filemodsbr.boasaude.top Open in urlscan Pro
2a02:4780:1:357:0:9da:6c33:13 Public Scan

Software

sffe /

Resource Hash

f83c574ffa76fcf2287e1093f293c313dd0da71be91321ee4f77dd4389084c4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28380
x-xss-protection: 0
server: sffe
etag: "1213 / 967 of 1000 / last-modified: 1652440057"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 unnamed-6-1-326x245.png.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/02/ 1 KB
1 KB 113ms
112ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/02/unnamed-6-1-326x245.png.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

4581f15cec3822e5a156815f8b67c8ba7000810a24a4844fa3f491cd14522ce2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Thu, 10 Feb 2022 23:33:50 GMT
server: LiteSpeed
etag: "462-6205a0de-c5ed798d35856ea5;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 1122
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 cookieconsent.min.js Show response
cdn.jsdelivr.net/npm/cookieconsent@3/build/ 20 KB
7 KB 38ms
22ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e55842a856a6d829feca3c3ad736c136b6c7549e9247274f78aa296259e06e24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 30350
x-jsd-version: 3.1.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19122-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"50d5-nLraS9YXyGxjjPLr3exyStWWkHs"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X3ccAyBnwC7umWfqFRn%2FGloIPE%2BLXNa3nqM4ff%2BGb%2B15DIcCSk41QBhSsXGwz%2BSmGs4z74KCCpY0OosRhPPpdgEZ9BnoZ7F8ur1eGwCy%2FnWNEf1IJlP4VJeALGn0BGpHuX4MUXXrUmL76%2BD8sBA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 70ad3be20dbe0200-ZRH

GET
H3 200 ads.js Show response
filemodsbr.boasaude.top/wp-content/plugins/quick-adsense-reloaded/assets/js/ 78 B
403 B 114ms
114ms Script
application/x-javascript 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://filemodsbr.boasaude.top/wp-content/plugins/quick-adsense-reloaded/assets/js/ads.js?ver=2.0.50

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

2ecad403abe6094919937758649c7fe968b8339a0b958e232acab55ca87ef02b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Fri, 06 May 2022 01:55:16 GMT
server: LiteSpeed
etag: "4e-62748004-317cd814abfd445e;;;"
content-type: application/x-javascript
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 78
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ 44 KB
44 KB 140ms
6ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,400italic,700,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://filemodsbr.boasaude.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Wed, 11 May 2022 19:32:51 GMT
x-content-type-options: nosniff
age: 166629
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 May 2023 19:32:51 GMT

GET
H3 200 fontawesome-webfont.woff2
filemodsbr.boasaude.top/wp-content/themes/mh-magazine-lite/fonts/ 75 KB
76 KB 112ms
111ms Font
font/woff2 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://filemodsbr.boasaude.top/wp-content/themes/mh-magazine-lite/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/wp-content/themes/mh-magazine-lite/includes/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://filemodsbr.boasaude.top/wp-content/themes/mh-magazine-lite/includes/font-awesome.min.css
Origin: https://filemodsbr.boasaude.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Wed, 24 Oct 2018 16:21:10 GMT
server: LiteSpeed
etag: "12d68-5bd09bf6-33e5d6c27b230ec6;;;"
content-type: font/woff2
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 77160
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 16172637798307-326x245.jpg.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/02/ 6 KB
6 KB 215ms
215ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/02/16172637798307-326x245.jpg.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

7a7702ec4fc13c221b551dbe8d841ec2d99ec75d3f708f93a4c2ee6094dbee9e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Tue, 08 Feb 2022 21:20:29 GMT
server: LiteSpeed
etag: "1704-6202de9d-7dd0a13d80b1cf27;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 5892
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 wpsapp-imagen-principal-en-326x245.jpg.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/02/ 7 KB
7 KB 257ms
256ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/02/wpsapp-imagen-principal-en-326x245.jpg.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

c87e4ee6fb6b691913c9e812974c7bb99315e3d06ad56ab42ee8d3459245ec22

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Tue, 08 Feb 2022 21:04:20 GMT
server: LiteSpeed
etag: "1be2-6202dad4-55357dba9bc57d23;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 7138
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 download-168x245.jpg.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/02/ 6 KB
6 KB 260ms
259ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/02/download-168x245.jpg.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

775b74d4848e8a946fe4ecafb72ea52a8e8706d4a16b69da53ab00ee3edc8355

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Tue, 08 Feb 2022 20:59:54 GMT
server: LiteSpeed
etag: "19a2-6202d9ca-8f4163cc8817b679;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 6562
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 unnamed-326x245.png.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/02/ 5 KB
5 KB 222ms
221ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/02/unnamed-326x245.png.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

890840320271de2f61a5de4f2ae6e8dc5ed2a3d5ea1cee14cec10c232cc17913

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Wed, 02 Feb 2022 23:18:24 GMT
server: LiteSpeed
etag: "12f0-61fb1140-113e2a93c0fdda01;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 4848
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 download-1.png.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/02/ 4 KB
4 KB 226ms
225ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/02/download-1.png.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

924a02f003acb082a0d0f49df2c7b5fd9bcf90ba62f35474a2e2d441278a0207

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Wed, 02 Feb 2022 23:14:09 GMT
server: LiteSpeed
etag: "10ac-61fb1041-cfd815b235125045;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 4268
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 images-1.jpg.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/01/ 2 KB
2 KB 230ms
229ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/01/images-1.jpg.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

0dbb2d869a8f2ceda9aa3e930ceabedebf0f6be0c66d3f8e45f887dfc9fe59ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Fri, 28 Jan 2022 23:21:17 GMT
server: LiteSpeed
etag: "902-61f47a6d-f5a51e02dd4d6ffd;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 2306
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 maxresdefault-326x245.jpg.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/01/ 13 KB
13 KB 231ms
230ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/01/maxresdefault-326x245.jpg.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

