda4ae3cb/itag/18/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1741766772/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source,xpc/signature/7CA395EACA7ED3170BF933501AD5BBEF331DB791.41042CD6C7373CA8CB274FC19E17E9C7AFBE0122/key/cms1/mh/Qo/pl/48/redirect_counter/1/rm/sn-q4fez67e/req_id/8c977f148ef636e2/cms_redirect/yes/mip/2001:550:1d05:1::9/mm/39/mn/sn-vgqsrnzd/ms/ltr/mt/1710230418/mv/m/mvi/3?file=file.mp4

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

HTTP/1.1

Server

2607:f8b0:4009:24::8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

a527246b3db7507b7ccb83033898f9814700592dcd80eb6da997c04e53082c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:15 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 14 Feb 2024 22:09:21 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-423806/423807
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 423807
Expires: Tue, 12 Mar 2024 08:06:15 GMT

Redirect headers

Date: Tue, 12 Mar 2024 08:06:15 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 02 May 2007 10:26:10 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: text/html
Location: https://r3---sn-vgqsrnzd.c.2mdn.net/videoplayback/id/3f2b5e9cda4ae3cb/itag/18/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1741766772/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source,xpc/signature/7CA395EACA7ED3170BF933501AD5BBEF331DB791.41042CD6C7373CA8CB274FC19E17E9C7AFBE0122/key/cms1/mh/Qo/pl/48/redirect_counter/1/rm/sn-q4fez67e/req_id/8c977f148ef636e2/cms_redirect/yes/mip/2001:550:1d05:1::9/mm/39/mn/sn-vgqsrnzd/ms/ltr/mt/1710230418/mv/m/mvi/3?file=file.mp4
Cache-Control: private, max-age=900
Connection: close
Content-Length: 0
Expires: Tue, 12 Mar 2024 08:06:15 GMT

GET
H2 200 / Show response
track.adform.net/Serving/Cookie/ Frame 87D4 73 B
617 B 224ms
149ms Script
text/javascript 37.157.6.254
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/Serving/Cookie/?adfaction=getjs;adfcookname=uid

Requested by

Host: sync.richaudience.com
URL: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

5d9e8cfd13ab9f3cb184ee716c93c4c007837b001ab17f762269a64b2d8958cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 180
expires: -1

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame D77F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=publicidad&gdpr=0&gdpr_consent=
https://eus.rubiconproject.com/usync.html?p=publicidad&gdpr=0&gdpr_consent=

281 B
554 B

248ms
68ms

Document
text/html

23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=publicidad&gdpr=0&gdpr_consent=
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://sync.richaudience.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 12 Mar 2024 08:06:15 GMT
ETag: "20524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 12 Mar 2024 08:06:15 GMT
location: https://eus.rubiconproject.com/usync.html?p=publicidad&gdpr=0&gdpr_consent=
server: AkamaiGHost

GET
H2

200

/
sync.richaudience.com/a566db6afba33978322ef47fa16ca6fe/ Frame 87D4
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.richaudience.com%2Fa566db6afba33978322ef47fa16ca6fe%2F%3Fgdpr%3D0%26euconsent%3D%26uid%3D$UID
https://sync.richaudience.com/a566db6afba33978322ef47fa16ca6fe/?gdpr=0&euconsent=&uid=ITrmABZHnRSn9U8bRSmi6w7L

95 B
372 B

173ms
170ms

Image
image/png

162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/a566db6afba33978322ef47fa16ca6fe/?gdpr=0&euconsent=&uid=ITrmABZHnRSn9U8bRSmi6w7L
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1
Protocol: H2
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/png
date: Tue, 12 Mar 2024 08:05:47 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Redirect headers

location: https://sync.richaudience.com/a566db6afba33978322ef47fa16ca6fe/?gdpr=0&euconsent=&uid=ITrmABZHnRSn9U8bRSmi6w7L
access-control-allow-origin: *
date: Tue, 12 Mar 2024 08:06:15 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
content-length: 0
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H2

200

/
sync.richaudience.com/a16582f729b43087fa6353b148f7ea54/ Frame 87D4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=id0lh84&ttd_tpi=1&gdpr=0&gdpr_consent=
https://sync.richaudience.com/a16582f729b43087fa6353b148f7ea54/?uid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&euconsent=&domain=sync.richaudience.com

95 B
379 B

174ms
172ms

Image
image/png

162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/a16582f729b43087fa6353b148f7ea54/?uid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&euconsent=&domain=sync.richaudience.com
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1
Protocol: H2
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/png
date: Tue, 12 Mar 2024 08:05:47 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Redirect headers

location: https://sync.richaudience.com/a16582f729b43087fa6353b148f7ea54/?uid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&euconsent=&domain=sync.richaudience.com
date: Tue, 12 Mar 2024 08:06:15 GMT
server: Kestrel
content-length: 333

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D4BA 17 KB
6 KB 96ms
95ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Mar 2024 08:06:15 GMT

GET
DATA 200
OK truncated
/ Frame D4BA 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 replay.png
s0.2mdn.net/sadbundle/15717895156372064762/ Frame D4BA 517 B
545 B 71ms
70ms Image
image/png 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15717895156372064762/replay.png

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

182fc11158c66dbbd0432664c2967f118f3a5e57b7e5fb28822376e8dbe365db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:10:50 GMT
date: Fri, 08 Mar 2024 22:10:50 GMT
x-content-type-options: nosniff
age: 294925
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 517
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:09:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 prod_studio_01_250_videomodule.js Show response
s0.2mdn.net/879366/ Frame D4BA 13 KB
5 KB 67ms
65ms Script
text/javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_250_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03656ff565d2cc90c3b8f2c1963c5804304e5d9dc796e920db21a6db906a942d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15717895156372064762/index.html?e=69&leftOffset=0&topOffset=0&c=raNxB6MgXm&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:17:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35343
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4955
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:43 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Mar 2024 22:17:12 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4285 42 B
64 B 129ms
128ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuLdZQIujFIePxYGT3GyyuOtCzUf5hGNLjLelzJP4YTm7ZDRgQTKYoosPzmfNanba870h3baxUQMjklxEvDxcy8YOpoTXLjxIhxmQNJrRm9KU--IkncNIhiw-br6M68TSiBLlIXwBhEBB42mLwh5wvPRT_2da8BmeV-2nOAad1PBo-2oYq-RuhDvSZAwNQ&sai=AMfl-YRWnmydJYGGjeVGqmFzF1Zjaa55aACMSIYuh2LOKHvYmGPrkR4fgoBkeuDR5eRlnvBpfmwr7f1fZsHx_GAPIoIC6j_f7N-j075GyVFHc7EUo8cut8UDkVBqMCrGItiwBZMtb41-e0Ww5ATTZkTa&sig=Cg0ArKJSzFc3SLFDuj7gEAE&cid=CAQSTgB7FLtqgHDw8Ikg3J451Bk_dYLB6Jr98bQpRA77WceTOsL9Q4Vb3OcITWDYgtM9NwVqpi9b3nxIPZYJl0zBYGPDadK656tCIaTPYDp3ohgB&id=lidar2&mcvt=1077&p=0,0,124,1005&mtos=770,1077,1077,1077,1077&tos=770,307,0,0,0&v=20240306&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=616357400&rst=1710230773272&rpt=966&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 58B2 59 KB
23 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 294332
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:20:43 GMT

GET
H3 200 O8T1Km08OhS5_Tz58jKeajrFynp-IyfJlJwKv1268Sc.js Show response
pagead2.googlesyndication.com/bg/ Frame 2A99 39 KB
15 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O8T1Km08OhS5_Tz58jKeajrFynp-IyfJlJwKv1268Sc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3bc4f52a6d3c3a14b9fd3cf9f2329e6a3ac5ca7a7e2327c9949c0abf5dbaf127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 20:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41473
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15541
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Mar 2025 20:35:02 GMT

GET
H2 204 b
sb.scorecardresearch.com/ 0
320 B 71ms
70ms Image
text/plain 108.139.47.33
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=8&c2=21892462&cs_it=b8&cv=4.0.0%2B2301240627&ns__t=1710230775431&ns_c=UTF-8&c3=1001000630&cs_cmp_nc=1&cs_fpcd=1&c7=https%3A%2F%2Fde.cosmetiks.net%2F&c8=-%20Besondere%20Neuigkeiten&c9=
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-33.jfk50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
via: 1.1 f577ca8c3771798c088df2efc06d2bc4.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: JFK50-P1
x-amz-cf-id: F54vmbURdvuRmPM5JgkAtAjYkKjS-UlGfx5ZKI1B-LKDDcDnzlPl3A==
x-cache: Miss from cloudfront

GET
H2 200 /
sync.richaudience.com/502e2341fac2c140295d7b3b0c915c8c/ Frame 87D4 95 B
352 B 170ms
162ms Image
image/png 162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/502e2341fac2c140295d7b3b0c915c8c/?gdpr=0&gdpr_consent=&uid=
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.richaudience.com/b3adde1f4bbb31c3485562d6e3ddceb4/?rnd=31367384&rd=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/png
date: Tue, 12 Mar 2024 08:05:47 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2 200 B31484616.387374617;dc_ver=99.292;sz=300x600;u_sd=1;gdpr=0;dc_adk=732509351;ord=hr1ios;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKbAfCamwAAAAMAxBkFAQj2mcCvBhDExpqutf_Ph2EYxbjs4L6lm... Show response
ad.doubleclick.net/ddm/adi/N1305047.3448850XANDR/ Frame 09C2 67 KB
32 KB 270ms
107ms Document
text/html 142.250.81.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1305047.3448850XANDR/B31484616.387374617;dc_ver=99.292;sz=300x600;u_sd=1;gdpr=0;dc_adk=732509351;ord=hr1ios;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKbAfCamwAAAAMAxBkFAQj2mcCvBhDExpqutf_Ph2EYxbjs4L6lm8obIOeR1AgorwkwmDk4AkCQlsfsAUi-235QAFoDVVNEYgNVU0RorAJw2AR4u_8EgAHDzAWIAQGQAQGYAQWgAQKpAT8rWj3h0O0_sQH-pN1MI1fhP7kBAAAAoJmZC0DBAf1Ju7H09ec_yQG2EOSghJn0P9gBngLgAQA.%2Fs%3Dae9d020a8fe643743a78c400681dfa7db8f3f4e3%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521phdRvAjon7scEJCWx-wBGL7bfiAAKAAx2_l-arx07z86CU5ZTTI6NTU4OUDzRUkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAADQP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU1ODk%3D%2Fbn%3D91715%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fde.cosmetiks.net%2F$0;xdt=0;crlt=REnE0)iI-v;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=139;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f6.1e100.net

Software

cafe /

Resource Hash

de316412492439d2fb032e5f8c759d7546571bd29ae5cc2681f46e8c0fb11638

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 32238
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C9FD 52 KB
17 KB 119ms
35ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1199&pub_id=1644430
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 7390
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 12 Mar 2024 08:06:15 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 23 Feb 2024 06:02:30 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2822, 6440
X-Served-By: cache-lga13626-LGA, cache-mia-kmia1760037-MIA
X-Timer: S1710230776.603663,VS0,VE0

GET
H2 200 rd_log Show response
nym1-ib.adnxs.com/ Frame 58B2 0
968 B 157ms
155ms Script
text/html 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fde.cosmetiks.net%2F%2F%3E%3Clink+rel%3D&e=wqT_3QLLBKBLAgAAAwDWAAUBCPaZwK8GEKXp7ef_pNrrWxjFuOzgvqWbyhsqNgkAAAkCABEJBywAABkAAACgcD0MQCEREgApEQn0FwExAAAAQArX4z8w76DUCDivCUCvCUgAUABYvtt-YABou_8EeMPMBYABAYoBAJIBA1VTRJgBrAKgAfoBqAEBsAEAuAEAwAEAyAEA0AEA2AEA4AEA8AEA2AKeAuAC1_Re6gIlaHR0cHM6Ly9kZS5jb3NtZXRpa3MubmV0Ly8-PGxpbmsgcmVsPYADAIgDAZADAJgDF6ADAaoDAMAD2ATIAwDYA7r3lAHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQNMzguMTMyLjExOC43MqgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADaBAIIAOAEAPAEAIgFAZgFAKAFAMAFAMkFAAAAAAAA8D_SBQkJMSBo2AUB4AUA8AUA-gUECAAQAJAGAJgGALgGAMEGESMQ2gYWChARDREBdBAAGADgBgDyBgIIAIAHAYgHAKAHAMgHw8wF0gcNCS4mAAjaBwYBWfBuGADgBwDqBwIIAPAHrIGHA4oIRwpDAAABjjGyoPBb12kn_Pt0pZ45Z_JM1rBSvxEm1AWaSCcnuS8C0CH-av_WOKvpLYjNdAvlzOVmkyA87YfKAHorSJnyMhABlQgAAIA_mAgBwAgA0ggGCAAQABgA&s=0ac74343b5b909b27b75b3c2bffb8304983c430c&bdref=https%3A%2F%2Fde.cosmetiks.net%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fde.cosmetiks.net%2F,https%3A%2F%2Fde.cosmetiks.net%2F&

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
an-x-request-uuid: 129159e3-9484-4b28-b21e-fb016e08f056
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2623 0
20 B 127ms
126ms Image
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BKQ1R9AzwZYCvOoTZoPMP5LqPyAcAAAAAOAHgBAI&bg=!m5ilmNfNAAZdgtM0fYI7ADQBe5WfOHtV657ZmA4r5k-CeRn3WhmhOWdTx5UfeIu9pjYZKVEeT8_gLxQTpluqXPrJ6DxXAgAAAzhSAAAACmgBBwoAfl0U93S5U2dJoLbW7xnDVjxZpSoFT0O3mo-0BTwjqR0DAS9n-qZislzs7RhHImgdlWpH1AwCrr42G_gkTsLIwbdjfxlb1apMXIbFQJpKjByGYPNhGZvb5QWYnOaPiqdmtrAfU8YFXC-uHB3SLlBkPbjjYjvS_Zyxa17RkvIx_ZkC46XeWjhDUfnmE6zgxdMtd20DAL_ps5wAKjNHmUrPFQid7HRuDQVZFw5KHdq8ReYARC9Do1OcsRH8NIKC6r-FPcz0QhrGnjBe08F6p3ZVFxBJB_LvJMMkFwlUjNexm9W_QZg2U9QFkn3dN9sqQAbG7P6a_H3q9zq6bPmjr-qSacgvspbIig9PHT-p5vHYmzkZU8Mj-b3ivKEehi-T893Q-NjArYXksrb3jCQx78yZCDKTOTUtcTEa-WrsLPYFWyu1d83y2n4UnoHCHaGvv4OwmtcwQjc6PT93NA-xJRypZEC0Vtadg_ybGrJhCUN77-sOqB0gW9560gexTf06XtOOqz5Mgnd9wueVclewbNClu8njCrqHlxfp9onkiPxrv_SefBg2HZDSNrt4VTOviE7pSlIjAPqDSxKaj2tYw7fk3O2gwo8-2oFY8SIdroxzK4KMd8UQE3EiLvLiakciGJpK_7o86eXHmS4FvlKAsAXZHmJWISyA8kPVf7RlC6Nt2ClPldo0t4zHJq9kzfuWtt9Xy5PYdhf06ply6aZodzlfr_rmjdQ-JZDRLaYOkn4g2Rwr68bStU2D2noJb4z84riTiuWBB6qw8xeOroUGeFgmQLwrip3ZOkdwMWx09_eAWJVx23ATVkDpx93P5kXkUXqL8wMwS51jNJuM_2a5S_wuqNhbvoHa5x0MhuQCVv8kqGZBOZBUO8ZamUDxE7SO-n8DU5aY9C3YB_iQWsTMwKgdR-l5C4wV4Z34UwYh1iSCxwb_b-J83VqJlADrV2ug8x3DdB2NzDb8AMZsTFq7kZitZOHbdm_HPEX4cz-MJi4wA6SWX8qJS27P8Rdl9CdMbZMlOCicTYvJnyrxgk4s9_NwC5-eUGZBftvZsf3hxP4ZgrVu9Ybe4D_5SH8ziD9ddtS9U-hs0mbfaXwfP_yA-1rfhhP32HEUmBDsHH7o0i8hLcEueEdTsKIiC5y_CvKWDPaFaiv7u5A

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adcheck Show response
fundingchoicesmessages.google.com/f/AGSKWxVZ_mJoWSu59HEPH7j4MPKNjduMUlL5dq6KpQcmW48EFW7KbOPrw-82dNouaOkhbZP5jMEvnJkzreliymBOJ75pJ0OxrgQuOEZ3ajpZqQR58KOioPgNyWsEWyioXJJmPkgp5Tx-eTUw_yfN2-smsjlgcfB-K... 54 B
110 B 92ms
90ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVZ_mJoWSu59HEPH7j4MPKNjduMUlL5dq6KpQcmW48EFW7KbOPrw-82dNouaOkhbZP5jMEvnJkzreliymBOJ75pJ0OxrgQuOEZ3ajpZqQR58KOioPgNyWsEWyioXJJmPkgp5Tx-eTUw_yfN2-smsjlgcfB-KezTaZDRWCjSUsVGkPRf79MaTKvsJsCS/__745_90./adcheck?_300_60_?ad_tag=/adb_detector.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.s7hiGroMvxU.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwI1hJDnoRrpPPGA0C2XADTNmznEw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

36a37b26f7b5d5cd999cd7fd9e33ac335a12356d9207464df05793a5d5d8bde0

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Vb1pwK_V5-6NbBXM006xGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Vb1pwK_V5-6NbBXM006xGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjStHikmJw0JBiOO90h-k6ENcyPGNqBWIDjedMFkD87stLJp6vL5kkgFgDiHf4eLDwrZvOqgLEuuuns4YCcczz6awpQOyUPoM1CIh96mewxgDxqQXnWS8BsRAPx_eZB9azCex4f2Q-EwDyRS51"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
67 B 64ms
62ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 13:21:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67514
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
server: cafe
etag: 13036835877489095579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 13:21:01 GMT

POST
H3 204 AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 321ms
184ms XHR
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-c-VzWqoz5sV4hzTevujwKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-c-VzWqoz5sV4hzTevujwKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktHikmII1pBiqGV4xtQKxDt8PFic0mewBgGxEA_H95kH1rMJ7Jh4rIsZAPoGDZ8"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 158ms
90ms XHR
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-c5-NNMQUTcnAj0Hsj7xO2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-c5-NNMQUTcnAj0Hsj7xO2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktHikmJw0JBiqGV4xtQKxDt8PFic0mewBgGxEA_H95kH1rMJNPw9-oAJAPh0DhQ"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://de.cosmetiks.net
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame C9FD 0
917 B 76ms
75ms Script
text/html 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1199&pub_id=1644430&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1199&pub_id=1644430

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
an-x-request-uuid: cc1384c7-63e7-4696-8191-5f1b8aa3f8e4
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 122ms
111ms XHR
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wNgCtcccC2hFuIxjlt_2MQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-wNgCtcccC2hFuIxjlt_2MQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktHikmLw05BiqGV4xtQKxDt8PFic0mewBgGxEA_H95kH1rMJnPh27iUTAPwBDnU"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://de.cosmetiks.net
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 184ms
175ms XHR
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Y2mY-T6gz0-kq5ioY3Rv3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Y2mY-T6gz0-kq5ioY3Rv3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktHikmII1pBiqGV4xtQKxDt8PFic0mewBgGxEA_H95kH1rMJvFj4opMZAPuaDgA"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://de.cosmetiks.net
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxXGJy8qPITQ2QaRA6EkFVQ0Hf4SfBKnBN4xEaSDGXvLVCcNXw_9CbWyh9SKAfe-P0p8JI-KCVvk0IA6HxKGjmv7dysITW1DF4S9LNYntAbFN17DHIC1wzfGjnw-SKvZ79DQz08ZUg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 100ms
99ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXGJy8qPITQ2QaRA6EkFVQ0Hf4SfBKnBN4xEaSDGXvLVCcNXw_9CbWyh9SKAfe-P0p8JI-KCVvk0IA6HxKGjmv7dysITW1DF4S9LNYntAbFN17DHIC1wzfGjnw-SKvZ79DQz08ZUg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzEwMjMwNzc1LDY4NzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZXMiLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9kZS5jb3NtZXRpa3MubmV0LyIsbnVsbCxbWzgsInM3aGlHcm9NdnhVIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzIwLCJbbnVsbCxudWxsLFs5NTMyNzA4MF0sNSwyXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

24784f208ef647427066fe7a4a40e90c5d7b6184251d28c2f9d8f171939a4aff

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-hKDAF7bD07KGrUSq9zKLbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-hKDAF7bD07KGrUSq9zKLbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjStHikmII1pBiOO90h-k6ENcyPGNqBWIDjedMFkD87stLJp6vL5kkgFgDiHf4eLDwrZvOqgLEuuuns4YCcczz6awpQOyUPoM1CIh96mewxgDxqQXnWS8BsRAPx_eZB9azCXx4_e8REwD8qy85"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 vevent
nym1-ib.adnxs.com/ Frame 58B2 0
984 B 71ms
70ms Ping
text/html 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fde.cosmetiks.net%2F%2F%3E%3Clink+rel%3D&e=wqT_3QK_F_SsAr8LAAADANYABQEI9pnArwYQxMaarrX_z4dhGMW47OC-pZvKGyo2CT8rWj3h0O0_Ef6k3UwjV-E_GQAAAKCZmQtAIf1Ju7H09ec_KbYQ5KCEmfQ_MQAAAKBH4do_MOeR1Ag4rwlAmDlIAlCQlsfsAVi-235gAGi7_wR4w8wFgAEBigEDVVNEkgEDVVNEmAGsAqAB2ASoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDk3MDM3MjIsIDApO3VmKCdpJywgOTc0NjEwMywgMCk7dWYoJ2cnLCAyNDYwODczNiwgMCk7dWYoJ3MnLCAyOTUzNDk2ODQsIDApO3VmKCdyJywgNDk2MDkzOTY4LCAwKTuSApkPIWhYdUJCd2pvbjdzY0VKQ1d4LXdCR0FBZ3Z0dC1NQUU0QUVBQVNKZzVVT2VSMUFoWUFHRGxBbWdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQXFnQkFyQUJBTGtCRnpvclhJbVo5RF9CQVJjNksxeUptZlFfeVFFQUFBQUFBQUR3UDlrQkFBQUFBQUFBOERfZ0FiZnQwZ1QxQVFvZ1EwQ1lBZ0NnQWdLMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3R2lBdzRJdnFmVU5oQUVHQUV0WTNlaU9LSURFd2pjay1RMUVBb1lBUzFmRzZZX01nTjFibkdpQXc0SWc3bktOUkFMR0FJdEFBQUFBTG9EQ1U1WlRUSTZOVFU0T2VBRDgwV0FCUFhieHcySUJQbmJ4dzJRQkFHWUJBU3FCS1lIQ1BfX19fX19fX19fX3dFUV9fX19fX19fX19fX0FSal9fX19fX19fX19fOEJJUF9fX19fX18BFRR3RW9DREQBCg0BDDhCT1ANCwEBCHdGQQEHEQEIQVVqEQsUX19fOEJVNiwAAFkBFhEBBEFXNlgAAGE2LAAAdxEoAQEYQVhnQmdBSAELDQEIOEJpOhAAAGs6EAAgbUFHNjk1UUJvOhgAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQACAwQUhua2RRSTI6GAAANDoQAAA2OhAAADg6EAAcLUFIdUhvQUMN4QUBCEFZZzYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAEWUEuFQIhADYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAEGVBREFPOhQAAGY6NAAAZjogAAhZQUUl7Q0BCEFZZzYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAIWUFGDfsFAQhBWWc2EAAAWjogAABaOiAAKGJvRUdnanRDQkVBCQEQRFFQeGsJCwEBJENDb203QVJ3UVEBDgRBQQEgBDhrES0BEBRZQkFEeEIBCw0BXGlBWFZLNUFGc3J0NG1BVzAyLXFNQWFrRg0fFEE4RC14QhFPFEFBQXdRVQEHCQEATQkoHGdBa2Y3VF9SLigAADIVKPBDRHdQLUFGN08wSDhBWGdfOTBMLUFXcW90QUVnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkEd5ABCHc8EQmsJiAEBAEMdGHBMZ0dDdmdIbU5NSS1BZVMxQWo0QjZQWENQZ0hsZgUUREM5d2lCQ0twZTByS0ltZlFfaQHGSEFnQZoCmQEhcGhkUnZBam9uN3P5nVxMN2JmaUFBS0FBeDJfbC1hcngwN3o4NkMuoQYUVUR6UlVrAY8hbQh3UDEdlQBGERgMQUFBRxEYDERRUDIdGABIERgcQUFBSGdBaVEREPDtRHdQdy4u2AKeAuAC1_Re6gIlaHR0cHM6Ly9kZS5jb3NtZXRpa3MubmV0Ly8-PGxpbmsgcmVsPYADAIgDAZADAJgDF6ADAaoDAMAD2ATIAwDYA7r3lAHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQNMzguMTMyLjExOC43MqgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABPqksiLIBADSBA43MzIwI05ZTTI6NTU4OdoEAggB4AQB8ASQlsfsAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAEPuNgFAeAFAfAFzf1A-gUECAAQAJAGAJgGAKIGDjExOTkjTllNMjo1MjYzuAYAwQYAATMsAPA_0AapJdoGFgoQBRAdAWAQABgA4AYB8gaHAQiyu3gSgAFvQlNFY1ZvIWvYREFBa0NCUUVJLS1mV0N4Q0RfYkFDR0tYbHRBSWdCeWdBUU55UThRUkl6dXV4RFZEelJWaVBLWDGdKa0AZzWtBEFBATdAQUpBQkFKb0JBZ2dBcUFFQXMuIABQQS4ugAcBiAcAoAcByAfDzAXSBw0JCa8EM0ABrAjaBwYB9PB3GADgBwDqBwIIAPAHrIGHA4oIRwpDAAABjjGyoPBhDz_7VcajRP-0xTZr9mQfzxMkk5gFf-GRHFHSZaWA17umrfgu_Ux_ivXy4ZFafScuXHgGkL6KCO8MmRABlQgAAIA_mAgBwAieAtIIDgiBgoSIkKDAgAEQABgA&s=c8fe5c943cf3e3ab018b599875dafc453873e31b&type=nv&nvt=5&jm=1003&px=1430&py=840&bw=300&bh=600&sid=4472259031769655685&vd=ct~0|rr~0&sv=243&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18155751&cid=3&cr=nv&sw=1600&sh=1200&pw=1600&ph=3169&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/243/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:15 GMT
an-x-request-uuid: 8262c7a2-c8e5-4426-bc34-c7951a209e93
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame D77F 40 KB
11 KB 87ms
86ms Script
text/html 23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=publicidad&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 11e0c063fa11fdd7b2e65c785f23baf9ca645f50fcdda383f35e8aad843832f4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=publicidad&gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Mar 2024 07:41:34 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84923
Connection: keep-alive
Content-Length: 10988
Expires: Wed, 13 Mar 2024 07:41:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/ Frame 09C2 12 KB
4 KB 64ms
62ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240306/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1305047.3448850XANDR/B31484616.387374617;dc_ver=99.292;sz=300x600;u_sd=1;gdpr=0;dc_adk=732509351;ord=hr1ios;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKbAfCamwAAAAMAxBkFAQj2mcCvBhDExpqutf_Ph2EYxbjs4L6lm8obIOeR1AgorwkwmDk4AkCQlsfsAUi-235QAFoDVVNEYgNVU0RorAJw2AR4u_8EgAHDzAWIAQGQAQGYAQWgAQKpAT8rWj3h0O0_sQH-pN1MI1fhP7kBAAAAoJmZC0DBAf1Ju7H09ec_yQG2EOSghJn0P9gBngLgAQA.%2Fs%3Dae9d020a8fe643743a78c400681dfa7db8f3f4e3%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521phdRvAjon7scEJCWx-wBGL7bfiAAKAAx2_l-arx07z86CU5ZTTI6NTU4OUDzRUkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAADQP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU1ODk%3D%2Fbn%3D91715%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fde.cosmetiks.net%2F$0;xdt=0;crlt=REnE0)iI-v;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=139;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 08:19:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 08:19:06 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 09C2 172 KB
60 KB 78ms
72ms Script
text/javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Origin: https://ad.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:11:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35676
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Mar 2024 22:11:39 GMT

POST
H3 204 AGSKWxU3REjG6aU5dmHeDB7qZADq8xejjieAzsHMD9vT-jUNYs4Xwc9GflYNHeFclVfxVG32-yv00U8KPT_KXM5JVKQM_oNIbv4SkGp8jbG6EuyS9iKZm-qGrXB7ccmAHjnA6kDtBsyiww== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 93ms
92ms XHR
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU3REjG6aU5dmHeDB7qZADq8xejjieAzsHMD9vT-jUNYs4Xwc9GflYNHeFclVfxVG32-yv00U8KPT_KXM5JVKQM_oNIbv4SkGp8jbG6EuyS9iKZm-qGrXB7ccmAHjnA6kDtBsyiww==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A8H3VPnM5BtXIUdV_QDoYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-A8H3VPnM5BtXIUdV_QDoYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktHikmLw15BiqGV4xtQKxDt8PFic0mewBgGxEA_H95kH1rMJLGjbuJAZAPi5DXo"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://de.cosmetiks.net
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 177ms
176ms XHR
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVF-ExNX2FVQ6YLIvabo37C7dO8Hkbm3PSQ_bzOXoRaKJzLY8eVKql44tsJLs14eVav6HBOjvjKD_lUL-nXbROenxKs2_lDdhoD4vaSmBjfap31tyW8koyV19CFtc9K64Y6JBoU9w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ATmHTz1Fj_6F_xNj515VnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-ATmHTz1Fj_6F_xNj515VnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktHikmLw1pBiqGV4xtQKxDt8PFic0mewBgGxEA_H95kH1rMJvDg06yQzAPqEDgs"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame D77F 7 B
790 B 363ms
61ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
Expires: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 09C2 41 KB
14 KB 67ms
66ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 19:42:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 476600
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 06 Mar 2025 19:42:55 GMT

GET
H2

200

src=10192510;dc_pre=CKnAjI-i7oQDFaIMdgYdUPQPPQ;type=impressi;cat=lv-gsxdr;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=0;gdpr_consent=;ord=1 Show response
adservice.google.com/ddm/fls/z/ Frame 09C2
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=10192510;type=impressi;cat=lv-gsxdr;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=0;gdpr_consent=;ord=1?
https://ad.doubleclick.net/ddm/activity/src=10192510;dc_pre=CKnAjI-i7oQDFaIMdgYdUPQPPQ;type=impressi;cat=lv-gsxdr;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=0;gdpr_consent=;...
https://adservice.google.com/ddm/fls/z/src=10192510;dc_pre=CKnAjI-i7oQDFaIMdgYdUPQPPQ;type=impressi;cat=lv-gsxdr;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=0;gdpr_consent=;o...

42 B
401 B

306ms
130ms

Script
image/gif

2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/z/src=10192510;dc_pre=CKnAjI-i7oQDFaIMdgYdUPQPPQ;type=impressi;cat=lv-gsxdr;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=0;gdpr_consent=;ord=1

Requested by

Protocol

Server

2607:f8b0:4006:820::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Mar 2024 08:06:16 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"4224391616936662289"}],"aggregatable_trigger_data":[{"filters":{"14":["73732516"]},"key_piece":"0x8a98c887d6084852","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x311352596d50df7","not_filters":{"14":["73732516"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["73732516"]},"key_piece":"0x1d09653539e0a9cb","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xfa681c868136d7c","not_filters":{"14":["73732516"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"971942794994035640","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"4224391616936662289","filters":{"14":["73732516"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"4224391616936662289","filters":{"14":["73732516"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"4224391616936662289","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"4224391616936662289","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["10192510"]}}
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: image/png
location: https://adservice.google.com/ddm/fls/z/src=10192510;dc_pre=CKnAjI-i7oQDFaIMdgYdUPQPPQ;type=impressi;cat=lv-gsxdr;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=0;gdpr_consent=;ord=1
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

activityi;dc_pre=CJjblo-i7oQDFUmKfwQdy88LAA;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 Show response
10192510.fls.doubleclick.net/ Frame 09C2
Redirect Chain

https://10192510.fls.doubleclick.net/activityi;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://10192510.fls.doubleclick.net/activityi;dc_pre=CJjblo-i7oQDFUmKfwQdy88LAA;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?

0
0

142ms
140ms

Script
text/html

142.250.72.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://10192510.fls.doubleclick.net/activityi;dc_pre=CJjblo-i7oQDFUmKfwQdy88LAA;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1305047.3448850XANDR/B31484616.387374617;dc_ver=99.292;sz=300x600;u_sd=1;gdpr=0;dc_adk=732509351;ord=hr1ios;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKbAfCamwAAAAMAxBkFAQj2mcCvBhDExpqutf_Ph2EYxbjs4L6lm8obIOeR1AgorwkwmDk4AkCQlsfsAUi-235QAFoDVVNEYgNVU0RorAJw2AR4u_8EgAHDzAWIAQGQAQGYAQWgAQKpAT8rWj3h0O0_sQH-pN1MI1fhP7kBAAAAoJmZC0DBAf1Ju7H09ec_yQG2EOSghJn0P9gBngLgAQA.%2Fs%3Dae9d020a8fe643743a78c400681dfa7db8f3f4e3%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521phdRvAjon7scEJCWx-wBGL7bfiAAKAAx2_l-arx07z86CU5ZTTI6NTU4OUDzRUkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAADQP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU1ODk%3D%2Fbn%3D91715%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fde.cosmetiks.net%2F$0;xdt=0;crlt=REnE0)iI-v;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=139;prcl=s
Protocol: H2
Server: 142.250.72.102 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s32-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Redirect headers

date: Tue, 12 Mar 2024 08:06:16 GMT
strict-transport-security: max-age=21600
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://10192510.fls.doubleclick.net/activityi;dc_pre=CJjblo-i7oQDFUmKfwQdy88LAA;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 09C2 207 KB
63 KB 68ms
65ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6afee967915e87f217a98c38c9d5ed411a339eac603c3f25364fea36cff27b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 07:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64070
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 12 Mar 2024 08:35:02 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 8 KB
4 KB 86ms
84ms Document
text/html 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ac93cca221190f9d74cb6fcba8f59d884eda69ed0b89ef83b002723bd844d28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3627
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:15 GMT
expires: Wed, 12 Mar 2025 08:06:15 GMT
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 09C2 0
0 127ms
126ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst7uqJQYg4WnGo5pLOrEiSgAkMsyT-zRKutOnjgUAvNpyNB64UZ9hF9-6OusQ6y1VcD5J22SWKRyuvFJawFcp9SPMs36nJTRIvqlTc2fCdpN86B6Sa8-dIrA0ULYcMxpHnLeyLnoHSWMRwSTsuuuQ_ZLZZCJOAz8Ad4C4XLw2wMY6kub5DOO0vGLl7yvlHcowQVwagjvWew2iqSu-SvY15uxw&sai=AMfl-YQ_BpAzJPbsAGGiMyV_1RzgfWcI48e9_gSBTDRWUtppGvq5KDsPPXY6VM0gj3Rxk6BzfNDSCl_UVBlgqpwnaqYwFC81E3eeDGlHcA&sig=Cg0ArKJSzD5pnTiO4xUyEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=139&cbvp=1&cstd=122&cisv=r20240306.22817&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 12 Mar 2024 08:06:16 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A76E 0
20 B 123ms
121ms Ping
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4710073187115&version=m202402290101&ct=119&x=1&cor=658080787492139400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 21F1 38 KB
13 KB 69ms
65ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 294961
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Mar 2024 22:10:15 GMT
expires: Sat, 08 Mar 2025 22:10:15 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 initial.css
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 4 KB
1 KB 69ms
65ms Stylesheet
text/css 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/initial.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6d6eb3afd7b0e066b58fccb2f53d0313ba458e2b41da9b8e25e4b7d38551b6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Thu, 06 Mar 2025 08:52:19 GMT
date: Wed, 06 Mar 2024 08:52:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 515637
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1221
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 6190 120 KB
41 KB 70ms
66ms Script
text/javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 22:18:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35275
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Mar 2024 22:18:21 GMT

GET
H3 200 modernizr.js Show response
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 3 KB
1 KB 93ms
90ms Script
application/x-javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/modernizr.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f02e1ddd474fd249cee6c56e4f1a491ac825f8f82dd8892817c4ff8079056a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:13:31 GMT
date: Fri, 08 Mar 2024 22:13:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 294765
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1424
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 DrawSVGPlugin.js Show response
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 4 KB
2 KB 94ms
90ms Script
application/x-javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/DrawSVGPlugin.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c951ef5c0fb339a2cb574510f4c0a4393e1af0c7af599eb1d85ce771bdc32d5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:21:39 GMT
date: Fri, 08 Mar 2024 22:21:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 294277
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2126
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gsap_3.1.0_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6190 56 KB
22 KB 116ms
112ms Script
text/javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.1.0_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc487336acb3ea5ed2cc6ca09757137d612286c0ebb00587a997ecbea9053546

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22938
x-xss-protection: 0
last-modified: Fri, 24 Jan 2020 21:59:48 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Mar 2024 08:06:16 GMT