5b125e052c0b51f06b07e3645be292ba0599bcbfc65ef1deaf27f42c7965c0ef

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Thu, 27 Jan 2022 01:25:06 GMT
server: LiteSpeed
etag: "34bc-61f1f472-e17f33c55f291338;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 13500
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 download-3.jpg.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/01/ 8 KB
8 KB 241ms
240ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/01/download-3.jpg.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

14c957c228f855e5309c641ea53e549b181aeca67f21e727612e5795be58cb4e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Thu, 27 Jan 2022 01:21:46 GMT
server: LiteSpeed
etag: "207e-61f1f3aa-2cb9df2a94f80fd2;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 8318
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 unnamed-4-326x245.png.webp
filemodsbr.boasaude.top/wp-content/uploads/2022/01/ 3 KB
3 KB 250ms
249ms Image
image/webp 2a02:4780:1:357:0:9da:6c33:13
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://filemodsbr.boasaude.top/wp-content/uploads/2022/01/unnamed-4-326x245.png.webp

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a02:4780:1:357:0:9da:6c33:13 , United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

24e09bd41fbed8922875ed609a6c1bf64948a4f221882dcd0ff8579e61a18aeb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
last-modified: Sat, 22 Jan 2022 00:56:35 GMT
server: LiteSpeed
etag: "c54-61eb5643-e70ed132211c22a3;;;"
content-type: image/webp
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
content-length: 3156
expires: Fri, 20 May 2022 17:50:00 GMT

GET
H3 200 sm.23.html Show response
static.addtoany.com/menu/ Frame D557 741 B
784 B 62ms
46ms Document
text/html 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.23.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ca130786a2d2531241f8b8c7aaad6a4e27271f51b417b9c23f51bfb0c65c080

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 747631
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 70ad3be33fea0211-ZRH
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 13 May 2022 17:50:00 GMT
etag: W/"2e5-5cc9e128a4c38"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Wed, 22 Sep 2021 23:42:51 GMT
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: e2s
x-content-type-options: nosniff

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 icons.30.svg.js Show response
static.addtoany.com/menu/svg/ 77 KB
33 KB 30ms
29ms Script
application/javascript 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons.30.svg.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e6f3eacf6af919ace45f10e39eda3e72143e0f57aad29590a6d37d5ddd0292f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
via: e1s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 15935771
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 10 Nov 2021 01:49:04 GMT
server: cloudflare
etag: W/"132a9-5d0656e4a26b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=315360000, immutable
cf-ray: 70ad3be33fec0211-ZRH
cf-bgj: minify

GET
H3 200 pubads_impl_2022051001.js Show response
securepubads.g.doubleclick.net/gpt/ 364 KB
124 KB 23ms
8ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb190163a0d4795999f1905b65b3d026f9308acdffce1cbeabbb96dc26c4816c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:27:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1353
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126527
x-xss-protection: 0
last-modified: Tue, 10 May 2022 08:34:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 13 May 2023 17:27:27 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 105 B
121 B 30ms
16ms XHR
application/json 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8059354af099b6263d1f9813cb54d28860cd3141f0ae139bd26f7ffd8594e53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96
x-xss-protection: 0
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205090101/ 308 KB
110 KB 46ms
31ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205090101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8854001660855218&plah=filemodsbr.boasaude.top

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c288f9455167916761c50982a689d55eab489afcfc65d2dd5a40f248c98537f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112602
x-xss-protection: 0
server: cafe
etag: 17796917985857603528
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220511/r20190131/ Frame 025E 10 KB
5 KB 27ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220511/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42b853168bb627593eb95b83db66183f7b3bd442db24c37398f1958d1451acd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85001
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4421
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 12 May 2022 18:13:19 GMT
etag: 1428802124239944296
expires: Thu, 26 May 2022 18:13:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 37ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 71ms
29ms Script
application/javascript 2a00:1450:4014:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4014:80b::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
19 KB 723ms
722ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

377632296a9eb3708946ef89a4210bc8b72b056a82abb86e218bb5306ec30707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19231
x-xss-protection: 0
google-lineitem-id: 5496887504
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138325501551
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://filemodsbr.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 85 KB
35 KB 294ms
293ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15432ccdc9c358ad9a51ed91e4b3b0182a3f4a0447d73f714eac79b038dcd22a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35595
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://filemodsbr.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
19 KB 485ms
485ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

8a6282c23ace5997ba9356791f83714313ae560a8e71353c41f1002b85668110

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19208
x-xss-protection: 0
google-lineitem-id: 5496887501
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138323424624
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://filemodsbr.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9E61 6 KB
4 KB 63ms
15ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:00 GMT
expires: Sat, 13 May 2023 17:50:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
646 B 36ms
15ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=filemodsbr.boasaude.top&callback=_gfp_s_&client=ca-pub-8854001660855218

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205090101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8854001660855218&plah=filemodsbr.boasaude.top

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

010b0fb0c74c20b150a509a75ebd24d25734b3ccb0cfd9bc0896a7568f942dc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&tn=DIV&cls=cc-window%20cc-banner%20cc-type-info%20cc-theme-block%20cc-bottom%20cc-color-override--2098402753%20&ign=false&pw=1600&ph=1200&x=0&y=1130.4

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C6FB 603 B
68 B 55ms
40ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8854001660855218&output=html&adk=3826760629&adf=1341073466&lmt=1652463981&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1652464200214&bpp=3&bdt=572&idt=133&shv=r20220511&mjsv=m202205090101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7096952404963&frm=20&pv=2&ga_vid=409443788.1652464200&ga_sid=1652464200&ga_hid=1332066531&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44761793%2C44761044%2C21066435&oid=2&pvsid=2592347529004605&pem=201&tmod=1578609053&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=146

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:00 GMT
expires: Fri, 13 May 2022 17:50:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 36ms
22ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022051001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d65fcb95ce02867bdad4b4f42b5798cd04886e22e077102e7ede27ced0fb28cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10532
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 57ms
21ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3351 13 KB
5 KB 32ms
7ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 796
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:36:44 GMT
expires: Sat, 13 May 2023 17:36:44 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D28B 783 B
1 KB 50ms
16ms Document
text/html 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d40466c85c6b324c53234777973423c927a482b77bf9576d9880e36172c1d6c4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eHQ-1rIXPEv-Fe7A8iFpCQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-eHQ-1rIXPEv-Fe7A8iFpCQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:00 GMT
expires: Fri, 13 May 2022 17:50:00 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 container.html Show response
cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 736C 6 KB
3 KB 24ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:00 GMT
expires: Sat, 13 May 2023 17:50:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D28B 0
0 71ms
71ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022051001&jk=2592347529004605&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

GET
H3 200 NhRng2ZenZRcaPRuU0zAmqgyTOhBGXWeehn8uWk0bEI.js Show response
pagead2.googlesyndication.com/bg/ Frame 3351 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NhRng2ZenZRcaPRuU0zAmqgyTOhBGXWeehn8uWk0bEI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36146783665e9d945c68f46e534cc09aa8324ce84119759e7a19fcb969346c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 10:31:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26335
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13698
x-xss-protection: 0
last-modified: Mon, 09 May 2022 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 13 May 2023 10:31:05 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0AD1 624 B
300 B 19ms
19ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYpPPTyQEwAQ&v=APEucNV0Hpn1pPy5ITp1VwTjIEKwh4Q7mU6e17c6WHht_YEZbr6up5g2xYDkr4F5CRgOOoJNT8ERyXdlS_1CtaaS__jXFRba5WT8JQ6mmoZbCzY0AbQ1S-HiUEsJqxn8DG_MLHU-1XsweqLt3ypwbkFSl5sXD14jFXkczjk6g_dfDMSJYPuf61A

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:00 GMT
expires: Fri, 13 May 2022 17:50:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 736C 106 KB
38 KB 35ms
8ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Origin: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 08:23:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33983
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 14 May 2022 08:23:37 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/elements/html/ Frame 736C 6 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:31:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1089
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2626
x-xss-protection: 0
server: cafe
etag: 8548655983161038638
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:31:51 GMT

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/ Frame 736C 19 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/abg_lite_fy2019.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a17fb8522bf74cf6b5cb185b7f6c7523977c79fe051071bc0e38aa1f59b8174d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:49:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7989
x-xss-protection: 0
server: cafe
etag: 11406487492938680093
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:49:10 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 736C 42 B
63 B 39ms
39ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CGwfhaUBZvVWXU8kzDC1S7ZlpyX-f2hs316t9NcdAX5wyDT1fIiCzwhbO45OLSY-fjoIZeXSEyBSBVJ3ngbS6NY5I0I6qiz35YkuyC9sK0oCbohYU

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame 736C 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/window_focus_fy2019.js

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:46:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:46:53 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 736C 121 KB
37 KB 45ms
18ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f53136d93b874d5ba193020ce13caae15abba12c500047c98985c3334a5c8c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37626
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652269989122821"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame 736C 15 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

965195159be784009cc31e4aff2505c066643cf8cdc99df7f56c2eab2abeda82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 433
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6412
x-xss-protection: 0
server: cafe
etag: 1643562372680595834
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:42:47 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 736C 0
0 30ms
15ms Image
text/html 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRL_4n_WdmS3XuI0Ty0srjxaPk_xgCAasiWREpa348agXBrqVUIFIyFEG9TAZoAheRjB9kt6gidKsHw-LuqCXdQrIr4KQ
Requested by: Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 736C 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 10 May 2022 08:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 292495
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 May 2023 08:35:05 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0AD1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFZOiPqJ34vyF6mXAtRTt6M&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFZOiPqJ34vyF6mXAtRTt6M&google_cver=1&C=1

43 B
1014 B

50ms
50ms

Image
image/gif

184.87.213.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFZOiPqJ34vyF6mXAtRTt6M&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYpPPTyQEwAQ&v=APEucNV0Hpn1pPy5ITp1VwTjIEKwh4Q7mU6e17c6WHht_YEZbr6up5g2xYDkr4F5CRgOOoJNT8ERyXdlS_1CtaaS__jXFRba5WT8JQ6mmoZbCzY0AbQ1S-HiUEsJqxn8DG_MLHU-1XsweqLt3ypwbkFSl5sXD14jFXkczjk6g_dfDMSJYPuf61A
Protocol: HTTP/1.1
Server: 184.87.213.8 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-87-213-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 May 2022 17:50:00 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 13 May 2022 17:50:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 13 May 2022 17:50:00 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFZOiPqJ34vyF6mXAtRTt6M&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Fri, 13 May 2022 17:50:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0AD1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yn6aSF0qbbd.uvMkVj7TSwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFZOiPqJ34vyF6mXAtRTt6M&google_cver=1&google_hm=2

43 B
1014 B

29ms
29ms

Image
image/gif

184.87.213.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFZOiPqJ34vyF6mXAtRTt6M&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYpPPTyQEwAQ&v=APEucNV0Hpn1pPy5ITp1VwTjIEKwh4Q7mU6e17c6WHht_YEZbr6up5g2xYDkr4F5CRgOOoJNT8ERyXdlS_1CtaaS__jXFRba5WT8JQ6mmoZbCzY0AbQ1S-HiUEsJqxn8DG_MLHU-1XsweqLt3ypwbkFSl5sXD14jFXkczjk6g_dfDMSJYPuf61A
Protocol: HTTP/1.1
Server: 184.87.213.8 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-87-213-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 May 2022 17:50:01 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 13 May 2022 17:50:01 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:00 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFZOiPqJ34vyF6mXAtRTt6M&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 0AD1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEOleoKaDm-9x0aJZejFzaHc&google_cver=1