GET
H3 200 block.png
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 9 KB
9 KB 90ms
86ms Image
image/png 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/block.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e779ff29dcb70827d3506c0a10bcf7235ccafb4eff2f2585007d857e6f75ac2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:09:21 GMT
date: Fri, 08 Mar 2024 22:09:21 GMT
x-content-type-options: nosniff
age: 295015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9171
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 7 KB
3 KB 88ms
84ms Image
image/svg+xml 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a430a306706760a4083cf5897c6bb11cd2abe86b057c539e9e5d5803264fc02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Thu, 06 Mar 2025 09:00:52 GMT
date: Wed, 06 Mar 2024 09:00:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 515124
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2864
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 introImage.jpg
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 51 KB
51 KB 66ms
65ms Image
image/jpeg 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/introImage.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fda220792b7ad74f366007068d1afac162b567cb7ec9f75a56b8022a85e14c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:18:07 GMT
date: Fri, 08 Mar 2024 22:18:07 GMT
x-content-type-options: nosniff
age: 294489
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51784
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 fitBox-min.js Show response
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 2 KB
659 B 77ms
76ms Script
application/x-javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/fitBox-min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d2a4b0964ff75d88c8a65fa5ca4f8bd08e102a0e071dffa79f3e414f018769c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:28:28 GMT
date: Fri, 08 Mar 2024 22:28:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 293868
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 628
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 initial.js Show response
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 17 KB
4 KB 90ms
87ms Script
application/x-javascript 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/initial.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7816ba77d1ae0b52a20e44a94e5c66e8d6c69fe21e947764444672abb69d0247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Thu, 06 Mar 2025 08:52:20 GMT
date: Wed, 06 Mar 2024 08:52:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 515636
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3951
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 dc_oe=ChMIgPnSjaLuhAMVhCxoCB1k3QN5EAAYACCClpxkQhMIzf-ajaLuhAMVOazRBB0U5AqK;dc_eps=AHas8cAy0m9A4zgI6n837MmdmJMLYwYKKrLzYTQPgtcYZEwbF4_Y5FmbjxkyxDW1WFm2UndRX9lzON0Vdd8CuEzF;met=1;&timestamp=171023077...
ade.googlesyndication.com/ddm/activity/ Frame A76E 42 B
401 B 306ms
123ms Image
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIgPnSjaLuhAMVhCxoCB1k3QN5EAAYACCClpxkQhMIzf-ajaLuhAMVOazRBB0U5AqK;dc_eps=AHas8cAy0m9A4zgI6n837MmdmJMLYwYKKrLzYTQPgtcYZEwbF4_Y5FmbjxkyxDW1WFm2UndRX9lzON0Vdd8CuEzF;met=1;&timestamp=1710230776141;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=1;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js Show response
pagead2.googlesyndication.com/bg/ Frame 21F1 51 KB
20 KB 66ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KWAUkR2X_3396iiuIOVJJ1s4v9_BCXHf9116__MAGIw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

296014911d97ff7dfdea28ae20e549275b38bfdfc10971dff75d7afff300188c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 22:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20259
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Mar 2025 22:29:57 GMT

GET
H3 200 Monday-Regular-min.woff2
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 9 KB
9 KB 73ms
71ms Font
font/woff2 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/Monday-Regular-min.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/initial.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d631b5ba7246900d6091b31413bf8577c9b354e48382f3d1570fb092c80ea476

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/initial.css
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:21:57 GMT
date: Fri, 08 Mar 2024 22:21:57 GMT
x-content-type-options: nosniff
age: 294259
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8964
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 FoundersGrotesk-Medium-min.woff2
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 7 KB
7 KB 74ms
72ms Font
font/woff2 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/FoundersGrotesk-Medium-min.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10750023337778355526/initial.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69ed614ee30d0b8afcf4d93629b66cc14b9a723aaefe61ba5f400e827ad58f4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/initial.css
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Thu, 06 Mar 2025 09:04:28 GMT
date: Wed, 06 Mar 2024 09:04:28 GMT
x-content-type-options: nosniff
age: 514908
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7632
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2

200

/
sync.richaudience.com/e231bbbe91d9e7e900144b910bfcc7d7/ Frame D77F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=publicidad&gdpr=0&gdpr_consent=&gdpr=0&khaos=LTO38VAL-1E-77AZ
https://sync.richaudience.com/e231bbbe91d9e7e900144b910bfcc7d7/?uid=LTO38VAL-1E-77AZ&gdpr=0

95 B
365 B

161ms
159ms

Image
image/png

162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/e231bbbe91d9e7e900144b910bfcc7d7/?uid=LTO38VAL-1E-77AZ&gdpr=0
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: H2
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/png
date: Tue, 12 Mar 2024 08:05:48 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.richaudience.com/e231bbbe91d9e7e900144b910bfcc7d7/?uid=LTO38VAL-1E-77AZ&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e71ccbe96f42d70fa40603ada4c96b28
Expires: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6190 8 KB
6 KB 134ms
133ms XHR
application/json 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

59c08804840272f3cbe412bfbf0da702cc44d8ec843f2943677d88adf5362a79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5811
x-xss-protection: 0

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame D77F
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=w0QZpsajRMCPcSbVwZy6og&rk=usync-other&gdpr=0
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=w0QZpsajRMCPcSbVwZy6og&gdpr=0

43 B
479 B

149ms
148ms

Image
image/gif

67.220.224.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=w0QZpsajRMCPcSbVwZy6og&gdpr=0

Protocol

HTTP/1.1

Server

67.220.224.144 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:17 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YSVV56E39G4G976VX209
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=w0QZpsajRMCPcSbVwZy6og&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 20e8391fc78a9019eb67dba4b22f0ac2
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame D77F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0
https://s.amazon-adsystem.com/ecm3?id=LTO38VAL-1E-77AZ&ex=d-rubiconproject.com&status=ok&gdpr=0

43 B
720 B

123ms
63ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LTO38VAL-1E-77AZ&ex=d-rubiconproject.com&status=ok&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:16 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 93FFF4SACEAQR42Q9AHB
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LTO38VAL-1E-77AZ&ex=d-rubiconproject.com&status=ok&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f69a50991384d09413b97a37bb74928b
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D77F
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZDBmNjM4MTNjMzBkNDdlMzViZTkyMGI1ODI0YTE1YzA1YWM0ZDhkNQ&gdpr=0

170 B
188 B

83ms
80ms

Image
image/png

142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZDBmNjM4MTNjMzBkNDdlMzViZTkyMGI1ODI0YTE1YzA1YWM0ZDhkNQ&gdpr=0

Requested by

Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/

Protocol

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZDBmNjM4MTNjMzBkNDdlMzViZTkyMGI1ODI0YTE1YzA1YWM0ZDhkNQ&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D77F
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFRPMzhWQUwtMUUtNzdBWg==&gdpr=0
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEEhELROvtmdbTNEUQVOb94g&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFRPMzhWQUwtMUUtNzdBWg==&google_push=&gdpr=0

170 B
188 B

80ms
79ms

Image
image/png

142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFRPMzhWQUwtMUUtNzdBWg==&google_push=&gdpr=0

Protocol

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-200-0-7.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFRPMzhWQUwtMUUtNzdBWg==&google_push=&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame D77F
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=&expires=30

42 B
884 B

180ms
61ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=&expires=30
date: Tue, 12 Mar 2024 08:06:16 GMT
server: Kestrel
content-length: 289

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame D77F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=7jf2hwtBRUCbBfGQhH4xhg&rk=usync-na&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=7jf2hwtBRUCbBfGQhH4xhg&gdpr=0

43 B
479 B

64ms
63ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=7jf2hwtBRUCbBfGQhH4xhg&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:16 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 60KBNJC48MM4H1253XMD
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=7jf2hwtBRUCbBfGQhH4xhg&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame D77F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEJk97gcS0qqpxs6x38CZIFI&google_cver=1

42 B
884 B

184ms
63ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEJk97gcS0qqpxs6x38CZIFI&google_cver=1
Requested by: Host: de.cosmetiks.net
URL: https://de.cosmetiks.net/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: e71ccbe96f42d70fa40603ada4c96b28
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEJk97gcS0qqpxs6x38CZIFI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
px.ads.linkedin.com/ Frame D77F
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&gdpr=0
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LTO38VAL-1E-77AZ&gdpr=0

0
514 B

231ms
131ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LTO38VAL-1E-77AZ&gdpr=0
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 41F3CCA9FFAC4273820D795CB29C7B88 Ref B: MIAEDGE2712 Ref C: 2024-03-12T08:06:16Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYTciHupB5a2+XkesuwKQ==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LTO38VAL-1E-77AZ&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame D77F
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0
https://pr-bh.ybp.yahoo.com/sync/rubicon/VyPbuXTPed8q87fIgcM2D8n5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-F1GuVOdE2oJeubOh4QOBBxmfIK9alW_gga284Q--~A

42 B
884 B

61ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-F1GuVOdE2oJeubOh4QOBBxmfIK9alW_gga284Q--~A
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Tue, 12 Mar 2024 08:06:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-F1GuVOdE2oJeubOh4QOBBxmfIK9alW_gga284Q--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame D77F
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&gdpr=0
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&gdpr=0&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AADUcE7L4BoAABOlJ8yvUw&expires=30&gdpr=0

42 B
884 B

63ms
62ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AADUcE7L4BoAABOlJ8yvUw&expires=30&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AADUcE7L4BoAABOlJ8yvUw&expires=30&gdpr=0
Date: Tue, 12 Mar 2024 08:06:16 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame D77F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LTO38VAL-1E-77AZ&gdpr=0

68 B
280 B

218ms
58ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LTO38VAL-1E-77AZ&gdpr=0
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LTO38VAL-1E-77AZ&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
Expires: 0

GET
H2

200

cksync.php
hb.yahoo.net/ Frame D77F
Redirect Chain

https://token.rubiconproject.com/token?pid=26594&gdpr=0
https://hb.yahoo.net/cksync.php?cs=1&type=58160&ovsid=LTO38VAL-1E-77AZ&gdpr=0

53 B
645 B

314ms
95ms

Image
image/gif

23.200.0.7
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hb.yahoo.net/cksync.php?cs=1&type=58160&ovsid=LTO38VAL-1E-77AZ&gdpr=0

Protocol

Server

23.200.0.7 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Tue, 12 Mar 2024 08:06:16 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Tue, 12 Mar 2024 08:06:16 GMT

Redirect headers

Location: https://hb.yahoo.net/cksync.php?cs=1&type=58160&ovsid=LTO38VAL-1E-77AZ&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame D77F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&gdpr=0
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LTO38VAL-1E-77AZ&gdpr=0
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LTO38VAL-1E-77AZ
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LTO38VAL-1E-77AZ&ckls=true&ci=xrDnVQeeQu&nc=false&trid=857840263

43 B
1 KB

237ms
81ms

Image
image/gif

18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LTO38VAL-1E-77AZ&ckls=true&ci=xrDnVQeeQu&nc=false&trid=857840263
Protocol: H2
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:17 GMT
via: 1.1 bf8d7cb6fca5d51158e1109ca40fe242.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: XirVPRJLBt4tegqnEpoiSYyPtscDhSsLHUHJEOM_tni2wluvDmqzaw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:17 GMT
via: 1.1 0ac640943c2918c03a0350f4e8b083a8.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LTO38VAL-1E-77AZ&ckls=true&ci=xrDnVQeeQu&nc=false&trid=857840263
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: 78otmnh4dGe5TL2nlRrsNm-8SHL_cYXAZBZ9g_r8iDH_Hbwf9ic0gA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame D77F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&gdpr=0
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LTO38VAL-1E-77AZ&gdpr=0

43 B
1 KB

69ms
68ms

Image
image/gif

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LTO38VAL-1E-77AZ&gdpr=0

Protocol

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
an-x-request-uuid: a1ac4e37-21dd-4f5d-a1ca-89c3458ceec9
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LTO38VAL-1E-77AZ&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
Expires: 0

GET
H2

200

pixel
capi.connatix.com/us/ Frame D77F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&gdpr=0
https://capi.connatix.com/us/pixel?puid=LTO38VAL-1E-77AZ&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0
https://capi.connatix.com/us/pixel?puid=LTO38VAL-1E-77AZ&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&final=true

82 B
82 B

84ms
82ms

Image
image/gif

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=LTO38VAL-1E-77AZ&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&final=true
Protocol: H2
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 863248b47b18259d-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 12 Mar 2024 08:06:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://capi.connatix.com/us/pixel?puid=LTO38VAL-1E-77AZ&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&final=true
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 863248b3facf259d-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame D77F
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=7afd8105-bed7-4777-9f68-61b4c22bab1c&expires=30&gdpr=0

42 B
884 B

63ms
61ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=7afd8105-bed7-4777-9f68-61b4c22bab1c&expires=30&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=7afd8105-bed7-4777-9f68-61b4c22bab1c&expires=30&gdpr=0
Date: Tue, 12 Mar 2024 08:06:17 GMT
Connection: keep-alive
X-CI-RTID: 285588f3-1c3f-4071-a072-245942ab01ec
Content-Length: 155
Content-Type: text/html; charset=utf-8

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 09C2 0
0 127ms
126ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst7uqJQYg4WnGo5pLOrEiSgAkMsyT-zRKutOnjgUAvNpyNB64UZ9hF9-6OusQ6y1VcD5J22SWKRyuvFJawFcp9SPMs36nJTRIvqlTc2fCdpN86B6Sa8-dIrA0ULYcMxpHnLeyLnoHSWMRwSTsuuuQ_ZLZZCJOAz8Ad4C4XLw2wMY6kub5DOO0vGLl7yvlHcowQVwagjvWew2iqSu-SvY15uxw&sai=AMfl-YQ_BpAzJPbsAGGiMyV_1RzgfWcI48e9_gSBTDRWUtppGvq5KDsPPXY6VM0gj3Rxk6BzfNDSCl_UVBlgqpwnaqYwFC81E3eeDGlHcA&sig=Cg0ArKJSzD5pnTiO4xUyEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=591&vt=11&dtpt=452&dett=3&cstd=122&cisv=r20240306.22817&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 12 Mar 2024 08:06:16 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6190 17 KB
6 KB 90ms
88ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Mar 2024 08:06:16 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 21F1 0
20 B 127ms
126ms Image
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BgR6W9wzwZcCKK9CeoPwP54OU0A4AAAAAOAHgBAI&bg=!aGulayTNAAZdgtM0fYI7ADQBe5WfOAaNePSCLTbhdVZi8XCOFeE6GGLz6uhaM_EVdYoLb_uitLkDd0Sbix3qIu481qbvAgAAAO9SAAAAB2gBB5kC-jlugvJRX_NpRa_N9KNJt06FXuOKhEEKBjspY0a-KJd4aS5ebf1lFjjY95kGMoTMTsegaaY2V0nPN_0igcsxfZMNyDq1VQCQXDX8tYRxNKeG_2Ygo9nabYH02xkWq7sGQGZw7ZKKTOFb1vfcEm138jWw86lYUxLdqMS5u1DqrKsw7pwg7CUKNYQUIyUAsRDBuZr7cQfbATZ_ML5Tq4AUljnPdCuPRT5xB6vmjmjMnVnQtS53goCUY6fem3mdrBZWaH_6HwMKWLmMLwctBt68rmPMlmIT8wm0Rz9zrEOt1DOjCq5oQUFc5DbeA4aDx_1xPeIgrqQwjEYqCbJF4L3HmDIFvrGyiEq_iy1XhE4dasF4Zj1TpWd5eo9DveLYeXFn6M9hOIbOlxIJUmrTXHS63T8Zk6PhOhj_RCMiQbDzh876W4Qtgb-KIcgi5vq7tt-kBqA58SD0bRB6cL4454UwkmtXGcATErpBvQj2qdxUefCvwezOwh3y0XVBSiaj_VVWvSpUsUmGh5OvkNBo3jT3_YSGVd_vn21GHQXPx_8oqn8rsjDBZxsjZytCpMiY4Nvijj4sT2hxRiBKtfi3VCP60L6jFY4V3vF7BTDAiKFMX7HVgSfTw3LJwzxnu008OzpL6Xb4vtfn0BfBDqPp4_8b4RIAqnv0hG9vrOFxGIQMqcnbJd2lLmAxUIw94FjkKTpXLjYhwzw-v1HQ3hs0FE8WTniLipNOhuU31ZRXq9f4HUJjKxvzEOj7tLwmU2doslWn2MuJNh8D2rejBBZuc8bGMlup72CitZn_OK5CRo1C-sJGMhwVEkU7Eqi0LSIvK2FyEj5_iFfRcYJY8P6v1wncZyiQB0M9idhUlBqbRoXLNrLRQ1_AQtAeZ_MjRzz3ahsuMOqZ_y4qwgEWBeqOeGMIALqBskEbe9TZUvdqDYnX2LJWavR2UgSZeNz8KMNIV0wfIRyFpfChizGrbOg_QfqSUwTIGBRNHfrSH9sLZekKUoiFLOj0wNdZkPiuWw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 149ms
147ms XHR
application/json 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240306&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403070101/show_ads_impl_fy2021.js?bust=31081690

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

97d5ceaff9d3d9b9b1a882b08ea8de38dc8a921e8ba01ecdc486e903f14dda60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12364
x-xss-protection: 0

GET
H3 200 pic_v21.jpg
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 72 KB
72 KB 66ms
65ms Image
image/jpeg 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/pic_v21.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13beb5267a44e63511f10d2edb6fe88c661de16b4864935d08c84b174965a606

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:14:49 GMT
date: Fri, 08 Mar 2024 22:14:49 GMT
x-content-type-options: nosniff
age: 294687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74153
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 O8T1Km08OhS5_Tz58jKeajrFynp-IyfJlJwKv1268Sc.js Show response
pagead2.googlesyndication.com/bg/ Frame B81E 39 KB
15 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O8T1Km08OhS5_Tz58jKeajrFynp-IyfJlJwKv1268Sc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3bc4f52a6d3c3a14b9fd3cf9f2329e6a3ac5ca7a7e2327c9949c0abf5dbaf127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 20:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41474
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15541
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Mar 2025 20:35:02 GMT

GET
H3 200 pic_v21.jpg
s0.2mdn.net/sadbundle/10750023337778355526/ Frame 6190 72 KB
72 KB 66ms
64ms Image
image/jpeg 2607:f8b0:4006:817::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10750023337778355526/pic_v21.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13beb5267a44e63511f10d2edb6fe88c661de16b4864935d08c84b174965a606

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10750023337778355526/index.html?e=69&leftOffset=0&topOffset=0&c=8wwYTpZWOv&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

expires: Sat, 08 Mar 2025 22:14:49 GMT
date: Fri, 08 Mar 2024 22:14:49 GMT
x-content-type-options: nosniff
age: 294687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74153
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 17:21:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