43 B
1016 B

107ms
103ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEOleoKaDm-9x0aJZejFzaHc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYpPPTyQEwAQ&v=APEucNV0Hpn1pPy5ITp1VwTjIEKwh4Q7mU6e17c6WHht_YEZbr6up5g2xYDkr4F5CRgOOoJNT8ERyXdlS_1CtaaS__jXFRba5WT8JQ6mmoZbCzY0AbQ1S-HiUEsJqxn8DG_MLHU-1XsweqLt3ypwbkFSl5sXD14jFXkczjk6g_dfDMSJYPuf61A

Protocol

HTTP/1.1

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 May 2022 17:50:00 GMT
X-Proxy-Origin: 45.141.152.68; 45.141.152.68; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3733630a-20d3-431d-9e12-b1d2b5a51997
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:00 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEOleoKaDm-9x0aJZejFzaHc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0AD1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA3NzAxMDA5OTYyMzU4NjQ0Ng%3D%3D

170 B
188 B

60ms
32ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA3NzAxMDA5OTYyMzU4NjQ0Ng%3D%3D

Requested by

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 13 May 2022 17:50:00 GMT
X-Proxy-Origin: 45.141.152.68; 45.141.152.68; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8871500e-3a85-45ef-b676-b6cdf5c6af88
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA3NzAxMDA5OTYyMzU4NjQ0Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 46BD 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 41257
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 06:22:23 GMT
expires: Sat, 13 May 2023 06:22:23 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3351 0
9 B 6ms
6ms Image
text/plain 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?1vydjw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/174493178656182189/ Frame 2CF9 9 KB
3 KB 23ms
8ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/174493178656182189/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6823af12ac242cb8a3e44eefe6f84c05df51bb31bc4bebc399168da48dd7029e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 112845
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2584
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 12 May 2022 10:29:15 GMT
expires: Fri, 12 May 2023 10:29:15 GMT
last-modified: Thu, 05 May 2022 07:04:01 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 736C 0
622 B 82ms
52ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBMIHvgI3KtcE1LNb2eHIU5cfD7B6DUbSC-pT_wkeCAP4_qdhN1RM5FMr1QQwrtvBbz3sY42tII80C2lBno3YlTn2ryDukeVEKHHOWqe2LLx5XditbTJB8OOL4T3d-ha5n_oRKHqHinSvO2t1zySv-Sy7ru32r5srcggHR_3pUTO8pdlY5D-VGier36NatYUCEVL9zLBDpqP5O2zcPWhdjPEnZexASCIDPLzavBVpExSzUqLQssVMa-QkHL0BEqrHQwjMeC7ws0S4077s2cCqghe4rdwhbjMjX231KrTDk95Qohml2ULiKTYx-zpADNd_E-eQXlBxEmBL__XqR17_vkqpNYhGsWRf8xBXRUtbNTgUf5kV-w6BAYkez8YOQTTevXQXkLd4GrCLM-KK-mMwKgz6e1qPj1fG8r--EeF2aJgY_eMwex-9bafxS28UjzAljUGX0Ing8MdlY5HNtIt_O-84_BtdKMYLVjGnIpCzaH9ikCwXf2N8i6x5n_jSIDOIcmiW7bBiBx2UZpXHTztvv4DeLtqgXrMKQq7ZBsEbzTld5UyKh9kjllVkjz97VZ2-fTxqFaKOVGaxTCdsQv53f2u28m-2arjOCjpNNj0xs6f4ONRZ5kSnm-ibe3rtZouixFuuHXolYe_UBCgw-m6NVvbTwXKMoCdJT_6s7jtcZJ19ktA2Ny0LOKvzAnApqBn8iKf_fMHaCRRDWrDDIIp5RPbxv9aUs-xsH2Dux20gdxaJvXVC6l0EgxbnpLSb1NLVR3UDv1wbXK_YRovFiRFd9I306XQDhM5QVcxBfXTTPFi44IqGHJg14h1FLBtgtHv83t5C2UhCMXPG-GfSNZ7vgI_N8xRgjxeQRnr0cv-0CDzQ5Du6OjBuJGqJYNjnHiD_IpJ0ZUSTY6AZOzVSNqsbnOdcBtdbvaD4rE3ABr3cttFtx-GtJ1d2YxCRKj05_KRKR9081PfQ2PvBC31_uYymiC7Ff6kohWegeTdaN7YcV4rK2wheDdy0GAV7hMhadMMCS10skrHHS2Z4IIYBrNR-0jTBe2SuGpD4MJ61oqOBZjUN0BxRWV24pIKxwH8NZ43QOdc4euTz1SwfMiK0IvIpRaq2-zPIeVOapEPjHrq8QcJO9quk2hdwp_0Bt-5LYbQsGiXeHSYgQxXXUcw&sai=AMfl-YSGHDY77g5cLSISWNT_klztcde25vjGiT1I6fz8wLgvAma4_yJc7Q7JDLllom_CFRsq5vC7-3syuKHrgCFMalBcdQjUXpaJTqRTRqHNpVi8dKatror2NvMiglkCYl1ljETzX6rw853_utqY5OloIPyY2lKVWPNM5nEX7OkmYBIdSZwSVCH6gc5Bc_wMYnJR6WKtT-eJx9eLH0DLaHXLmzIeJMNapwGbzTH-1tFDzs-CvdZ1rbQVjSemg5JCac_GLfQqiIALtYVd1rc13Rq0VrjGRtORJhPEHAIZ1vOtJ0GIlBjab7jIMFs1sV8FZoq0CcmHO3J-klxLo4axRy9xEpUGsEnNDO_i5zv0CAH303olw9rf5SbeJnYNOCEyeEmvJbRpKoHskrwSHMVYoPvqOA&sig=Cg0ArKJSzJSCZgPxS4gnEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=65&cbvp=1&cstd=63&cisv=r20220511.98104&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 13 May 2022 17:50:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 736C 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 680c9894c46ee270425f8a36835ad6d26e03f4b206f3f383b79331693733c259