POST
H2 200 vevent
nym1-ib.adnxs.com/ Frame 58B2 0
985 B 76ms
75ms Ping
text/html 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fde.cosmetiks.net%2F%2F%3E%3Clink+rel%3D&e=wqT_3QK_F_SsAr8LAAADANYABQEI9pnArwYQxMaarrX_z4dhGMW47OC-pZvKGyo2CT8rWj3h0O0_Ef6k3UwjV-E_GQAAAKCZmQtAIf1Ju7H09ec_KbYQ5KCEmfQ_MQAAAKBH4do_MOeR1Ag4rwlAmDlIAlCQlsfsAVi-235gAGi7_wR4w8wFgAEBigEDVVNEkgEDVVNEmAGsAqAB2ASoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDk3MDM3MjIsIDApO3VmKCdpJywgOTc0NjEwMywgMCk7dWYoJ2cnLCAyNDYwODczNiwgMCk7dWYoJ3MnLCAyOTUzNDk2ODQsIDApO3VmKCdyJywgNDk2MDkzOTY4LCAwKTuSApkPIWhYdUJCd2pvbjdzY0VKQ1d4LXdCR0FBZ3Z0dC1NQUU0QUVBQVNKZzVVT2VSMUFoWUFHRGxBbWdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQXFnQkFyQUJBTGtCRnpvclhJbVo5RF9CQVJjNksxeUptZlFfeVFFQUFBQUFBQUR3UDlrQkFBQUFBQUFBOERfZ0FiZnQwZ1QxQVFvZ1EwQ1lBZ0NnQWdLMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3R2lBdzRJdnFmVU5oQUVHQUV0WTNlaU9LSURFd2pjay1RMUVBb1lBUzFmRzZZX01nTjFibkdpQXc0SWc3bktOUkFMR0FJdEFBQUFBTG9EQ1U1WlRUSTZOVFU0T2VBRDgwV0FCUFhieHcySUJQbmJ4dzJRQkFHWUJBU3FCS1lIQ1BfX19fX19fX19fX3dFUV9fX19fX19fX19fX0FSal9fX19fX19fX19fOEJJUF9fX19fX18BFRR3RW9DREQBCg0BDDhCT1ANCwEBCHdGQQEHEQEIQVVqEQsUX19fOEJVNiwAAFkBFhEBBEFXNlgAAGE2LAAAdxEoAQEYQVhnQmdBSAELDQEIOEJpOhAAAGs6EAAgbUFHNjk1UUJvOhgAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQACAwQUhua2RRSTI6GAAANDoQAAA2OhAAADg6EAAcLUFIdUhvQUMN4QUBCEFZZzYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAEWUEuFQIhADYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAEGVBREFPOhQAAGY6NAAAZjogAAhZQUUl7Q0BCEFZZzYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAIWUFGDfsFAQhBWWc2EAAAWjogAABaOiAAKGJvRUdnanRDQkVBCQEQRFFQeGsJCwEBJENDb203QVJ3UVEBDgRBQQEgBDhrES0BEBRZQkFEeEIBCw0BXGlBWFZLNUFGc3J0NG1BVzAyLXFNQWFrRg0fFEE4RC14QhFPFEFBQXdRVQEHCQEATQkoHGdBa2Y3VF9SLigAADIVKPBDRHdQLUFGN08wSDhBWGdfOTBMLUFXcW90QUVnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkEd5ABCHc8EQmsJiAEBAEMdGHBMZ0dDdmdIbU5NSS1BZVMxQWo0QjZQWENQZ0hsZgUUREM5d2lCQ0twZTByS0ltZlFfaQHGSEFnQZoCmQEhcGhkUnZBam9uN3P5nVxMN2JmaUFBS0FBeDJfbC1hcngwN3o4NkMuoQYUVUR6UlVrAY8hbQh3UDEdlQBGERgMQUFBRxEYDERRUDIdGABIERgcQUFBSGdBaVEREPDtRHdQdy4u2AKeAuAC1_Re6gIlaHR0cHM6Ly9kZS5jb3NtZXRpa3MubmV0Ly8-PGxpbmsgcmVsPYADAIgDAZADAJgDF6ADAaoDAMAD2ATIAwDYA7r3lAHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQNMzguMTMyLjExOC43MqgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABPqksiLIBADSBA43MzIwI05ZTTI6NTU4OdoEAggB4AQB8ASQlsfsAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAEPuNgFAeAFAfAFzf1A-gUECAAQAJAGAJgGAKIGDjExOTkjTllNMjo1MjYzuAYAwQYAATMsAPA_0AapJdoGFgoQBRAdAWAQABgA4AYB8gaHAQiyu3gSgAFvQlNFY1ZvIWvYREFBa0NCUUVJLS1mV0N4Q0RfYkFDR0tYbHRBSWdCeWdBUU55UThRUkl6dXV4RFZEelJWaVBLWDGdKa0AZzWtBEFBATdAQUpBQkFKb0JBZ2dBcUFFQXMuIABQQS4ugAcBiAcAoAcByAfDzAXSBw0JCa8EM0ABrAjaBwYB9PB3GADgBwDqBwIIAPAHrIGHA4oIRwpDAAABjjGyoPBhDz_7VcajRP-0xTZr9mQfzxMkk5gFf-GRHFHSZaWA17umrfgu_Ux_ivXy4ZFafScuXHgGkL6KCO8MmRABlQgAAIA_mAgBwAieAtIIDgiBgoSIkKDAgAEQABgA&s=c8fe5c943cf3e3ab018b599875dafc453873e31b&type=pv&jm=1003&px=1430&py=840&bw=300&bh=600&sf=1&sid=4472259031769655685&vd=ct~0|rr~6&sv=243&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18155751&cid=3&cr=pv&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/243/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:16 GMT
an-x-request-uuid: d0741d1f-809b-469d-81f6-f7e876b915bb
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 104ms
104ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403070101/show_ads_impl_fy2021.js?bust=31081690

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Mar 2024 08:06:16 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6D9A 13 KB
5 KB 70ms
69ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 41196
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Mar 2024 20:39:40 GMT
expires: Tue, 11 Mar 2025 20:39:40 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A1E4 829 B
561 B 93ms
86ms Document
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6e52bbf1ac73031cead44cbd4dd741544bb71aa7a4386432d833b6065928f3e7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HLx9mEKkLNT-1uRVDK7RCA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://de.cosmetiks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-HLx9mEKkLNT-1uRVDK7RCA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:16 GMT
expires: Tue, 12 Mar 2024 08:06:16 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 O8T1Km08OhS5_Tz58jKeajrFynp-IyfJlJwKv1268Sc.js Show response
pagead2.googlesyndication.com/bg/ Frame 6D9A 39 KB
15 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O8T1Km08OhS5_Tz58jKeajrFynp-IyfJlJwKv1268Sc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3bc4f52a6d3c3a14b9fd3cf9f2329e6a3ac5ca7a7e2327c9949c0abf5dbaf127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 20:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41475
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15541
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Mar 2025 20:35:02 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A1E4 0
0 123ms
123ms Image
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240306&jk=4145890288937817&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 09C2 42 B
64 B 130ms
126ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss5u3soXiWLAOPKBJanG8g5LBKytwLTjVjbhCRlK9acwtxCGWSPv6bZbSzGh5Si2zXITaKDc7J-jrNM-OzwgAnY4sGVszGZsjYvWXdwhlCHt_nIZirdAiScAUe2V66bGX7_kYm4KVO7fNyXSA&sig=Cg0ArKJSzG4955P703eiEAE&id=lidar2&mcvt=1010&p=0,0,600,300&mtos=1010,1010,1010,1010,1010&tos=1010,0,0,0,0&v=20240306&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=732509351&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=616357600&rst=1710230775497&rpt=569&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6D9A 0
12 B 65ms
64ms Image
text/plain 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?745lLw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:17 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 126ms
126ms Image
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240306&jk=4145890288937817&bg=!X1ylXBPNAAZsmiNCTJo7ADQBe5WfONculab-CcL9c2v8gG20FvTODl8LyuEMM1y3b9i3odj1HuUysuTgHkhtRcL0w_jUAgAAAMVSAAAABWgBB5kCuo9ghvw0nYq0lNBBTNNHwXwfSvfYcTkN1e-NBJhqeC9RakqQWlOZsAzprcRClxwpMraacW-31Ydt7TPwo0z9RPShOUwoZKrCf9y6oth1TlQdwSl-7tSJ8-lIUZze64fNcm0_GGf5mroRqEfarsqaeRcgWtPipzxzzDz6Ps8n_qELBaXp_IZPT3iZLDYSyotopDQAaWQP2qSdACoLGSgJBnqEl2rYasGTQYpouyHl4_AyYl03Sc-SuL1EYxRLc3Si58sJ_uK1lDLTpcWBHR7uUhu-s2MnPu7MMI8NJAYpzpM2ZF7J_mfNhw1YotnLOxikmp6p0RP_UbQh0F98mmnHd27P8GD_bXisHkxUhEmOE2Fwyn7Pe65-gRcYU9lpGon6GSdlL8gXmzG_NxusgC_1PWWjGI8CaQbgLBa92XVvL3er9-6mLGJsdRDgfKEUE3bp2bD5ADB_LqiGhAzTggWABRDJeXmPydWTcMdqUotQHiaNZbIKdWxEAWEDmfhjdnXKFzMmo2zoQVIMaQIpYBe1TkpRYFkZfawYSgX9XPsklvhueWVk8aaxI66IE_OOqXwg2ByyXjQVAIcvRyKYL4rapkUc_J4tMp5PJNqSIJs6S_GUSEsew2N2pb2RkmWsZfijCx04iDK1SqrAtP6hb1t3v_v5NGqxrWS4ppIsUlgNr1VayAN6BWV4ETHD5XUT3eB3cTf_T29q7QmhKKadk4VJej4-33ondppKZg2ECMUCWVHaxA0dtrM2xvBya5gYxlBsjd6FM-GJkEN-bYsp6gDKSBftIB3HCmr6mTm8_qPkYsAz0LaKYT28xodrO5YGEI0A530-Kf97JHgL2ky9uDNMg7Gt8vEMHZ8ezJvIU09TtKaEXJypI0R-lVmpf64t09J8ymWucfEjYGxH5XQSFWcBVkvZAn91ovRi-lpO
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://de.cosmetiks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 208ms
55ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fde.cosmetiks.net%2F&cw=1&lsw=1&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://de.cosmetiks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 12 Mar 2024 08:06:17 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 342968
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/ Frame 3E46
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fde.cosmetiks.net%2F&cw=1&lsw=1&gdpr=0
https://mug.criteo.com/sid?cpp=STjAJ3xJQ3FvZ1gyS25uVHZXL0ZCOGVyUlhCTFM5MHpDNG41MjlBaTRBT29LVks1SzkxTEkzSzlVbXhPNGlOeEcwYmZJTWlmWC9nNFpSZ2IvNWdGUjZ5NDFENm9uWHV0L01HcXBuV3JtdEVrQlEwYmNETmVJUi9BY1VQTU...

357 B
992 B

216ms
52ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=STjAJ3xJQ3FvZ1gyS25uVHZXL0ZCOGVyUlhCTFM5MHpDNG41MjlBaTRBT29LVks1SzkxTEkzSzlVbXhPNGlOeEcwYmZJTWlmWC9nNFpSZ2IvNWdGUjZ5NDFENm9uWHV0L01HcXBuV3JtdEVrQlEwYmNETmVJUi9BY1VQTUJCUUhpQUNMY3BDN0N4bHllN3lCWVQ3NmF1Q29ndWhjdTVvSFNuVlBKUm9KM28yNmN6dzhXVTVITFRJYTZLb1hnSlp6N01xandZbEtBY2pQbktMSUZjaEtEZUJ4QzlTVVBJY3ZSa3JweFl2YWJTUlRUeWNBPXw&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4d859cde036f09f3728e356c69ed70fb1c9364fe2e04606b0090f4f990f82566

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 959018
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:17 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
access-control-allow-origin: https://de.cosmetiks.net
location: https://mug.criteo.com/sid?cpp=STjAJ3xJQ3FvZ1gyS25uVHZXL0ZCOGVyUlhCTFM5MHpDNG41MjlBaTRBT29LVks1SzkxTEkzSzlVbXhPNGlOeEcwYmZJTWlmWC9nNFpSZ2IvNWdGUjZ5NDFENm9uWHV0L01HcXBuV3JtdEVrQlEwYmNETmVJUi9BY1VQTUJCUUhpQUNMY3BDN0N4bHllN3lCWVQ3NmF1Q29ndWhjdTVvSFNuVlBKUm9KM28yNmN6dzhXVTVITFRJYTZLb1hnSlp6N01xandZbEtBY2pQbktMSUZjaEtEZUJ4QzlTVVBJY3ZSa3JweFl2YWJTUlRUeWNBPXw&cppv=2
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 353218
content-length: 0
expires: 0

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 3E46 135 B
417 B 465ms
147ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4af95f928db794d4eb7feaaf1a738439f9dfcf9f0761dddb7b3f96724223eee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://de.cosmetiks.net
date: Tue, 12 Mar 2024 08:06:17 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 id Show response
id.crwdcntrl.net/ Frame 3E46 75 B
825 B 208ms
72ms Fetch
application/json 52.203.57.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?gdpr_applies=false
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.57.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-57-111.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 62d08f58f9289cee09480fe45d9213ec600e9b154990f3d72b93f5f0e321edf6

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://de.cosmetiks.net
cache-control: no-cache
x-server: 10.40.7.232
access-control-allow-credentials: true
content-length: 75
expires: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame FF25 16 KB
6 KB 232ms
68ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c861dd92be984fe498ece34c0f3c921861ac51bfee50323fcae21231abf7a82b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=71458
content-encoding: gzip
content-length: 5685
content-type: text/html
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: Wed, 13 Mar 2024 03:57:16 GMT
last-modified: Tue, 13 Feb 2024 04:57:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 5691 281 B
554 B 73ms
72ms Document
text/html 23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=0&gdpr_consent=
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 12 Mar 2024 08:06:18 GMT
ETag: "20524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 isync Show response
visitor.omnitagjs.com/visitor/ Frame A673 5 KB
2 KB 221ms
62ms Document
text/html 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

4b6cfc87f5c9cbdcf0e2d488bf0616fd6d7e188f29df0ecfdeb60d3722671b97

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 1448
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:17 GMT
expires: 0
p3p: CP="CAO PSA OUR"
pragma: no-cache
server: ayl-lb-usa02
vary: Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 2

GET
H2 200 isyn Show response
sync.a-mo.net/ Frame 33F5 2 KB
833 B 300ms
65ms Document
text/html 147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=Cq0BShBkZS5jb3NtZXRpa3MubmV0UgthYXMtMDNmZjlkM1oIcGJhMS4zLjRqEGRlLmNvc21ldGlrcy5uZXT6AQY4LjMzLjDoAgGIA_aZwK8GqAM86gMkNjE4Y2M5MDQtOThkMS00MzlhLWFiOTYtMGI0OTg2NWE0MzljqgQDRENIsgUDVVNE6gUHZGVza3RvcPoFA255NaoHA3dlYsoHDWNvc21ldGlrcy5uZXTgBwE
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 1f14de449c3f14033c8eb1683b4d5887dbc41d2d9a0308b583a296f2b93fecb0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 684
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

GET
H2 200 / Show response
csync.smilewanted.com/ Frame 168F 6 KB
2 KB 185ms
168ms Document
text/html 2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e1450b21a6f1b2807726ebbeadbaf68bafbbf406c15209e5d903f17c9a262b7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248bb1ef98dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:18 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 5C97 2 KB
863 B 68ms
65ms Document
text/html 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1710230774912&gdpr=0&gdpr_consent=

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip232.ip-51-222-239.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 / Show response
sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/ Frame 2080 61 B
245 B 173ms
172ms Document
text/html 162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/?ord=5545191321&consentString=
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: a2f3ad5fc3affc491c52f7538cc21e6d9d651f189386a5e5e768d74a5d1ad757

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:05:49 GMT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server: nginx/1.14.1
x-powered-by: PHP/8.2.4

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 5F0B 3 KB
2 KB 129ms
38ms Document
text/html 104.18.38.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.38.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 360
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 863248bb9d6c3708-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: Tue, 12 Mar 2024 12:06:18 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 012B 52 KB
17 KB 34ms
33ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 7392
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 12 Mar 2024 08:06:18 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 23 Feb 2024 06:02:30 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2822, 6441
X-Served-By: cache-lga13626-LGA, cache-mia-kmia1760037-MIA
X-Timer: S1710230778.094324,VS0,VE0

GET
H/1.1 200
OK iframe Show response
sync.admanmedia.com/ Frame ADFC 3 KB
1 KB 220ms
70ms Document
text/html 8.2.110.26
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Requested by: Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.2.110.26 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 4e861c268fbc825f704d1d3a2840e3914b980d9b1096d63036178899a3c30527

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 12 Mar 2024 08:06:25 GMT
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3E46
Redirect Chain

https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEVWNFN0w0Qm9BQUJPbEo4eXZVdw&gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Csyn%2Csas%2Cpp%2Cshr&bee_sync_current_partner...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Csyn%2Csas%2Cpp%2Cshr&bee_sync_current_partner=adx&bee_sync_initiator=shr&bee_sync_hop_count=1
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADUcE7L4BoAABOlJ8yvUw&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Csas%2Cpp%2Cshr&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
https://sync.technoratimedia.com/services?uid=AADUcE7L4BoAABOlJ8yvUw&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cshr%26bee_sync_current_part...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cshr&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3
https://rtb-csync.smartadserver.com/redir?partneruserid=AADUcE7L4BoAABOlJ8yvUw&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cshr%26bee_sync_curr...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cshr&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=3251992762847553212
https://bh.contextweb.com/bh/rtset?ev=AADUcE7L4BoAABOlJ8yvUw&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D3251992762847553212%26bee_sync_partners%3Dshr%26bee_syn...
https://match.prod.bidr.io/cookie-sync?userid=3251992762847553212&bee_sync_partners=shr&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=5&ev=AADUcE7L4BoAABOlJ8yvUw&pid=558502&...
https://match.sharethrough.com/sync/v1?source_id=vyXkw8rSq3j4JmKvTgxR3x1c&source_user_id=AADUcE7L4BoAABOlJ8yvUw

68 B
279 B

59ms
58ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=vyXkw8rSq3j4JmKvTgxR3x1c&source_user_id=AADUcE7L4BoAABOlJ8yvUw
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=vyXkw8rSq3j4JmKvTgxR3x1c&source_user_id=AADUcE7L4BoAABOlJ8yvUw
Date: Tue, 12 Mar 2024 08:06:19 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3E46
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=3251992762847553212&gdpr=0&gdpr_consent=

68 B
279 B

60ms
60ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=3251992762847553212&gdpr=0&gdpr_consent=
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=3251992762847553212&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3E46
Redirect Chain

https://stx-match.dotomi.com/match/bounce/current?networkId=44410&version=1&nuid=ba07feb4-181a-480a-a737-b532c2f97406&gdpr=0&gdpr_consent=
https://stx-match.dotomi.com/match/bounce/current?DotomiTest=22dc731c0163045e&is_secure=true&networkId=44410&version=1&nuid=ba07feb4-181a-480a-a737-b532c2f97406&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=XXFNqX2gk1rVb6Jw3xJ26afL&source_user_id=AAAMbGp1m8FdpgN6qEDbAAAAAAA&expiration=1710317178&nuid=ba07feb4-181a-480a-a737-b532c2f97406&is_secure=true&g...

68 B
279 B

60ms
58ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=XXFNqX2gk1rVb6Jw3xJ26afL&source_user_id=AAAMbGp1m8FdpgN6qEDbAAAAAAA&expiration=1710317178&nuid=ba07feb4-181a-480a-a737-b532c2f97406&is_secure=true&gdpr_consent=&gdpr=0
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://match.sharethrough.com/sync/v1?source_id=XXFNqX2gk1rVb6Jw3xJ26afL&source_user_id=AAAMbGp1m8FdpgN6qEDbAAAAAAA&expiration=1710317178&nuid=ba07feb4-181a-480a-a737-b532c2f97406&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3E46
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7345385260132989076&gdpr=0&gdpr_consent=

43 B
448 B

58ms
57ms

Image
image/gif

216.22.16.40
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7345385260132989076&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.40 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:17 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7345385260132989076&gdpr=0&gdpr_consent=
Date: Tue, 12 Mar 2024 08:06:18 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3E46
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=

68 B
279 B

60ms
58ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:18 GMT
server: Kestrel
content-length: 323

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3E46
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=

43 B
425 B

173ms
57ms

Image
image/gif

216.22.16.40
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.40 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:17 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:18 GMT
server: Kestrel
content-length: 299

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3E46
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558357&ev=1&rurl=https%3a%2f%2fmatch.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&source_user_id=%%VGUID%%
https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&ev=1&source_user_id=KsY5oYrrfYT0&pid=558357

68 B
279 B

61ms
61ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&ev=1&source_user_id=KsY5oYrrfYT0&pid=558357
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&ev=1&source_user_id=KsY5oYrrfYT0&pid=558357
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5fddfb9bb8-phrqp
expires: -1

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3E46
Redirect Chain

https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/smartadserver?zcc=1&cb=1710230777006
https://ad.turn.com/r/cs?pid=45&rndcb=8546561618
https://sync.1rx.io/usersync/turn/7606574748126567586?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-e918c4b3-5...
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005

43 B
523 B

62ms
56ms

Image
image/gif

216.22.16.40
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005
Protocol: HTTP/1.1
Server: 216.22.16.40 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005
date: Tue, 12 Mar 2024 08:06:19 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXe918c4b356b14a679d381bd043111e3a005
content-type: text/html

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3E46
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=9de3421c-94ae-4b14-ae41-c7179f33521e&gdpr=0&gdpr_consent=

43 B
425 B

113ms
58ms

Image
image/gif

216.22.16.40
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=9de3421c-94ae-4b14-ae41-c7179f33521e&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.40 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:17 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=9de3421c-94ae-4b14-ae41-c7179f33521e&gdpr=0&gdpr_consent=
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1108836
content-length: 0
expires: Tue, 12 Mar 2024 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3E46
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1294&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1294&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=45425327371528386&gdpr=0&gdpr_consent=

68 B
279 B

65ms
57ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=45425327371528386&gdpr=0&gdpr_consent=
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=45425327371528386&gdpr=0&gdpr_consent=
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 5691 40 KB
11 KB 95ms
94ms Script
text/html 23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 11e0c063fa11fdd7b2e65c785f23baf9ca645f50fcdda383f35e8aad843832f4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Mar 2024 07:41:34 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84920
Connection: keep-alive
Content-Length: 10988
Expires: Wed, 13 Mar 2024 07:41:38 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 012B 0
916 B 79ms
78ms Script
text/html 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

server-18-164-96-6.jfk50.r.cloudfront.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
an-x-request-uuid: e0c695af-92ab-4aa7-a0ba-1e2b5d631ad4
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%26ttl%3D720%26uid%3D48d5713d5c563cba2049f505b2d944b6%26vis...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=1987333370989452357&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

49 B
208 B

64ms
60ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=1987333370989452357&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
an-x-request-uuid: 0c013d73-0dc0-4b6e-864b-dffa227c2d79
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=1987333370989452357&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%2B-%2BBanner%26ttl%3D720%26uid%3D75d56568a11564bfb79a01d2f...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=1987333370989452357&gdpr=0&gdpr_consent=&gdpr=0&gdpr_c...

49 B
180 B

64ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=1987333370989452357&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
an-x-request-uuid: 973f9f92-0a73-4f92-92c5-9a7246d5dbdb
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=1987333370989452357&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=70&p=120&cp=adyoulike&cu=1&url=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fis_cookie_sync_uid%3Dtrue%26uid%3D4246a50e6cf42e85f26c381a4b7701fb%2...
https://visitor.omnitagjs.com/visitor/sync?is_cookie_sync_uid=true&uid=4246a50e6cf42e85f26c381a4b7701fb&name=CRITEO&visitor=9de3421c-94ae-4b14-ae41-c7179f33521e

49 B
177 B

68ms
67ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?is_cookie_sync_uid=true&uid=4246a50e6cf42e85f26c381a4b7701fb&name=CRITEO&visitor=9de3421c-94ae-4b14-ae41-c7179f33521e

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://visitor.omnitagjs.com/visitor/sync?is_cookie_sync_uid=true&uid=4246a50e6cf42e85f26c381a4b7701fb&name=CRITEO&visitor=9de3421c-94ae-4b14-ae41-c7179f33521e
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 796050
content-length: 0
expires: Tue, 12 Mar 2024 00:00:00 GMT

GET
H2 204 ayl_pixel
api-2-0.spot.im/pixels/ Frame A673 0
458 B 216ms
69ms Image
text/plain 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://api-2-0.spot.im/pixels/ayl_pixel?ayl_id=c425f07c00f1509151429b5cd9460220

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; img-src 'self'; script-src-elem connect.facebook.net; style-src-elem 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; report-uri https://o294277.ingest.sentry.io/api/4505425533272064/security/?sentry_key=f16f012f16c94b179d820f4d5e9c39ff
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
via: 1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
content-security-policy: default-src 'none'; img-src 'self'; script-src-elem connect.facebook.net; style-src-elem 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; report-uri https://o294277.ingest.sentry.io/api/4505425533272064/security/?sentry_key=f16f012f16c94b179d820f4d5e9c39ff
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-amz-cf-id: abz0LfuRIpEcvJSItqpBAGYs7MSTLGSPP1zBJ7DQHHaSjkO8_by9Xg==
x-cache: Miss from cloudfront

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=KN-tvl53r1LdBusVOHbSqnY-OgFINFU9jLpixHvmcpo&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1

49 B
177 B

78ms
64ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=KN-tvl53r1LdBusVOHbSqnY-OgFINFU9jLpixHvmcpo&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=KN-tvl53r1LdBusVOHbSqnY-OgFINFU9jLpixHvmcpo&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT, Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://x.bidswitch.net/sync?ssp=adyoulike&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=adyoulike&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=adyoulike&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=adyoulike&gdpr=0&user_id=Yfnih2ev4tZ6qOaHYqqpjjSuttZ6-7XVbvjUT_r7
https://visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=0b5b6457-daab-412b-9a22-4fc8cddb8b43&name=BIDSWITCH&gdpr=0&gdpr_consent=

49 B
177 B

67ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=0b5b6457-daab-412b-9a22-4fc8cddb8b43&name=BIDSWITCH&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

Location: //visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=0b5b6457-daab-412b-9a22-4fc8cddb8b43&name=BIDSWITCH&gdpr=0&gdpr_consent=
Date: Tue, 12 Mar 2024 08:06:18 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent=
https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=50b14d87-5347-4d9e-be83-599baad62bba&name=THE_TRADE_DESK

49 B
177 B

65ms
64ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=50b14d87-5347-4d9e-be83-599baad62bba&name=THE_TRADE_DESK

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=50b14d87-5347-4d9e-be83-599baad62bba&name=THE_TRADE_DESK
date: Tue, 12 Mar 2024 08:06:18 GMT
server: Kestrel
content-length: 319

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://match.prod.bidr.io/cookie-sync/aul
https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AADUcE7L4BoAABOlJ8yvUw&name=BEESWAX

49 B
177 B

66ms
65ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AADUcE7L4BoAABOlJ8yvUw&name=BEESWAX

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AADUcE7L4BoAABOlJ8yvUw&name=BEESWAX
Date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://csync.loopme.me/?pubid=11480&redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3D68c72dd412a8d0f3f6d2276db2509939%26name%3DLOOPME%26visitor%3D%7Bdevice_id%7D%0A&gdpr=0&gdp...
https://visitor.omnitagjs.com/visitor/sync?uid=68c72dd412a8d0f3f6d2276db2509939&name=LOOPME&visitor=ef948574-0b54-49b9-b35f-cf926b4f43af%20&gdpr_consent=null&gdpr=0

49 B
177 B

64ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=68c72dd412a8d0f3f6d2276db2509939&name=LOOPME&visitor=ef948574-0b54-49b9-b35f-cf926b4f43af%20&gdpr_consent=null&gdpr=0

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=68c72dd412a8d0f3f6d2276db2509939&name=LOOPME&visitor=ef948574-0b54-49b9-b35f-cf926b4f43af &gdpr_consent=null&gdpr=0
date: Tue, 12 Mar 2024 08:06:18 GMT
server: _
content-length: 0

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_NATIVE_1_2%26ttl%3D720%26uid%3Df2d9136cf53dede7f83ba16171a37fdd%26visit...
https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_NATIVE_1_2%26ttl%3D720%26uid%3Df2d9136cf53dede7f83ba16171a37fdd%26visit...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=0TOOuqSng3-r_l-fWEMj&gdpr=0&gdpr_consent=&gdpr=0

49 B
177 B

69ms
59ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=0TOOuqSng3-r_l-fWEMj&gdpr=0&gdpr_consent=&gdpr=0

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:18 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: text/html; charset=utf-8
Location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=0TOOuqSng3-r_l-fWEMj&gdpr=0&gdpr_consent=&gdpr=0
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 221
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3...
https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=0TOOuqSng3-r_l-fWEMj&gdpr=0&gdpr_consent=&gdpr=0

49 B
177 B

68ms
60ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=0TOOuqSng3-r_l-fWEMj&gdpr=0&gdpr_consent=&gdpr=0

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:18 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: text/html; charset=utf-8
Location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=0TOOuqSng3-r_l-fWEMj&gdpr=0&gdpr_consent=&gdpr=0
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 217
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame A673
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%...
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=6174173dceb045e&is_secure=true&networkId=17100&version=1&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABc6PytV83iAMUVm_wAAAAAAA&expiration=1710317179&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&...

42 B
294 B

68ms
57ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABc6PytV83iAMUVm_wAAAAAAA&expiration=1710317179&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:19 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABc6PytV83iAMUVm_wAAAAAAA&expiration=1710317179&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://sync.adotmob.com/cookie/adyoulike?r=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADOTMOB%26ttl%3D720%26uid%3Db989ee06df7dfc250798f7f0dfc4ddee%26visitor%3D%7Bamob_user...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=0a432204001dfcbaf33823e1&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent=

49 B
177 B

62ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=0a432204001dfcbaf33823e1&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=0a432204001dfcbaf33823e1&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent=
date: Tue, 12 Mar 2024 08:06:18 GMT
access-control-allow-credentials: true
x-powered-by: Express
keep-alive: timeout=5
vary: Origin
content-length: 0

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=33&gdpr=0&gdpr_consent=
https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-e2c14bf6-0973-54c5-60a7-0af8aa8bb0dc$ip$38.132.118.72&name=STACKADAPT&gdpr=0&gdpr_consent=

49 B
177 B

75ms
62ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-e2c14bf6-0973-54c5-60a7-0af8aa8bb0dc$ip$38.132.118.72&name=STACKADAPT&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

Location: https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-e2c14bf6-0973-54c5-60a7-0af8aa8bb0dc$ip$38.132.118.72&name=STACKADAPT&gdpr=0&gdpr_consent=
Date: Tue, 12 Mar 2024 08:06:18 GMT
Connection: keep-alive
Content-Length: 219
Content-Type: text/html; charset=utf-8

GET
H2 200 sync-iframe
cs-server-s2s.yellowblue.io/ Frame A673 0
0 255ms
78ms Image
text/html 54.82.57.110
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DRISE_CODES%26ttl%3D720%26uid%3D48b439bcf2930e6408d6e795f7f1cdd2%26visitor%3D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.82.57.110 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-57-110.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://jadserve.postrelease.com/suid/101967?ntv_r=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DNATIVO%26ttl%3D720%26uid%3D0544850a0778385701c6899403bef718%26visitor%3DNTV_US...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=cd344e64-011b-4300-aa59-e29b8cd7bb3d&gdpr=0&gdpr_consent=

49 B
177 B

74ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=cd344e64-011b-4300-aa59-e29b8cd7bb3d&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
server: nginx
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=cd344e64-011b-4300-aa59-e29b8cd7bb3d&gdpr=0&gdpr_consent=
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 204 pixel
ap.lijit.com/ Frame A673 0
174 B 64ms
59ms Image
text/plain 54.146.199.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSOVRN%26ttl%3D720%26uid%3D4b30a0b1f289a261ab592e1e53c126eb%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.146.199.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-199-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 12 Mar 2024 08:06:18 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame A673
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=6b2595d5-cf4e-4298-a4ac-bcc34433eaad&secure=1&gdpr=0&gdpr_consent=
https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=457e9071-c1c9-49ab-bde5-2f1131825b6f&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}

49 B
177 B

67ms
63ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=457e9071-c1c9-49ab-bde5-2f1131825b6f&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

x-servername: Track002-iad
pragma: no-cache
date: Tue, 12 Mar 2024 08:05:15 GMT
strict-transport-security: max-age=31536000;
content-type: text/html; charset=utf-8
location: https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=457e9071-c1c9-49ab-bde5-2f1131825b6f&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
cache-control: private,no-cache
content-length: 315
expires: -1

GET
H2 200 711333.gif
id.rlcdn.com/ Frame A673 42 B
308 B 98ms
72ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711333.gif?&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

200

/
sync.richaudience.com/74889303289e27f327ad0c6de7be7264/ Frame ADFC
Redirect Chain

https://x.bidswitch.net/sync?ssp=adman&user_id=8ae26607-09e2-4c22-b23a-6c0a54053cb2&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
https://x.bidswitch.net/ul_cb/sync?ssp=adman&user_id=8ae26607-09e2-4c22-b23a-6c0a54053cb2&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=0b5b6457-daab-412b-9a22-4fc8cddb8b43&ssp=adman&gdpr=&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10593803339280776124&ssp=adman&gdpr=&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10593803339280776124&ssp=adman&gdpr=&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=adman
https://x.bidswitch.net/sync?dsp_id=419&user_id=10593803339280776124&ssp=adman&gdpr=&gdpr_consent=
https://sync.admanmedia.com/bidswitch.gif?puid=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=&gdpr_consent=
https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=sZn9xIbZzF&consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2F71da423e3fcc7c87e88ac913d505141d.gif%3Fpuid%3D[PDID]
https://sync.admanmedia.com/71da423e3fcc7c87e88ac913d505141d.gif?puid=2d2ec731-2eb2-4f9e-94b8-1zz1710230746
https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2Fmm.gif%3Fpuid%3D[PDID]

0
0

165ms
164ms

Image
text/html

162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2Fmm.gif%3Fpuid%3D[PDID]
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:27 GMT
Server: nginx/1.18.0 (Ubuntu)
Location: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2Fmm.gif%3Fpuid%3D[PDID]
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

/
sync.richaudience.com/74889303289e27f327ad0c6de7be7264/ Frame ADFC
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.admanmedia.com%2Fappnexus.gif%3Fpuid%3D%24UID%26gdpr%3D[GDPR]%26gdpr_consent%3D[GDPR_CONSENT]
https://sync.admanmedia.com/appnexus.gif?puid=1987333370989452357&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
https://match.adsrvr.org/track/cmf/generic?ttd_pid=digqd7p&ttd_tpi=1&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
https://sync.admanmedia.com/ttd.gif?puid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=
https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2Fmm.gif%3Fpuid%3D[PDID]

95 B
177 B

174ms
164ms

Image
image/png

162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2Fmm.gif%3Fpuid%3D[PDID]
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:05:50 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:25 GMT
Server: nginx/1.18.0 (Ubuntu)
Location: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2Fmm.gif%3Fpuid%3D[PDID]
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

/
sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/ Frame ADFC
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=digqd7p&ttd_tpi=1&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
https://sync.admanmedia.com/ttd.gif?puid=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?referrer=[PAGE]&consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2F5adaebfbb9dfe4ba75269cf62a4503e8.gif%3Fpuid%3D[PDID]
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsync.richaudience.com%2F1a12a024f8f9561c49164bbaf87ed164%2F%3Fgdpr%3D0%26euconsent%3D%5BGDPR_CONSENT%5D%26uid%3D[sas_uid]&gdpr=0&gdpr_consent...
https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?gdpr=0&euconsent=[GDPR_CONSENT]&uid=3251992762847553212

95 B
365 B

176ms
158ms

Image
image/png

162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?gdpr=0&euconsent=[GDPR_CONSENT]&uid=3251992762847553212
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/png
date: Tue, 12 Mar 2024 08:05:50 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Redirect headers

location: https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?gdpr=0&euconsent=[GDPR_CONSENT]&uid=3251992762847553212
date: Tue, 12 Mar 2024 08:06:18 GMT
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame ADFC
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=157362&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D157362%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync.admanmedia.com%252Fpub.gif%2...
https://image8.pubmatic.com/AdServer/ImgSync?p=157362&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D157362%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync.admanmedia.com%252Fpub.gif%2...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=2b539c3cc78d07c9&is_secure=true&networkId=17100&version=1&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMfAw8i16MfgMZg7vGAAAAAAA&expiration=1710317178&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&...