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E369 0
0 43ms
42ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNpwxdKAWt7fzclrHyzeihfjx269D9pkjn8i3J4zhSthnNM_Tarv3lyozRvO5mo4d4wfczn-GgBnwM42KdJ-rnpETL_cYBvuRSN_-1_wM32SP5K1lcQuQLWablDy2A1bz9z_fUgqZwoR5ZZIvAe5GxLYjN5Jg1nXPmWeyNCRyCm3_nvFq0MrqUlEpCzM7vUHTFnvIoZnGmj_92pbTashhPPhhvrVDFhawa4vh0OMt5B5PddvEVhiB4YlrApKXWsU5UsCIcD-HiSyHYC62GJ9IHVbWx6QnEkH5f_qF7MXbhQaf0Zc9rljOYVdVLENIHAH2TP0eN-ei7Tuaz&sai=AMfl-YSRuoQQscZd2CyR_v186ylQ9PwZ5_Eo_CZ4M6W2ory41yBvB1frXU6wuX5l2EeQ5yrlJfDbhZu863F-zeVyP7uk4PXEIoV81Gydv12OyaRqV3enYhy_pvWsQJpGbvU&sig=Cg0ArKJSzACxsAIOL8sXEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E369 121 KB
37 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f53136d93b874d5ba193020ce13caae15abba12c500047c98985c3334a5c8c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37626
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652269989122821"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2CF9 60 KB
24 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/174493178656182189/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/174493178656182189/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 cssruleplugin_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2CF9 2 KB
1013 B 25ms
24ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/cssruleplugin_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/174493178656182189/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d9095c25f5663901783868e1cd2994842dcbb4967ff5d0f0d3b9409b67675c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/174493178656182189/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 985
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:22:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/sadbundle/174493178656182189/ Frame 2CF9 6 KB
3 KB 9ms
9ms Script
application/x-javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/174493178656182189/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/174493178656182189/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

639933f86eb6befdf84c1307d608d0d76d7713bc62c4d3be2d98176f477f5f25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/174493178656182189/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Thu, 12 May 2022 10:29:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 112845
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2576
x-xss-protection: 0
last-modified: Thu, 05 May 2022 07:04:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 May 2023 10:29:15 GMT

GET
H3 200 Yd3cEgPtLOfKcy7GxWkHziCM9jl-6RVWGk-YTJsF5Kc.js Show response
pagead2.googlesyndication.com/bg/ Frame 46BD 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yd3cEgPtLOfKcy7GxWkHziCM9jl-6RVWGk-YTJsF5Kc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61dddc1203ed2ce7ca732ec6c56907ce208cf6397ee915561a4f984c9b05e4a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:01:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2924
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13574
x-xss-protection: 0
last-modified: Mon, 09 May 2022 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 13 May 2023 17:01:16 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 31ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 60ms
30ms Script
application/javascript 2a00:1450:4014:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4014:80b::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 48 KB
17 KB 469ms
468ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2592347529004605&correlator=3644113764059174&output=ldjh&gdfp_req=1&vrg=2022051001&ptt=17&impl=fifs&iu_parts=339263271%3A22641433963%2Cadex_boasaude.top&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50&ifi=5&adks=2890984277&sfv=1-0-38&ecs=20220513&ris=1&rcs=1&fsapi=false&prev_scp=in2w_key%3D648%26in2w_key2%3Dnope%2Coptimization%26in2w_key3%3Dadx392%26in2w_key4%3D--g---%2C--g---%26in2w_key5%3Doptimization%26in2w_key6%3D--gh--qgz%26in2w_key7%3D392%26in2w_key8%3D648%252C649%26in2w_key9%3Doptimization_request%26in2w_key12%3Doptimization%26in2w_key15%3Do0%26in2w_key16%3D10%26in2w_keypm%3Ddiv-gpt-ad-1636061935023-0%26in2w_key9001%3D1&eri=1&sc=1&cookie=ID%3D6b9eb1c18f7c422c-2292efb694cd002e%3AT%3D1652464200%3AS%3DALNI_MacgJq7kypGd3G5FzLYuEgBNXQlrA&abxe=1&dt=1652464200836&lmt=1652463981&dlt=1652464199642&idt=627&biw=1600&bih=1200&adxs=285&adys=3299&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1030x50&msz=1030x50&fws=0&ohw=0&ga_vid=409443788.1652464200&ga_sid=1652464200&ga_hid=1332066531&ga_fc=false&btvi=2&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80a030cf8c71259758bc00cc10337ae3d67fc18d0545fdc47720391a62da70b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16997
x-xss-protection: 0
google-lineitem-id: 5645478603
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138377412814
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://filemodsbr.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E369 0
0 41ms
41ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssnzE6nwgI_QOy8RZhg6F4RN6BwDTyiU9S7CpCHRw_mRPmJYjwOQDxhpnOO0cc-LxfmRNZuXLyc8DczB4cyFLAYZg4d7RpOxdGKrYBvAzQt5jw98YhmUVlNzteAT5gB-h3txfvGZKb5cTnYaFOCfkSDmMWN-Med0yzCmSmyyH1_PhV5iA8_jAbUdqXk17MpSQas0aIq58ql2qkFoEtEfC11Glfg82EnW3HCNOmYV1komMenAskfHx4PmcrsG6O4PkpCGQKV4bvx2AUo0t1HdnCDRYBhnTLiay1g2OWw_jZyqcIRB_-YkaPKbvXsxvkQ2AYojfCY_PrLsSCTADE&sai=AMfl-YQ-TIj4-Flzobgl1cpHh9Q8Bir07jFzwCA2Z3h9XmGVoMS7zHsTYe3FN7lOEWWWyKFFs88EuVxI6RbBHu58OsKcZN4fRth-uyImaM8g64MdqzOde4Iho_kqxL3vT8E&sig=Cg0ArKJSzJrckGt0H6HSEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 13 May 2022 17:50:00 GMT

GET
H3 200 comdirect_yoga_0x0_js.png
s0.2mdn.net/sadbundle/174493178656182189/ Frame 2CF9 189 KB
189 KB 8ms
8ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/174493178656182189/comdirect_yoga_0x0_js.png

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72cfbcc8941249ec246e1983e34575653f4a5c8ffbc4fa16ab72c94411866bab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/174493178656182189/index.html
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Thu, 12 May 2022 10:29:15 GMT
x-content-type-options: nosniff
age: 112845
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193379
x-xss-protection: 0
last-modified: Thu, 05 May 2022 07:04:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 May 2023 10:29:15 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 736C 0
26 B 59ms
43ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBMIHvgI3KtcE1LNb2eHIU5cfD7B6DUbSC-pT_wkeCAP4_qdhN1RM5FMr1QQwrtvBbz3sY42tII80C2lBno3YlTn2ryDukeVEKHHOWqe2LLx5XditbTJB8OOL4T3d-ha5n_oRKHqHinSvO2t1zySv-Sy7ru32r5srcggHR_3pUTO8pdlY5D-VGier36NatYUCEVL9zLBDpqP5O2zcPWhdjPEnZexASCIDPLzavBVpExSzUqLQssVMa-QkHL0BEqrHQwjMeC7ws0S4077s2cCqghe4rdwhbjMjX231KrTDk95Qohml2ULiKTYx-zpADNd_E-eQXlBxEmBL__XqR17_vkqpNYhGsWRf8xBXRUtbNTgUf5kV-w6BAYkez8YOQTTevXQXkLd4GrCLM-KK-mMwKgz6e1qPj1fG8r--EeF2aJgY_eMwex-9bafxS28UjzAljUGX0Ing8MdlY5HNtIt_O-84_BtdKMYLVjGnIpCzaH9ikCwXf2N8i6x5n_jSIDOIcmiW7bBiBx2UZpXHTztvv4DeLtqgXrMKQq7ZBsEbzTld5UyKh9kjllVkjz97VZ2-fTxqFaKOVGaxTCdsQv53f2u28m-2arjOCjpNNj0xs6f4ONRZ5kSnm-ibe3rtZouixFuuHXolYe_UBCgw-m6NVvbTwXKMoCdJT_6s7jtcZJ19ktA2Ny0LOKvzAnApqBn8iKf_fMHaCRRDWrDDIIp5RPbxv9aUs-xsH2Dux20gdxaJvXVC6l0EgxbnpLSb1NLVR3UDv1wbXK_YRovFiRFd9I306XQDhM5QVcxBfXTTPFi44IqGHJg14h1FLBtgtHv83t5C2UhCMXPG-GfSNZ7vgI_N8xRgjxeQRnr0cv-0CDzQ5Du6OjBuJGqJYNjnHiD_IpJ0ZUSTY6AZOzVSNqsbnOdcBtdbvaD4rE3ABr3cttFtx-GtJ1d2YxCRKj05_KRKR9081PfQ2PvBC31_uYymiC7Ff6kohWegeTdaN7YcV4rK2wheDdy0GAV7hMhadMMCS10skrHHS2Z4IIYBrNR-0jTBe2SuGpD4MJ61oqOBZjUN0BxRWV24pIKxwH8NZ43QOdc4euTz1SwfMiK0IvIpRaq2-zPIeVOapEPjHrq8QcJO9quk2hdwp_0Bt-5LYbQsGiXeHSYgQxXXUcw&sai=AMfl-YSGHDY77g5cLSISWNT_klztcde25vjGiT1I6fz8wLgvAma4_yJc7Q7JDLllom_CFRsq5vC7-3syuKHrgCFMalBcdQjUXpaJTqRTRqHNpVi8dKatror2NvMiglkCYl1ljETzX6rw853_utqY5OloIPyY2lKVWPNM5nEX7OkmYBIdSZwSVCH6gc5Bc_wMYnJR6WKtT-eJx9eLH0DLaHXLmzIeJMNapwGbzTH-1tFDzs-CvdZ1rbQVjSemg5JCac_GLfQqiIALtYVd1rc13Rq0VrjGRtORJhPEHAIZ1vOtJ0GIlBjab7jIMFs1sV8FZoq0CcmHO3J-klxLo4axRy9xEpUGsEnNDO_i5zv0CAH303olw9rf5SbeJnYNOCEyeEmvJbRpKoHskrwSHMVYoPvqOA&sig=Cg0ArKJSzJSCZgPxS4gnEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=207&vt=11&dtpt=142&dett=3&cstd=63&cisv=r20220511.98104&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 2CF9 131 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: efc9b32e0e682d42d1f287e352c1f20144f57409c9247b896ecd0b126d123d1b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 2CF9 32 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4bc1d8465533d05526d2941898653ebce0ef1c0fd4194225df1785a4aaa4bfb0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E9F3 0
0 40ms
40ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvv7KNmMDEXIbZj53YVpWZZ9PxLu8WlpH-ucjSfJtbgt-DgAJJiGeglpIlD6IaEkz_wowDcUzmm88m52hIl7zkmJoqWP_N7vtGdW9s5U1wd9riyxSpWqIAum36pMR52GyFTz2a4Cjc2cwWuormvz3uPqZqLSCG2by4hGyVsVYEMBw6CB8SQkFjTOpWN1ZuhIX55ukZcyJOt6gCj_tHXtKrq9Tku2b725fnlFPs_3QbHtQTzU4SjTuHP2fM-6lVM8tIPQCoJxxDERqeidsimmbXqR0XGeXOocnaYZVutnRXIS9rS6_CC2FLNV2Ub2LsvqFlL3IJbLlX3qroE&sai=AMfl-YRmKA4V0lQzcItZPSnooRcoJu4BNpjnUVFgrm39EPJMsmb4nhL2NC-PfwwdExq9zKm5sEyLIMCGgsL_kE-MscT4KIcyxHd-VMO51pEQmxbAOVRVbdQpuUDKXrHmWXI&sig=Cg0ArKJSzB99LvTxw2-PEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E9F3 121 KB
37 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f53136d93b874d5ba193020ce13caae15abba12c500047c98985c3334a5c8c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37626