42 B
295 B

70ms
56ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMfAw8i16MfgMZg7vGAAAAAAA&expiration=1710317178&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&is_secure=true&gdpr_consent=&gdpr=-1
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:17 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMfAw8i16MfgMZg7vGAAAAAAA&expiration=1710317178&nuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&is_secure=true&gdpr_consent=&gdpr=-1
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1 204
No Content tum
ums.acuityplatform.com/ Frame ADFC 0
27 B 230ms
61ms Image
text/plain 69.90.254.78
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ums.acuityplatform.com/tum?umid=134&uid=8ae26607-09e2-4c22-b23a-6c0a54053cb2
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.90.254.78 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame ADFC
Redirect Chain

https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=sZn9xIbZzF&consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2F71da423e3fcc7c87e88ac913d505141d.gif%3Fpuid%3D[PDID]
https://sync.admanmedia.com/71da423e3fcc7c87e88ac913d505141d.gif?puid=2d2ec731-2eb2-4f9e-94b8-1zz1710230746
https://idsync.rlcdn.com/711169.gif?partner_uid=8ae26607-09e2-4c22-b23a-6c0a54053cb2&ct=4&cv=[GDPR_CONSENT]
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=d99fda40-013f-461e-910f-1533976382c7

42 B
60 B

70ms
70ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=d99fda40-013f-461e-910f-1533976382c7
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Tue, 12 Mar 2024 08:06:19 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=d99fda40-013f-461e-910f-1533976382c7
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame ADFC
Redirect Chain

https://cs.admanmedia.com/sync/admanmedia?puid=8ae26607-09e2-4c22-b23a-6c0a54053cb2&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&ccpa=[CCPA]&coppa=0
https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=8ae26607-09e2-4c22-b23a-6c0a54053cb2&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]

68 B
279 B

74ms
60ms

Image
image/png

18.214.14.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=8ae26607-09e2-4c22-b23a-6c0a54053cb2&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Server: 18.214.14.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-14-211.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:18 GMT
Server: nginx
Location: https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=8ae26607-09e2-4c22-b23a-6c0a54053cb2&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

db_sync
px.ads.linkedin.com/ Frame ADFC
Redirect Chain

https://idsync.rlcdn.com/711169.gif?partner_uid=8ae26607-09e2-4c22-b23a-6c0a54053cb2&ct=4&cv=[GDPR_CONSENT]
https://idsync.rlcdn.com/1000.gif?memo=CIG0KxIwCiwIARCnhAoaJDhhZTI2NjA3LTA5ZTItNGMyMi1iMjNhLTZjMGE1NDA1M2NiMhAAGg0I-pnArwYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=262fe8293bf4b25f87fa82ad2b401ba0efbb04e071be978b65d24064643cd4c2791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=262fe8293bf4b25f87fa82ad2b401ba0efbb04e071be978b65d24064643cd4c2791426b5417dce21&rand=04771696
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=262fe8293bf4b25f87fa82ad2b401ba0efbb04e071be978b65d24064643cd4c2791426b5417dce21&rand=04771696&expected_cookie=7069e4fc-62e0-44ba-b62c-d954e71d2991

0
142 B

140ms
126ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=262fe8293bf4b25f87fa82ad2b401ba0efbb04e071be978b65d24064643cd4c2791426b5417dce21&rand=04771696&expected_cookie=7069e4fc-62e0-44ba-b62c-d954e71d2991
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 9543890C666745AB9209C365B4E25F23 Ref B: MIAEDGE2712 Ref C: 2024-03-12T08:06:19Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYTciISnOD9HluT6FSRZw==

Redirect headers

date: Tue, 12 Mar 2024 08:06:18 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: CE3F0C90FA8B4B3E995B2E760B5CBCCB Ref B: MIAEDGE2712 Ref C: 2024-03-12T08:06:18Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: /db_sync?pid=10339&puuid=262fe8293bf4b25f87fa82ad2b401ba0efbb04e071be978b65d24064643cd4c2791426b5417dce21&rand=04771696&expected_cookie=7069e4fc-62e0-44ba-b62c-d954e71d2991
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYTciIQXZNvlzyeZMJzQA==

GET
H2 200 /
sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/ Frame ADFC 95 B
177 B 160ms
158ms Image
image/png 162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?referrer=[PAGE]&consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2F5adaebfbb9dfe4ba75269cf62a4503e8.gif%3Fpuid%3D[PDID]
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:05:50 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
content-type: image/png

GET
H/1.1

204
No Content

tum
ums.acuityplatform.com/ Frame ADFC
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=29&redirectUri=https%3A%2F%2Fsync.admanmedia.com%2F6ee87f33c866f2a98fb8fdaca65874d4.gif%3Fpuid%3D[ssb_sync_pid]%26gdpr%3D[GDPR]%26gdpr_consent%3D...
https://sync.admanmedia.com/6ee87f33c866f2a98fb8fdaca65874d4.gif?puid=3251992762847553212&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]
https://ums.acuityplatform.com/tum?umid=134&uid=8ae26607-09e2-4c22-b23a-6c0a54053cb2

0
27 B

65ms
61ms

Image
text/plain

69.90.254.78
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ums.acuityplatform.com/tum?umid=134&uid=8ae26607-09e2-4c22-b23a-6c0a54053cb2
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Server: 69.90.254.78 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:25 GMT
Server: nginx/1.18.0 (Ubuntu)
Location: https://ums.acuityplatform.com/tum?umid=134&uid=8ae26607-09e2-4c22-b23a-6c0a54053cb2
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2 200 /
sync.richaudience.com/74889303289e27f327ad0c6de7be7264/ Frame ADFC 95 B
177 B 160ms
159ms Image
image/png 162.55.233.29
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?consentString=[GDPR_CONSENT]&r=https%3A%2F%2Fsync.admanmedia.com%2Fmm.gif%3Fpuid%3D[PDID]
Requested by: Host: sync.admanmedia.com
URL: https://sync.admanmedia.com/iframe?pbjs=1&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.29.233.55.162.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.admanmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:05:50 GMT
server: nginx/1.14.1
x-powered-by: PHP/8.2.4
content-type: image/png

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame A505
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54...
https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26v...
https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26...

2 KB
3 KB

80ms
67ms

Document
text/html

67.202.105.31
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.31 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip31.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: b51253c928979dd7ed04b705fe5f64f3fbcbeac1fd6393d1fae558afc11c0284

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1886
content-type: text/html
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 0
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6756 2 KB
863 B 69ms
67ms Document
text/html 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip232.ip-51-222-239.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 6554
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=

281 B
554 B

73ms
72ms

Document
text/html

23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 12 Mar 2024 08:06:18 GMT
ETag: "20524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 12 Mar 2024 08:06:18 GMT
location: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
server: AkamaiGHost

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 3861 959 B
1 KB 408ms
106ms Document
text/html 23.83.76.69
LEASEWEB-USA-LAX

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.69 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software: /
Resource Hash: 92c37fd867001a0a1d8fd9b703476178003ee0414d5a70da9f638624d19ad2e5

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 959
content-type: text/html
date: Tue, 12 Mar 2024 08:06:17 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 33F5 17 KB
7 KB 162ms
43ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: sync.a-mo.net
URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=Cq0BShBkZS5jb3NtZXRpa3MubmV0UgthYXMtMDNmZjlkM1oIcGJhMS4zLjRqEGRlLmNvc21ldGlrcy5uZXT6AQY4LjMzLjDoAgGIA_aZwK8GqAM86gMkNjE4Y2M5MDQtOThkMS00MzlhLWFiOTYtMGI0OTg2NWE0MzljqgQDRENIsgUDVVNE6gUHZGVza3RvcPoFA255NaoHA3dlYsoHDWNvc21ldGlrcy5uZXTgBwE
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb24331a7e29e6c6ca7b1a724441ee7493341a4c4839b462126c4b5211a0abd8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
via: 1.1 d7db6b9cdf796f6ea0cdbe5b3a75c84a.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 284
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 27 Feb 2024 20:28:54 GMT
server: cloudflare
etag: W/"3c18296d733019efeee5c80831f8f3ee"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 863248bdcaa13713-MIA
x-amz-cf-id: y-Joel6CnmRbUUPIDhbM5OesmcDgZTKkKPO61AG5iUAsGZFa59Pcog==
expires: Tue, 12 Mar 2024 09:06:18 GMT

GET
H2 200 decode_consent.js Show response
static.smilewanted.com/js/decode_consent/ Frame 168F 48 KB
12 KB 63ms
46ms Script
application/javascript 2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.smilewanted.com/js/decode_consent/decode_consent.js

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://csync.smilewanted.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 1093503
x-xss-protection: 1; mode=block
referrer-policy: strict-origin
last-modified: Thu, 15 Apr 2021 17:11:55 GMT
server: cloudflare
etag: W/"607873db-c1ce"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 863248bd38e88dca-MIA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame FF25 2 KB
3 KB 222ms
75ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=48195506&p=156136&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 9d80d1fa49985d04bf91e3eaf0a1f26ad3d80dccea0db00580991589bcb93bd3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 215ms
65ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 202519
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 drop_cookie_sw.php Show response
csync.smilewanted.com/ Frame 7021 0
316 B 167ms
160ms Document
text/html 2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/drop_cookie_sw.php
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248bdb9388dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:18 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2

200

3251992762847553212 Show response
csync.smilewanted.com/set_partner_userid_get/smart/ Frame B41C
Redirect Chain

https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]
https://csync.smilewanted.com/set_partner_userid_get/smart/3251992762847553212

0
372 B

168ms
168ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/smart/3251992762847553212
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248bee9dc8dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:18 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

content-length: 0
date: Tue, 12 Mar 2024 08:06:18 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/smart/3251992762847553212

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 3E46 33 B
276 B 455ms
141ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

7fb2ebe530430492c696ab43fef5ea3fbf5c3b3944c54e765fc5b88b2c410d33

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin: https://de.cosmetiks.net
date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2

200

1987333370989452357 Show response
csync.smilewanted.com/set_partner_userid_get/appnexus/ Frame 37D7
Redirect Chain

https://secure.adnxs.com/getuid?https://csync.smilewanted.com/set_partner_userid_get/appnexus/$UID
https://csync.smilewanted.com/set_partner_userid_get/appnexus/1987333370989452357

0
385 B

188ms
164ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/appnexus/1987333370989452357
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248bee9d98dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:18 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 5307b99b-da2e-4374-9aa9-f5ec3dd7f1b8
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/appnexus/1987333370989452357
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 6554 40 KB
11 KB 96ms
85ms Script
text/html 23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 11e0c063fa11fdd7b2e65c785f23baf9ca645f50fcdda383f35e8aad843832f4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Mar 2024 07:41:34 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84920
Connection: keep-alive
Content-Length: 10988
Expires: Wed, 13 Mar 2024 07:41:38 GMT

GET
H2

200

LTO38VAL-1E-77AZ Show response
csync.smilewanted.com/set_partner_userid_get/rubicon/ Frame DD31
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent=
https://csync.smilewanted.com/set_partner_userid_get/rubicon/LTO38VAL-1E-77AZ?gdpr=0

0
386 B

172ms
166ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/rubicon/LTO38VAL-1E-77AZ?gdpr=0
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248bee9db8dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:18 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
Expires: 0
Location: https://csync.smilewanted.com/set_partner_userid_get/rubicon/LTO38VAL-1E-77AZ?gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
X-RPHost: c1df09169f58a071f2a391dff1b3307b
content-length: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C152 16 KB
6 KB 119ms
85ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c861dd92be984fe498ece34c0f3c921861ac51bfee50323fcae21231abf7a82b

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=71458
content-encoding: gzip
content-length: 5685
content-type: text/html
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: Wed, 13 Mar 2024 03:57:16 GMT
last-modified: Tue, 13 Feb 2024 04:57:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 527A 43 B
855 B 103ms
86ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 12 Mar 2024 08:06:18 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 6V6H440RZTDDQ3DQ89G3

GET
H2

204

CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame C0FC
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1987333370989452357&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=

0
0

203ms
54ms

Document
text/plain

44.197.3.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.197.3.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-197-3-66.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT

Redirect headers

content-length: 95
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:18 GMT
location: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame B12A
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?ev=AADUcE7L4BoAABOlJ8yvUw&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dsas%252Cpm%26be...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=pm&bee_sync_hop_count=1&ev=AADUcE7L4BoAABOlJ8yvUw&pid=558502&do...
https://rtb-csync.smartadserver.com/redir?partneruserid=AADUcE7L4BoAABOlJ8yvUw&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=pm&bee_sync_hop_count=2&userid=3251992762847553212&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADUcE7L4BoAABOlJ8yvUw&gdpr=0&gdpr_consent=

42 B
297 B

71ms
61ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADUcE7L4BoAABOlJ8yvUw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:19 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 12 Mar 2024 08:06:19 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADUcE7L4BoAABOlJ8yvUw&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame FF25
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=PbjmkVkvTs2DzL-R9_e8vw%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

77ms
69ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
content-encoding: gzip
last-modified: Tue, 13 Feb 2024 04:57:54 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=71458
accept-ranges: bytes
content-length: 5685
expires: Wed, 13 Mar 2024 03:57:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame FF25
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Daad7f838-49fe-454a-b9db-bd86dea9f137%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1987333370989452357&pt=aad7f838-49fe-454a-b9db-bd86dea9f137%2C%2C

95 B
124 B

55ms
52ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1987333370989452357&pt=aad7f838-49fe-454a-b9db-bd86dea9f137%2C%2C

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
an-x-request-uuid: 48ab9c1e-e6de-4acd-8c15-8be10638320a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1987333370989452357&pt=aad7f838-49fe-454a-b9db-bd86dea9f137%2C%2C
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 403 FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame FF25 0
0 213ms
63ms Image
text/html 40.76.134.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%203DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&rnd=RND
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame FF25
Redirect Chain

https://eb2.3lift.com/xuid?mid=7976&xuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&dongle=u6nf&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

37 B
474 B

70ms
57ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7976&xuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

204

CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame FF25
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=M0RCOEU2OTEtNTkyRi00RUNELTgzQ0MtQkY5MUY3RjdCQ0JG&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=

0
284 B

191ms
56ms

Image
text/plain

44.197.3.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Protocol: H2
Server: 44.197.3.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-197-3-66.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT

Redirect headers

location: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 95
content-type: text/html; charset=utf-8

GET
H2

204

CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame FF25
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDWpPsElBNz1QR073_Auxvc&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=

0
286 B

195ms
58ms

Image
text/plain

44.197.3.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Protocol: H2
Server: 44.197.3.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-197-3-66.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT

Redirect headers

location: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 95
content-type: text/html; charset=utf-8

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame FF25
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:671A20FE88FC4F52ABDF8387E6F2C43A
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://visitor-usa02.omnitagjs.com/visitor/sync?name=PUBMATIC&ttl=720&uid=2fe1084ffe44c28350116ec0a0a1c2d1&visitor=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=

49 B
177 B

69ms
59ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=PUBMATIC&ttl=720&uid=2fe1084ffe44c28350116ec0a0a1c2d1&visitor=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=PUBMATIC&ttl=720&uid=2fe1084ffe44c28350116ec0a0a1c2d1&visitor=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:19 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 216
content-type: text/html; charset=utf-8

GET
H2

204

CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame FF25
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=50b14d87-5347-4d9e-be83-599baad62bba&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=

0
284 B

178ms
57ms

Image
text/plain

44.197.3.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Protocol: H2
Server: 44.197.3.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-197-3-66.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT

Redirect headers

location: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 95
content-type: text/html; charset=utf-8

GET
H2 200 3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame FF25 43 B
601 B 78ms
70ms Image
image/gif 2600:1f18:4e9:5a01:2084:805e:851c:1774
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF?gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:2084:805e:851c:1774 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame FF25
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-RerOdQtE2uVaMinDLPmMRByMmNsZpmo-~A&gdpr=0

0
128 B

232ms
52ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-RerOdQtE2uVaMinDLPmMRByMmNsZpmo-~A&gdpr=0
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 18:27:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-RerOdQtE2uVaMinDLPmMRByMmNsZpmo-~A&gdpr=0
date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame FF25
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=7afd8105-bed7-4777-9f68-61b4c22bab1c&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=

0
284 B

183ms
59ms

Image
text/plain

44.197.3.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Protocol: H2
Server: 44.197.3.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-197-3-66.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT

Redirect headers

location: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 95
content-type: text/html; charset=utf-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 6554 7 B
790 B 82ms
61ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&khaos=LTO38VAL-1E-77AZ
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
Expires: 0

GET
H2 200 idl.js Show response
assets.a-mo.net/js/ Frame 33F5 3 KB
2 KB 42ms
41ms Script
application/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=de.cosmetiks.net&e=27&uid=e4e3f506-3b89-47e7-a499-a0402f551299
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8c49bc14e5b5041853d619fe2dc1b01b28bfd4974b8e732f13fa4943efaada3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
via: 1.1 dcaec0b05596b42ef5dab9e145ac961e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 5
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 02 Nov 2023 21:08:31 GMT
server: cloudflare
etag: W/"771a6a92588a8fb45e42a04fa3fe9ddd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600
cf-ray: 863248bfcb003713-MIA
x-amz-cf-id: nEJJO8_qp4CLe-E55h-kc_Yowk5ug-7kjBZZL9REobkh7PTyS9NQdQ==
expires: Tue, 12 Mar 2024 09:06:18 GMT

GET
H/1.1

200
OK

set Show response
id.a-mx.com/ Frame 33F5
Redirect Chain

https://id.a-mx.com/sync?tao=1&&do=de.cosmetiks.net
https://c3.a-mo.net/b?uid=e1d5095f-2b65-4020-a6c5-ee68eac489e7&sh=id.a-mx.com&
https://id.a-mx.com/set?oid=e1d5095f-2b65-4020-a6c5-ee68eac489e7&uid=e4e3f506-3b89-47e7-a499-a0402f551299&

99 B
606 B

63ms
60ms

Fetch
application/json

121.127.42.98
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/set?oid=e1d5095f-2b65-4020-a6c5-ee68eac489e7&uid=e4e3f506-3b89-47e7-a499-a0402f551299&
Protocol: HTTP/1.1
Server: 121.127.42.98 Ashburn, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: unn-121-127-42-98.datapacket.com
Software: /
Resource Hash: c813025912b3548712569f74ef08c5de3405523b88d58a66b75ae9addae5967d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin: null
date: Tue, 12 Mar 2024 08:06:18 GMT
access-control-allow-credentials: true
content-length: 99
content-type: application/json

Redirect headers

access-control-allow-origin: null
location: https://id.a-mx.com/set?oid=e1d5095f-2b65-4020-a6c5-ee68eac489e7&uid=e4e3f506-3b89-47e7-a499-a0402f551299&
date: Tue, 12 Mar 2024 08:06:18 GMT
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 4410
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-adaptmx
https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx

281 B
554 B

96ms
90ms

Document
text/html

23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://sync.a-mo.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 12 Mar 2024 08:06:19 GMT
ETag: "20524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 12 Mar 2024 08:06:18 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
server: AkamaiGHost

GET
H2

204

setuid
prebid.a-mo.net/ Frame 33F5
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=e4e3f506-3b89-47e7-a499-a0402f551299&gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=
https://sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=1---_e&ssp=adaptmx&bsw=0b5b6457-daab-412b-9a22-4fc8cddb8b43
https://sync-dmp.mobtrakk.com/match/bidswitch?id=%24%7Buser_id%7D&gdpr=0&consent=&usp=1---_e&ssp=adaptmx&bsw=0b5b6457-daab-412b-9a22-4fc8cddb8b43&chk=1
https://x.bidswitch.net/sync?dsp_id=457&user_id=YzdkOGM5ODQ5NjE2NGQ3&gdpr=0&gdpr_consent=&us_privacy=1---_e&ssp=adaptmx&bsw_param=0b5b6457-daab-412b-9a22-4fc8cddb8b43
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=0&gdpr_consent=&us_privacy=1---_e

0
113 B

67ms
65ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=0&gdpr_consent=&us_privacy=1---_e
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Location: //prebid.a-mo.net/setuid?bidder=bid_switch&uid=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=0&gdpr_consent=&us_privacy=1---_e
Date: Tue, 12 Mar 2024 08:06:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame 33F5
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?uid=e4e3f506-3b89-47e7-a499-a0402f551299
https://prebid.a-mo.net/setuid/yahoo?uid=y-jP3FhnJE2uGvp.gsibvkyGvFWsZbJU41hZxN95U-~A

0
138 B

74ms
64ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-jP3FhnJE2uGvp.gsibvkyGvFWsZbJU41hZxN95U-~A
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-jP3FhnJE2uGvp.gsibvkyGvFWsZbJU41hZxN95U-~A
date: Tue, 12 Mar 2024 08:06:18 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
sync.a-mo.net/ Frame 33F5
Redirect Chain

https://id.a-mx.com/u?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Damx_com%26uid%3D
https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=amx_com&uid=e4e3f506-3b89-47e7-a499-a0402f551299

0
111 B

81ms
67ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=amx_com&uid=e4e3f506-3b89-47e7-a499-a0402f551299
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=amx_com&uid=e4e3f506-3b89-47e7-a499-a0402f551299
date: Tue, 12 Mar 2024 08:06:18 GMT
content-length: 0

GET
H2

204

setuid
sync.a-mo.net/ Frame 33F5
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=1---_e&r=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Dopenx%26uid%3D%24%7BUID%7D
https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Dopenx%26uid%3D%24%7BUID%7D&us_privacy=1---_e&ox_sc=1
https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=openx&uid=b5872ae9-75e7-4397-a5fa-55d52fa32192

0
111 B

84ms
68ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=openx&uid=b5872ae9-75e7-4397-a5fa-55d52fa32192
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:19 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=openx&uid=b5872ae9-75e7-4397-a5fa-55d52fa32192
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 152

GET
H2

204

setuid
sync.a-mo.net/ Frame 33F5
Redirect Chain

https://cm.adform.net/cookie?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&redirect_url=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Dadform%26ui...
https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=adform&uid=45425327371528386