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652269989122821"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 13 May 2022 17:50:01 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
29ms Script
application/javascript 2a00:1450:4014:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4014:80b::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 95 KB
37 KB 478ms
478ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2592347529004605&correlator=3644113764059174&output=ldjh&gdfp_req=1&vrg=2022051001&ptt=17&impl=fifs&iu_parts=339263271%3A22641433963%2Cadex_boasaude.top&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=6&adks=1412801661&sfv=1-0-38&ecs=20220513&ris=1&rcs=1&fsapi=false&prev_scp=in2w_key%3D675%26in2w_key2%3Dnope%26in2w_key4%3D--g8gz%26in2w_key5%3Doptimization%26in2w_key6%3D--gqgz%26in2w_key7%3D392%26in2w_key8%3D675%26in2w_key9%3Doptimization_request%26in2w_key15%3Do0%26in2w_key16%3D1%26in2w_keypm%3Ddiv-gpt-ad-1637156656139-0%26in2w_key9001%3D2&eri=1&sc=1&cookie=ID%3D237549127e7fb75a-2292efb694cd002d%3AT%3D1652464200%3AS%3DALNI_MYnRIteFGAyIgDlTm11MlQ9dnkIMw&abxe=1&dt=1652464201076&lmt=1652463981&dlt=1652464199642&idt=627&biw=1600&bih=1200&adxs=260&adys=194&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1080x280&msz=1080x280&fws=0&ohw=0&psts=AGkb-H8Mi06QhlySbrA8zEkqTcX6UPrwo_ffAr27ULbTFVxRfP7mHHA21Fr0ThnfsWFPDjh7YIJQGfTyI7Gq-9VNaJpMNtu7kX0&ga_vid=409443788.1652464200&ga_sid=1652464200&ga_hid=1332066531&ga_fc=false&btvi=0&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4be46cc48dcfdd576265ba24a7e395aaeb21b04b79fdcdcbf589d800538abd47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37389
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://filemodsbr.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E9F3 0
0 43ms
42ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvFl1gMZPAtiliVZhFdxbQ9etSswGa3ZLKGY1idMIp-AwmBehV0qVg0ByZC8ClGjAloWTgr0evKw8_a5R5EmkNlJrFxnddhvmUhkIbKGN6o3Z6G7QVHA6_PhmwpG1N4Jh3g31bG1RMLa4pF3SNQXZiM6NWEkh_UBzhYiP8PoTGyhqhEq5RYgGXZCdIX6bMvdGNQkzbfDZCH2g93s16e7_Jl-_KprPdgYz_M_ovwyyLHWCcDco1Apm88QnbsR5goEuai6PZainx-qoKFxVYF7Oq8ANwvIFIz6XVrRSj_tPxMmn5OJ19kjyPJ5py7oj-yaX7mEMHgSZFTwUYrWbk&sai=AMfl-YROtJ-J9xAbZZsOwABSSo5X4L10Gz2AMNWQV0aj9qy4Wd-iZEBEdLmzGDgJeyjHD-GHiB1gBtRT8xA1_JjTfvz9lrRjFEKDrHVnzDEm3X_Rg9E-oUyJ4H7wWDUOlec&sig=Cg0ArKJSzFDIVKeJOxulEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 13 May 2022 17:50:01 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 46BD 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bg3tXSJp-YuT9FM-IrATK_7hwAAAAADgB4AQC&bg=!a2ilaCzNAAZL3OSAa9w7ACkAdvg8Wj59Oqs7nOPf2a5d2TGHzVhLPjNCyrvjahk7BUmR-po7cWd2DgIAAAEtUgAAAAJoAQeZAvTz-vGNi3qHW4gRIRpju1mtlCcyK-hYD7WdZxxLNUvWv7X3qJc237QXitYlkwCjztM4XESJe7X_yARTCcBJGojhtPD6QN3we1usDufo187FoOOl7B1aJCoxKj5WYgaTMcvV5Ekeq2P0b5Va8gB67yGc8JCDI__A9AE8YLzmS1Jv4g8uSX6I3lEqamEnKbrqckunNbxuzJrhB7ijQDmJOv-JYgyV8jWNfz752yVMPEQ6UnKtrVvtesH6OzTq2yakq9x67B-4RGLc7LRc4DCnEIbrPK9KKD8TsTfUTUMOmXB0EJdv4oovf2_Pqt9hCHhpV6ogW7O8pDmo4Bw_bluKn8E62Q6IMo25rJGyBvenpUE1YWyjka3SFCDJDtrjKZh_VJwG3wui-D83koD8mJNzVMhOrB77h1WEYVeDDFDQe6-gqGAuIZdl3Vm195DLAeqYfGD4ujfWIyInAx_Z8D4LntD87gewjKb3A_b2q7XBGRbk-xRZcf7tbSqPUMq7lRlYtV8iS_ZZi5hQw4ZHgH2M7wd0YcyJ8P4mhgWs0w8JOMUQa3KIMbB0kYNxy1qFB5R2Lmwuv4lrWigeT6jPiH_2257MNzASqkxvduMUg2-1UW8yA5c37IT3bUhxLnc3hdPRhoD0O0dg5vIGMKoZYMElr5nJeR79Zqq9fr08V69igAlgIqYxUNYJ-bIF5n_EUXc8L9YmnmeKHouGlv1OnJbVA_Rth9Dbp0M5Rpu0ihOJu-JjM75k8BeeVjTatLZxHNGyz9BYllpkozSvHqeB1PIUtbRjmYJbVRrw-nLDPUIWG5nYHOFwJu-N4kpJaAaq1NCFfURRRJ8D8TabDDOqswzeSDPoXWBic07wM4OB4Ip9JgOGbSxP5AAXk-ychtQO6J9AEYsPxcz0ZsCHkAZM71p9EFSRcNULaWkoHXNICXw9nnkJQ5gbmDZbDwrAxdgbj4-fErsTwYB96XiVRjzujJiiTwna7N5qZ_axRyXhpL901uZi4sJa3-E

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 51ms
51ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022051001&jk=2592347529004605&bg=!EBOlE1fNAAZL3OSAa9w7ACkAdvg8Wg5Mac4aFuUAKhA-zRVid8l2dcI3u7CgpIQc4TyZhNk5YojLAgIAAAB_UgAAAAFoAQeZArCniSGS6K9Vc43oTo1gX5CgvKwfUr-jtbucukE1dxgViOm9dyz1PjqTn8ojj26_qhiHk5NtAuF1f2vCCQXLVMQ_Z_LtYsHS4ni2cZOcrv5n-6e8bGooRhlK-UHNn6y9JHPFvEB-JdDcACvS4CGymoQogaaPftURaO5H2ZknLng_IGVroIf7NxO5shsb1_fVrrnC5OprMsAkN7oi_UXVlVsVPEgzToMPa8BLMPX9srza8-gYJUWphl3lG2mbEkJ9odECyoyIhaVebOLmczNI3bpHRqhYjL6UdFQvmBMSlBGwoOyddeSoA3tE28yOjCQOd3AxGQLZ1uHfA9i2LmCedXjey3KYrW5BcSHO6AE62bgdriGqWIZeBholyBZLSyjl_hhazo_TSILfKAx0JgXb6lvfcKjVhP4bVOpceTYmipa9uEj87d4JefPRE1gY06fmfBKZpQQ2QmWGH29DIMnAjeHxs_ciezgFfV_MbWKYOUYT94fKqcUSzsJGuP5B3RiXGxd000g99rHFn4L_vV2eQd0ppHqnsGrFuV33RrvG9i7b0JJ2oy1wHKyU_m3njaoe2RlfzFoXOUQnK4M-mHWUd3jji5ia_IU72GSMnU_MtvdeObVskRaEn8S_GkXr0WOnfLU5NI3lERc1ImjzyjpDqnOnpT7nX78BN-4aATMX-dCEYmBp9TDPJBw9bUdJHZWPNbFysepF2eC-m6d699CZ1RzhaYzgSTjWHJerY9pUHY7odaag8kQPJA-xQuo3s9LquPLZyEdfu-DA43rvHqTiqbQe041V1BtHJfzV14ZP2uwzbJoiPnWCCmwfqtf1Pdk6IrkxFjvC6sG7RiiHCUPvt5hx8MYlKyCLmlBBvmLumwF9PTqydHNozqijodY9OwG4q0UwU6ZAmAhTJ7MbAKMbAoz1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

GET activeview
pagead2.googlesyndication.com/pcs/ Frame E369 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F77A 0
0 42ms
42ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstvMgjxO1QyALgEexJZEQAmOOmV8byqd9es3KH_Un7Budcyia_1SmO0X3Kn7JHdoGfwHjnFVCS2Eqq6h0xqXUE3V1PmWsX7MxIrJQoI77AjywDnGVxk8-Zld8fgDjp8-LXxtrs-ey-CdShUGBi7c134b0nzWoxn9UzkuGqNaXshEL59u9msx63gBk0MxrbAH-qYZotwgVETh9k7SOLqW6kxDokzeGP8FWYxhfZEyuiOaX2i2ykGC86qN35aHGHo0QVlaOrLS1BSjZR5KMfcEv-pkG9PE80OlLOXuZidl_NYAEh12ENu1iM9g7bNV8by9GMgVVLVOCGOy7KZ&sig=Cg0ArKJSzC5BO-nOe2I3EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F77A 121 KB
37 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f53136d93b874d5ba193020ce13caae15abba12c500047c98985c3334a5c8c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37626
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652269989122821"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 13 May 2022 17:50:01 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
29ms Script
application/javascript 2a00:1450:4014:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=filemodsbr.boasaude.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4014:80b::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 19 KB
10 KB 324ms
324ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2592347529004605&correlator=3644113764059174&output=ldjh&gdfp_req=1&vrg=2022051001&ptt=17&impl=fifs&iu_parts=339263271%3A22641433963%2Cadex_boasaude.top&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50&ifi=7&adks=2890984277&sfv=1-0-38&ecs=20220513&rcs=2&fsapi=false&prev_scp=in2w_key%3D649%26in2w_key12%3Doptimization%26in2w_key15%3Do0%26in2w_key16%3D1%26in2w_key2%3Dnope%2Coptimization%26in2w_key3%3Dadx392%26in2w_key4%3D--g8gz%26in2w_key5%3Doptimization%26in2w_key6%3D--gh--qgz%26in2w_key7%3D392%26in2w_key8%3D648%2C649%26in2w_key9001%3D3%26in2w_keypm%3Ddiv-gpt-ad