0
134 B

66ms
65ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=adform&uid=45425327371528386
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

date: Tue, 12 Mar 2024 08:06:19 GMT
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=adform&uid=45425327371528386
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0

GET
H2

204

setuid
sync.a-mo.net/ Frame 33F5
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&us_privacy=1---_e&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252...
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Dpubmatic%26uid%3D3DB8E691-592F-4ECD-83C...
https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=pubmatic&uid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF

0
111 B

69ms
68ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=pubmatic&uid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=pubmatic&uid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
date: Mon, 11 Mar 2024 18:34:38 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

setuid
sync.a-mo.net/ Frame 33F5
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=1---_e&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Dindex_rtb%2...
https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=index_rtb&uid=ZfAM9MAoJb4AAHtHAH5pUgAA%262929

0
111 B

69ms
67ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=index_rtb&uid=ZfAM9MAoJb4AAHtHAH5pUgAA%262929
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iT0N2PeRiy1nTFYyG2ks3YxwnztYnG3ZprkXHWmLGVbV%2BRVcFqGfscPDvGa9ss2TYT%2BtpvZUd1VFLlgSKSt4Q8dLaP0nnD0aAhJzQ3ub1IKEkZoI%2FSyAU69gz14Uis8uaYYXSj04"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=index_rtb&uid=ZfAM9MAoJb4AAHtHAH5pUgAA%262929
cache-control: no-cache
cf-ray: 863248c0088174a6-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 204 pixel
ap.lijit.com/ Frame 33F5 0
174 B 79ms
58ms Image
text/plain 54.146.199.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Dsovrn%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.146.199.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-199-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 12 Mar 2024 08:06:18 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H2

204

setuid
sync.a-mo.net/ Frame 33F5
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3De4e3f506-3b89-47e7-a499-a0402f551299%26bidder%3Dappnexus%26uid%3D%24UID
https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=appnexus&uid=1987333370989452357

0
123 B

74ms
66ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=appnexus&uid=1987333370989452357
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
an-x-request-uuid: 08360650-f840-4822-ad19-1635b65973c0
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://sync.a-mo.net/setuid?A=e4e3f506-3b89-47e7-a499-a0402f551299&bidder=appnexus&uid=1987333370989452357
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ow.pubmatic.com/ Frame 33F5 0
248 B 239ms
58ms Image
text/html 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=amx&uid=e4e3f506-3b89-47e7-a499-a0402f551299&do=de.cosmetiks.net
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
content-length: 0
content-type: text/html

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame 33F5 43 B
2 KB 86ms
67ms Image
image/gif 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=e4e3f506-3b89-47e7-a499-a0402f551299&do=de.cosmetiks.net

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
an-x-request-uuid: 814fc2ab-3b52-409b-b281-76942ce1ff25
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 server_match Show response
ice.360yield.com/ Frame 981E 43 B
198 B 84ms
62ms Document
image/gif 34.206.244.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.206.244.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-244-148.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
content-length: 43
content-type: image/gif
date: Tue, 12 Mar 2024 08:06:18 GMT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

291367b0-fc1d-4ee0-8803-522cd0444b6d Show response
csync.smilewanted.com/set_partner_userid_get/openx/ Frame 5B3F
Redirect Chain

https://u.openx.net/w/1.0/cm?id=158474f5-20ec-4fcc-8ba8-4c101c556b25&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fopenx%2F
https://u.openx.net/w/1.0/cm?cc=1&id=158474f5-20ec-4fcc-8ba8-4c101c556b25&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fopenx%2F
https://csync.smilewanted.com/set_partner_userid_get/openx/291367b0-fc1d-4ee0-8803-522cd0444b6d

0
621 B

166ms
165ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/openx/291367b0-fc1d-4ee0-8803-522cd0444b6d
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248c14ad48dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:19 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 0
content-type: text/html
date: Tue, 12 Mar 2024 08:06:19 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/openx/291367b0-fc1d-4ee0-8803-522cd0444b6d
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2

200

ITrmABZHnRSn9U8bRSmi6w7L Show response
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame CA3E
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
https://csync.smilewanted.com/set_partner_userid_get/sovrn/ITrmABZHnRSn9U8bRSmi6w7L

0
447 B

168ms
157ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/sovrn/ITrmABZHnRSn9U8bRSmi6w7L
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248c08a778dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:19 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Tue, 12 Mar 2024 08:06:18 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/sovrn/ITrmABZHnRSn9U8bRSmi6w7L

GET
H2 200 sync
visitor.omnitagjs.com/visitor/ Frame 3861 49 B
179 B 67ms
60ms Image
image/gif 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=3251992762847553212&name=SMARTADSERVER&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3861
Redirect Chain

https://sync.adotmob.com/cookie/smart?r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D66%26partneruserid%3D%7Bamob_user_id%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=0a43220400d0f3802fae0723&gdpr=0&gdpr_consent=

43 B
551 B

63ms
57ms

Image
image/gif

216.22.16.40
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=0a43220400d0f3802fae0723&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.40 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=0a43220400d0f3802fae0723&gdpr=0&gdpr_consent=
date: Tue, 12 Mar 2024 08:06:19 GMT
access-control-allow-credentials: true
x-powered-by: Express
keep-alive: timeout=5
vary: Origin
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3861
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzI1MTk5Mjc2Mjg0NzU1MzIxMg==&gdpr=0&gdpr_consent=

170 B
188 B

85ms
83ms

Image
image/png

142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzI1MTk5Mjc2Mjg0NzU1MzIxMg==&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=

Protocol

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzI1MTk5Mjc2Mjg0NzU1MzIxMg==&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET

ping_match.gif
pm.w55c.net/ Frame 3861
Redirect Chain

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent=
https://id5-sync.com/c/102/0/9/1.gif?gdpr=0&gdpr_consent=&us_privacy=
https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-d834MnCvUZ4utFh4ZSaGp_pb9reALmi7xyFlWSRvDA&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_...
https://id5-sync.com/c/102/102/8/2.gif?puid=3251992762847553212&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AADUcE7L4BoAABOlJ8yvUw&id5AccountNum=155&numCascadesAllowed=9
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=50b14d87-5347-4d9e-be83-599baad62bba&ttl=%%TTL%%
https://ib.adnxs.com/getuid?https://id5-sync.com/c/102/2/5/5.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/102/2/5/5.gif?puid=1987333370989452357&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F4%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F4%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/102/112/4/6.gif?puid=542DD60ED927D14D&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F3%2F7.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D
https://ps.eyeota.net/match/bounce/?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F3%2F7.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/102/123/3/7.gif?puid=18e31b2bd03-4d210000010a5fd4&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F10%2F2%2F8.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/102/10/2/8.gif?puid=45425327371528386&gdpr=0&gdpr_consent=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F1%2F9.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent=
https://id5-sync.com/c/102/104/1/9.gif?puid=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?st=ID5&rurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F163%2F0%2F10.gif%3Fpuid%3D_wfivefivec_%26gdpr%3D0%26gdpr_consent%3D

0
0

GET
H2

200

/
wt.rqtrk.eu/ Frame 3861
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=150&partneruserid=0&redirurl=https%3A%2F%2Fwt.rqtrk.eu%3Fpid%3D58a76248-f101-4e52-b8f7-c4de9362ea12%26src%3Dwww%26type%3D100%26sid%3D0%26...
https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=3251992762847553212&gdpr_pd=0&gdpr=0&gdpr_consent=

43 B
350 B

255ms
67ms

Image
image/gif

51.222.241.106
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=3251992762847553212&gdpr_pd=0&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol: H2
Server: 51.222.241.106 , Canada, ASN16276 (OVH, FR),
Reverse DNS: haproxy-ca-012.roqad.pl
Software: istio-envoy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:19 GMT
server: istio-envoy
p3p: CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
content-type: image/gif
cache-control: no-cache,private
x-envoy-upstream-service-time: 1
content-length: 43
expires: Tue, 12 Mar 2024 08:06:18 GMT

Redirect headers

location: https://wt.rqtrk.eu?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=3251992762847553212&gdpr_pd=0&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

200

45425327371528386 Show response
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 2B11
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
https://csync.smilewanted.com/set_partner_userid_get/adform/45425327371528386

0
459 B

161ms
157ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/adform/45425327371528386
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248c32c4f8dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:19 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
content-length: 0
date: Tue, 12 Mar 2024 08:06:19 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/adform/45425327371528386
server: nginx

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 6554
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=adyoulike&gdpr=0&gdpr_consent=&gdpr=0&khaos=LTO38VAL-1E-77AZ
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LTO38VAL-1E-77AZ&name=RUBICON&gdpr=0

49 B
200 B

62ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LTO38VAL-1E-77AZ&name=RUBICON&gdpr=0

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:19 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LTO38VAL-1E-77AZ&name=RUBICON&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 912cff0d4173a093b08c7658cc52c847
Expires: 0

GET
H2

200

79a2f1c8-1c94-4507-b9f1-5b1ea40fdf72 Show response
csync.smilewanted.com/set_partner_userid_get/adwmg/ Frame B383
Redirect Chain

https://us.shb-sync.com/d3cf52c0-fa89-45fb-83fa-f14d2af39226.gif?puid=[UID]&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadwmg%2F%5BUID%5D&gdpr=[GDPR]&gdpr_consent=[GDPR_CON...
https://csync.smilewanted.com/set_partner_userid_get/adwmg/79a2f1c8-1c94-4507-b9f1-5b1ea40fdf72

0
495 B

166ms
162ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/adwmg/79a2f1c8-1c94-4507-b9f1-5b1ea40fdf72
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248c1bb0e8dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:19 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Tue, 12 Mar 2024 08:06:19 GMT
Expires: 0
Location: https://csync.smilewanted.com/set_partner_userid_get/adwmg/79a2f1c8-1c94-4507-b9f1-5b1ea40fdf72
Pragma: no-cache
Server: nginx

GET
BLOB 200
OK 3904f279-6462-4034-bf57-013293e1b433
https://sync.a-mo.net/ Frame 33F5 177 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://sync.a-mo.net/3904f279-6462-4034-bf57-013293e1b433
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b37bcd7f9649cb43a766fdf64c6d4f86af863ab22d1a149a06d74d416080bd5c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Length: 177
Content-Type

GET
H2

200

e9513b27e3 Show response
csync.smilewanted.com/set_partner_userid_get/smaato/ Frame 1A5E
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=smile&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsmaato%2F%24UID
https://csync.smilewanted.com/set_partner_userid_get/smaato/e9513b27e3

0
448 B

163ms
162ms

Document
text/html

2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/smaato/e9513b27e3
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248c1db158dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:19 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

age: 53
cache-control: no-cache, must-revalidate
content-length: 0
date: Tue, 12 Mar 2024 08:05:26 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/smaato/e9513b27e3
server: CloudFront
via: 1.1 6f9ef5ae165c9835aa6935d9fb7e2072.cloudfront.net (CloudFront)
x-amz-cf-id: PFycCWDN0J5sxF-FFkKZU1EhmASuIePmRCHFHcDdRsuMfQZj6fCpnw==
x-amz-cf-pop: EWR53-P1
x-cache: Hit from cloudfront

POST
H2 200 673.json Show response
id5-sync.com/g/v2/ Frame 3E46 628 B
1 KB 333ms
149ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/673.json

Requested by

Host: static.sunmedia.tv
URL: https://static.sunmedia.tv/sdks/3p/prebid-js/0.3.0/sm-prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

f09c59f997712314c699182de38eec8c8af2aeec39512a13e3d7e9637f61e1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://de.cosmetiks.net
date: Tue, 12 Mar 2024 08:06:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin
content-type: application/json

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame ED5C
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1710230778941.2&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26predire...
https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

16 KB
6 KB

66ms
65ms

Document
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c861dd92be984fe498ece34c0f3c921861ac51bfee50323fcae21231abf7a82b

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=71457
content-encoding: gzip
content-length: 5685
content-type: text/html
date: Tue, 12 Mar 2024 08:06:19 GMT
expires: Wed, 13 Mar 2024 03:57:16 GMT
last-modified: Tue, 13 Feb 2024 04:57:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Tue, 12 Mar 2024 08:06:18 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP012
x-33x-status: 40000000008200000A

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 52DE
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

86ms
77ms

Document
text/html

23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 12 Mar 2024 08:06:19 GMT
ETag: "20524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 12 Mar 2024 08:06:19 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame A505
Redirect Chain

https://ssc-cms.33across.com/ps/?_=1710230778941.&ri=0015a00003HljHyAAJ&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26t...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=33ACROSS&ttl=720&uid=2f9442d7df2189f76c8b593d5f54ce95&visitor=212503519072140&gdpr=0&gdpr_consent=

49 B
177 B

69ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=33ACROSS&ttl=720&uid=2f9442d7df2189f76c8b593d5f54ce95&visitor=212503519072140&gdpr=0&gdpr_consent=

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
referrer-policy: unsafe-url
server: 33XP014
x-33x-status: 100000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=33ACROSS&ttl=720&uid=2f9442d7df2189f76c8b593d5f54ce95&visitor=212503519072140&gdpr=0&gdpr_consent=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame A505
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=50b14d87-5347-4d9e-be83-599baad62bba&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=0b5b6457-daab-412b-9a22-4fc8cddb8b43
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=0b5b6457-daab-412b-9a22-4fc8cddb8b43&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

60ms
59ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=0b5b6457-daab-412b-9a22-4fc8cddb8b43&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
referrer-policy: unsafe-url
server: 33XP017
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=0b5b6457-daab-412b-9a22-4fc8cddb8b43&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame A505
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-g.WulN1E2uHHwOFf5NiE0aWDBrsyDcTP~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-g.WulN1E2uHHwOFf5NiE0aWDBrsyDcTP%7EA&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

157ms
58ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-g.WulN1E2uHHwOFf5NiE0aWDBrsyDcTP%7EA&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-g.WulN1E2uHHwOFf5NiE0aWDBrsyDcTP%7EA&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame A505
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1710230778941.6&ri=90&ru=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253...
https://ib.adnxs.com/getuid?https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D90%26external_user_id%3D%24UID
https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=90&external_user_id=1987333370989452357

68 B
216 B

155ms
57ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=90&external_user_id=1987333370989452357
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:19 GMT
an-x-request-uuid: f93a9b7d-71ec-4949-b93f-85910c6479f0
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=90&external_user_id=1987333370989452357
x-proxy-origin: 38.132.118.72; 38.132.118.72; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame A505
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID
https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=2332154404910819626621
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=2332154404910819626621&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

159ms
59ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=2332154404910819626621&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:18 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=2332154404910819626621&ts=1710230779&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58771/ Frame 33F5 316 B
415 B 68ms
61ms XHR
application/json 3.225.218.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58771/fed?1p=0&gdpr=0&gdpr_consent=&us_privacy=&pixelId=58771&puid=e4e3f506-3b89-47e7-a499-a0402f551299

Requested by

Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=de.cosmetiks.net&e=27&uid=e4e3f506-3b89-47e7-a499-a0402f551299

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-218-10.compute-1.amazonaws.com

Software

ATS/9.1.10.94 /

Resource Hash

27bd54e28e9d2e7b546e0bbf1e8a7ff95739f1a920c7925545d49c098728945b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sync.a-mo.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://sync.a-mo.net
content-type: application/json
access-control-allow-credentials: true

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 4410 40 KB
11 KB 167ms
79ms Script
text/html 23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 11e0c063fa11fdd7b2e65c785f23baf9ca645f50fcdda383f35e8aad843832f4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:19 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Mar 2024 07:41:34 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84919
Connection: keep-alive
Content-Length: 10988
Expires: Wed, 13 Mar 2024 07:41:38 GMT

POST
H/1.1 204
No Content rum
id.rtb.mx/ Frame 33F5 0
476 B 207ms
60ms Ping
text/plain 121.127.42.98
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://id.rtb.mx/rum?
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 121.127.42.98 Ashburn, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: unn-121-127-42-98.datapacket.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.a-mo.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://sync.a-mo.net
date: Tue, 12 Mar 2024 08:06:18 GMT
access-control-allow-credentials: true

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 52DE 40 KB
11 KB 93ms
70ms Script
text/html 23.46.226.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.226.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-226-102.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 11e0c063fa11fdd7b2e65c785f23baf9ca645f50fcdda383f35e8aad843832f4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:19 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Mar 2024 07:41:34 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84919
Connection: keep-alive
Content-Length: 10988
Expires: Wed, 13 Mar 2024 07:41:38 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 4410 7 B
790 B 63ms
62ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=LTO38VAL-1E-77AZ
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: eea754ae2ea80a3b4eb2fcf35349058a
Expires: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 52DE 7 B
790 B 63ms
62ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=LTO38VAL-1E-77AZ
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
Expires: 0

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 4410
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&khaos=LTO38VAL-1E-77AZ
https://prebid.a-mo.net/setuid/magnite?uid=LTO38VAL-1E-77AZ

0
135 B

67ms
65ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LTO38VAL-1E-77AZ
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LTO38VAL-1E-77AZ
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
Expires: 0

GET
H2

200

match
events-ssc.33across.com/ Frame 52DE
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=LTO38VAL-1E-77AZ
https://ssc-cms.33across.com/ps/?xi=1&xu=LTO38VAL-1E-77AZ
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LTO38VAL-1E-77AZ&ts=1710230780&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

60ms
58ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LTO38VAL-1E-77AZ&ts=1710230780&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:20 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:19 GMT
referrer-policy: unsafe-url
server: 33XP020
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LTO38VAL-1E-77AZ&ts=1710230780&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c732a3fff5a49cd2b7c3227849c58fdc5bd887a48d7976cf3925d2d8168a6e6

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame FF25 0
128 B 99ms
60ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156136&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:20 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame FF25 2 KB
2 KB 65ms
63ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=28922776&p=156136&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 49f8605cc22d9a6aba0811404c220bb38ab74d8ee6055aac9c37cc2c2ccbc656

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 12 Mar 2024 08:06:20 GMT
content-length: 1874
content-type: text/html; charset=UTF-8

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7F8F
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=69dc4c8c-e047-11ee-b6f8-cbf6af1d924f

42 B
323 B

59ms
58ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=69dc4c8c-e047-11ee-b6f8-cbf6af1d924f
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 11 Mar 2024 17:52:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 0
content-type: image/gif
date: Tue, 12 Mar 2024 08:06:21 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=69dc4c8c-e047-11ee-b6f8-cbf6af1d924f
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 244D 0
338 B 228ms
57ms Document
image/gif 169.197.150.8

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 -, , ASN (),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: c

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 0F6A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
236 B

59ms
58ms

Document
image/png

151.101.130.49

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZfAM-QAAAktBIQBM
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 -, , ASN (),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760053-MIA
x-timer: S1710230782.783179,VS0,VE26

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Tue, 12 Mar 2024 08:06:21 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZfAM-QAAAktBIQBM
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760053-MIA
x-timer: S1710230782.722430,VS0,VE25

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame DDF3
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://r.bidswitch.net/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=0b5b6457-daab-412b-9a22-4fc8cddb8b43
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=0b5b6457-daab-412b-9a22-4fc8cddb8b43&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%...
https://dpm.demdex.net/ibs:dpid=540&dpuuid=aad7f838-49fe-454a-b9db-bd86dea9f137&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=540&dpuuid=aad7f838-49fe-454a-b9db-bd86dea9f137&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=42825698124411876324431173834509639337&pt=aad7f838-49fe-454a-b9db-bd86dea9f137%2Chttps%253A%252F%252Fx.bidswitch.net%252Fs...
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=pubmatic&bsw_param=0b5b6457-daab-412b-9a22-4fc8cddb8b43
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
246 B

60ms
58ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Tue, 12 Mar 2024 08:06:22 GMT
Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=0b5b6457-daab-412b-9a22-4fc8cddb8b43&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 038B
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=NA2NBDJbjVUvXIkEN17GDWFa2VUvD9pWOwxvmN_X

42 B
345 B

71ms
70ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=NA2NBDJbjVUvXIkEN17GDWFa2VUvD9pWOwxvmN_X
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Tue, 12 Mar 2024 08:06:21 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=NA2NBDJbjVUvXIkEN17GDWFa2VUvD9pWOwxvmN_X
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame CC0D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:24Ii4Zii1RJX9r5&gdpr=0&gdpr_consent=

42 B
298 B

60ms
59ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:24Ii4Zii1RJX9r5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Tue, 12 Mar 2024 08:06:21 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:24Ii4Zii1RJX9r5&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/v2.0.30-801-g0076fb7#rel-ec2-master i-0bca69a16b77b2452@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F30F
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=4sFL9glzVMVgpwr4qouw3CaEdkg&gdpr=0&gdpr_consent=

42 B
377 B

73ms
71ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=4sFL9glzVMVgpwr4qouw3CaEdkg&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Tue, 12 Mar 2024 08:06:21 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=4sFL9glzVMVgpwr4qouw3CaEdkg&gdpr=0&gdpr_consent=

GET
H2

200

insync
thrtle.com/ Frame FF25
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&vxii_pid=12&vxii_pid1=10067&vxii_rcid=53208ca3-c1be-48f8-a6b0-a6957d0758f3

43 B
294 B

69ms
62ms

Image
image/gif

54.236.220.85

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&vxii_pid=12&vxii_pid1=10067&vxii_rcid=53208ca3-c1be-48f8-a6b0-a6957d0758f3
Protocol: H2
Server: 54.236.220.85 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Tue, 12 Mar 2024 08:06:21 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&vxii_pid=12&vxii_pid1=10067&vxii_rcid=53208ca3-c1be-48f8-a6b0-a6957d0758f3
date: Tue, 12 Mar 2024 08:06:21 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame FF25 43 B
61 B 53ms
49ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 Martin
crb.kargo.com/api/v1/dsync/ Frame FF25 43 B
359 B 211ms
59ms Image
image/gif 34.237.39.192

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.39.192 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:21 GMT
x-accel-expires: 0
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame FF25 0
425 B 267ms
60ms Image
text/plain 52.71.140.242

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.140.242 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 12 Mar 2024 08:06:21 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame FF25
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33646_11240C742_83F89C&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

71ms
70ms

Image
image/gif

38.98.69.175

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Protocol

HTTP/1.1

Server

38.98.69.175 -, , ASN (),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-393235581; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:21 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-393235581; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Mon, 11 Mar 2024 18:31:49 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame FF25
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=8f6ab9f0-e047-4360-9cce-df1c97d86c47-65f00cfd-5553&gdpr=0&gdpr_consent=

42 B
467 B

58ms
57ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=8f6ab9f0-e047-4360-9cce-df1c97d86c47-65f00cfd-5553&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 11 Mar 2024 18:34:07 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:20 GMT
via: 1.1 google
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=8f6ab9f0-e047-4360-9cce-df1c97d86c47-65f00cfd-5553&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame FF25
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7606574748126567586&gdpr=0&gdpr_consent=&us_privacy=

1 B
220 B

68ms
67ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7606574748126567586&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:20 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7606574748126567586&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:21 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C152 2 KB
3 KB 64ms
63ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=40615865&p=158810&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 492b9e6a4e178eed704b7a772a02fc7c8d06a4597c2e65a31d8167067eac3321

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 4502
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=f9f1af37-3df1-46bf-a31f-588a5313bd57&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF

42 B
493 B

60ms
59ms

Document
image/gif

44.218.18.183

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.18.183 -, , ASN (),
Reverse DNS
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Tue, 12 Mar 2024 08:06:22 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Tue, 12 Mar 2024 08:06:22 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 1E6B
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314650103699788

42 B
273 B

60ms
59ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314650103699788
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 11 Mar 2024 17:52:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Tue, 12 Mar 2024 08:06:22 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314650103699788
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET pubmatic
ad.mrtnsvr.com/sync/ Frame C871 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9735
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
95 B

58ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Tue, 12 Mar 2024 08:06:21 GMT
expires: Tue, 12 Mar 2024 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 1144963
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame FA85
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
428 B

142ms
114ms

Document
image/gif

2606:4700::6812:19ad

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 863248d56e0d5c7f-MIA
content-length: 43
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:22 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 863248d48dac5c7f-MIA
content-type: text/html
date: Tue, 12 Mar 2024 08:06:22 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 42

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 40D9
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0

0
93 B

65ms
63ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Tue, 12 Mar 2024 08:06:22 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
server: _

GET
H/1.1 204
No Content tum
ums.acuityplatform.com/ Frame 45F5 0
0 71ms
64ms Document
text/plain 69.90.254.78
COGECO-PEER1

General

Check archive.org

Show headers Download Go to

Full URL: https://ums.acuityplatform.com/tum?umid=6
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.90.254.78 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame DA33
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU78dcf35f963549f5a6e2d767624b9411

42 B
280 B

63ms
60ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU78dcf35f963549f5a6e2d767624b9411
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:22 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU78dcf35f963549f5a6e2d767624b9411
pragma: no-cache
server: nginx

GET
H2 200 3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF Show response
csync.smilewanted.com/set_partner_userid_get/pubmatic/ Frame 6DAD 0
551 B 170ms
166ms Document
text/html 2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/pubmatic/3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248d40c538dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:22 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame C152 0
200 B 217ms
60ms Image
text/plain 18.238.55.69

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.69 -, , ASN (),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:22 GMT
via: 1.1 28fca7284ad6e07382ad05b79a20cd6a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK52-P4
content-length: 0
x-amz-cf-id: dr8BtHPc2mv0u6DXCLcFlsv59xpOVUARDZOR7I0PCnf3MsOydR3_xQ==
x-cache: Error from cloudfront

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame C152
Redirect Chain

https://idsync.rlcdn.com/712188.gif?partner_uid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=d99fda40-013f-461e-910f-1533976382c7

42 B
60 B

71ms
70ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=d99fda40-013f-461e-910f-1533976382c7
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:22 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Tue, 12 Mar 2024 08:06:22 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=d99fda40-013f-461e-910f-1533976382c7
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF/gdpr=0/ Frame C152 49 B
265 B 85ms
68ms Image
image/gif 52.203.57.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF/gdpr=0/gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.57.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-57-111.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:22 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.51.179
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame C152 95 B
124 B 52ms
50ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame C152
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=KN-tvl53r1LdBusVOHbSqnY-OgFINFU9jLpixHvmcpo&pi=pubmatic&gdpr=0&gdpr_consent=

42 B
446 B

58ms
57ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=KN-tvl53r1LdBusVOHbSqnY-OgFINFU9jLpixHvmcpo&pi=pubmatic&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 11 Mar 2024 18:31:24 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=KN-tvl53r1LdBusVOHbSqnY-OgFINFU9jLpixHvmcpo&pi=pubmatic&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 12 Mar 2024 08:06:22 GMT, Tue, 12 Mar 2024 08:06:22 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame C152
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=45425327371528386

42 B
318 B

61ms
59ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=45425327371528386
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 11 Mar 2024 18:15:30 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=45425327371528386
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame ED5C 2 KB
3 KB 67ms
66ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=17724107&p=156423&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 979bd7d928a4d54341b2a31949f09a18fa531a97a781c98f05d1da2a382fcbaa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 4140
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1474501188
https://sync.1rx.io/usersync/tradedesk/50b14d87-5347-4d9e-be83-599baad62bba
https://sync.targeting.unrulymedia.com/csync/RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005

42 B
378 B

61ms
59ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-type: text/html
date: Tue, 12 Mar 2024 08:06:23 GMT
etag: RXe918c4b356b14a679d381bd043111e3a005
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-e918c4b3-56b1-4a67-9d38-1bd043111e3a-005
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 7F27
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=lTjrR3fMC2uwleaR_gzwZQ

42 B
307 B

58ms
55ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=lTjrR3fMC2uwleaR_gzwZQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 11 Mar 2024 18:34:08 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:22 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=lTjrR3fMC2uwleaR_gzwZQ
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B671
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:d15c65f0-0cfe-4000-9caf-ae481b43d351&gdpr=0&gdpr_consent=

42 B
289 B

60ms
58ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:d15c65f0-0cfe-4000-9caf-ae481b43d351&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 11 Mar 2024 18:15:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 12 Mar 2024 08:06:22 GMT
Expires: Tue, 12 Mar 2024 08:06:21 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1549 cea2cde master ord ord-pixel-x28 config_version:"828"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:d15c65f0-0cfe-4000-9caf-ae481b43d351&gdpr=0&gdpr_consent=

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 2DD6 43 B
360 B 174ms
70ms Document
image/gif 35.186.193.173

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 -, , ASN (),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Tue, 12 Mar 2024 08:06:22 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 674F 43 B
285 B 859ms
216ms Document
image/gif 195.5.165.20

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Tue, 12 Mar 2024 08:06:23 GMT
Vary: Accept-Encoding
X-adserver-worker: leviathan-7f538048e4d5@version_1.6.0-pre8
X-core-time: 1ms
X-server-arch: v2

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame F077 0
0 455ms
150ms Document
text/plain 23.88.86.2

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.88.86.2 -, , ASN (),

Reverse DNS

Software

nginx/1.23.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Date: Tue, 12 Mar 2024 08:06:22 GMT
Server: nginx/1.23.1
Strict-Transport-Security: max-age=15768000

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F665
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:671A20FE88FC4F52ABDF8387E6F2C43A&gdpr=0&gdpr_consent=

1 B
53 B

62ms
59ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:671A20FE88FC4F52ABDF8387E6F2C43A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Tue, 12 Mar 2024 08:06:22 GMT
expires: Mon, 11 Mar 2024 08:06:22 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:671A20FE88FC4F52ABDF8387E6F2C43A&gdpr=0&gdpr_consent=
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B8BC
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7635171821357415279&uid=Q763517182135741...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7635171821357415279

42 B
95 B

58ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7635171821357415279
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=15655
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Tue, 12 Mar 2024 08:06:22 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7635171821357415279
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H3 200 match Show response
events-ssc.33across.com/ Frame 7F4F 68 B
82 B 62ms
61ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Tue, 12 Mar 2024 08:06:22 GMT
via: 1.1 google

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame ED5C 43 B
109 B 247ms
101ms Image
image/gif 34.195.193.82

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=20909&user_id=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.193.82 -, , ASN (),
Reverse DNS
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:22 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame ED5C
Redirect Chain

https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&_li_chk=true&previous_uuid=4e4a4b12cf7a460d8a321f57644bc480
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=50b14d87-5347-4d9e-be83-599baad62bba
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=50b14d87-5347-4d9e-be83-599baad62bba

43 B
548 B

274ms
60ms

Image
image/gif

2600:1f18:ed:550a:8ff3:6b7a:9a75:7879

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=50b14d87-5347-4d9e-be83-599baad62bba

Protocol

HTTP/1.1

Server

2600:1f18:ed:550a:8ff3:6b7a:9a75:7879 -, , ASN (),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:23 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 0
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=50b14d87-5347-4d9e-be83-599baad62bba
Date: Tue, 12 Mar 2024 08:06:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 0

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame ED5C 49 B
265 B 93ms
70ms Image
image/gif 52.203.57.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.57.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-57-111.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:22 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.55.171
content-length: 49
expires: 0

GET
H/1.1

204
No Content

/
io.narrative.io/ Frame ED5C
Redirect Chain

https://io.narrative.io/?companyId=673&id=pubmatic_id:3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
https://io.narrative.io/?io.narrative.guid.v2=6a4ff970-e047-11ee-b5dd-063bb86db637&companyId=673&id=pubmatic_id:3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF

0
247 B

63ms
62ms

Image
text/plain

35.168.146.242

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://io.narrative.io/?io.narrative.guid.v2=6a4ff970-e047-11ee-b5dd-063bb86db637&companyId=673&id=pubmatic_id:3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Protocol: HTTP/1.1
Server: 35.168.146.242 -, , ASN (),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:22 GMT
Cache-Control: no-cache
Server: nginx/1.22.1
Connection: keep-alive

Redirect headers

Location: https://io.narrative.io/?io.narrative.guid.v2=6a4ff970-e047-11ee-b5dd-063bb86db637&companyId=673&id=pubmatic_id:3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Date: Tue, 12 Mar 2024 08:06:22 GMT
Server: nginx/1.22.1
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame ED5C
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:090522d1-d7e2-43e4-b4c0-9790dd87605a&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
100 B

60ms
59ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:090522d1-d7e2-43e4-b4c0-9790dd87605a&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 12 Mar 2024 08:06:22 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:090522d1-d7e2-43e4-b4c0-9790dd87605a&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Tue, 12 Mar 2024 08:06:22 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2 200 dc_oe=ChMIgPnSjaLuhAMVhCxoCB1k3QN5EAAYACCClpxkQhMIzf-ajaLuhAMVOazRBB0U5AqK;dc_eps=AHas8cAy0m9A4zgI6n837MmdmJMLYwYKKrLzYTQPgtcYZEwbF4_Y5FmbjxkyxDW1WFm2UndRX9lzON0Vdd8CuEzF;met=1;&timestamp=171023078...
ade.googlesyndication.com/ddm/activity/ Frame A76E 42 B
107 B 173ms
134ms Image
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIgPnSjaLuhAMVhCxoCB1k3QN5EAAYACCClpxkQhMIzf-ajaLuhAMVOazRBB0U5AqK;dc_eps=AHas8cAy0m9A4zgI6n837MmdmJMLYwYKKrLzYTQPgtcYZEwbF4_Y5FmbjxkyxDW1WFm2UndRX9lzON0Vdd8CuEzF;met=1;&timestamp=1710230783187;eid1=2;ecn1=0;etm1=7;eid2=12;ecn2=0;etm2=7;eid4=14;ecn4=1;etm4=0;eid6=16;ecn6=1;etm6=0;eid8=960584;ecn8=1;etm8=0;eid10=18;ecn10=1;etm10=0;eid12=960585;ecn12=1;etm12=0;eid14=13;ecn14=1;etm14=0;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame FF25 0
128 B 66ms
65ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156136&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156136&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:22 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame C152 0
128 B 58ms
57ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=158810&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 18:34:43 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame ED5C 0
128 B 60ms
57ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156423&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 08:06:24 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 dc_oe=ChMIgPnSjaLuhAMVhCxoCB1k3QN5EAAYACCClpxkQhMIzf-ajaLuhAMVOazRBB0U5AqK;dc_eps=AHas8cAy0m9A4zgI6n837MmdmJMLYwYKKrLzYTQPgtcYZEwbF4_Y5FmbjxkyxDW1WFm2UndRX9lzON0Vdd8CuEzF;met=1;&timestamp=171023078...
ade.googlesyndication.com/ddm/activity/ Frame A76E 42 B
63 B 124ms
123ms Image
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C152 625 B
1003 B 70ms
65ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=37476355&p=158810&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 3295fa7d5d4aebb52a103fc2d756f1dec3e6ab236943864af103adb734e46e0c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 12 Mar 2024 08:06:23 GMT
content-length: 625
content-type: text/html; charset=UTF-8

GET
H2 200 3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF Show response
csync.smilewanted.com/set_partner_userid_get/pubmatic/ Frame 0A81 0
551 B 175ms
167ms Document
text/html 2606:4700:10::6816:1fd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/pubmatic/3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1fd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 863248e7dfbb8dca-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Mar 2024 08:06:25 GMT
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200

p
a.audrte.com/ Frame C152
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=NmNtN0F1UXdFMVpRSktreHlhSDRKRFdvUQ%3D%3D&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=45425327371528386&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
https://a.audrte.com/p

68 B
424 B

143ms
142ms

Image
image/png

52.30.18.244

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Protocol: HTTP/1.1
Server: 52.30.18.244 -, , ASN (),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Tue, 12 Mar 2024 08:06:26 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Tue, 12 Mar 2024 08:06:26 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame C152 43 B
656 B 289ms
86ms Image
image/gif 2600:9000:21ea:2000:1a:609a:6780:93a1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21ea:2000:1a:609a:6780:93a1 -, , ASN (),
Reverse DNS
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Mar 2024 08:06:25 GMT
via: 1.1 78151a5252ddc63300143dbe81b1f0c4.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: EWR50-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: vHj3IKvuu37C1-1qPwW0QQ-F0lS9gmymHoP4wHnEaOM86aYl_f0qgA==
expires: 0

GET
H/1.1 200
OK info
uipglob.semasio.net/pubmatic/1/ Frame C152 42 B
603 B 97ms
81ms Image
image/gif 50.57.31.206

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&sInitiator=external&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.57.31.206 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Mar 2024 08:06:25 GMT
Frontend-ID: 5
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Content-Type: image/gif
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Origin: *
Content-Length: 42
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H2

200

33141
tags.bluekai.com/site/ Frame C152
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=50b14d87-5347-4d9e-be83-599baad62bba&icm&gdpr=0&gdpr_consent=&cver
https://pixel.onaudience.com/?partner=109&icm&cver&gdpr=0&smartmap=1&redirect=tags.bluekai.com%2Fsite%2F33141%3F%26id%3D%25m
https://tags.bluekai.com/site/33141?&id=151dacb3e87b7367

62 B
427 B

411ms
157ms

Image
image/gif

23.46.225.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/33141?&id=151dacb3e87b7367
Protocol: H2
Server: 23.46.225.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Tue, 12 Mar 2024 08:06:26 GMT
content-length: 62
content-type: image/gif

Redirect headers

location: https://tags.bluekai.com/site/33141?&id=151dacb3e87b7367
content-length: 0

GET
H3 200 match Show response
events-ssc.33across.com/ Frame 911F 68 B
82 B 294ms
293ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=3DB8E691-592F-4ECD-83CC-BF91F7F7BCBF
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Tue, 12 Mar 2024 08:06:25 GMT
via: 1.1 google

GET
H3 200 dc_oe=ChMIgOL6jqLuhAMVUA-ICR3nAQXqEAAYACCZnKRk;dc_eps=AHas8cBCkVkLwtJAenuCGT6550DjRdPGIAQk-6iRAPIIeacHlRpsBKXd5WgCvAzr0H7Ke5kzQLwdKp5h_Y-M4GHb;met=1;&timestamp=1710230786366;eid1=871060;ecn1=1;etm1...
ade.googlesyndication.com/ddm/activity/ Frame 09C2 42 B
63 B 124ms
123ms Image
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIgOL6jqLuhAMVUA-ICR3nAQXqEAAYACCZnKRk;dc_eps=AHas8cBCkVkLwtJAenuCGT6550DjRdPGIAQk-6iRAPIIeacHlRpsBKXd5WgCvAzr0H7Ke5kzQLwdKp5h_Y-M4GHb;met=1;&timestamp=1710230786366;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS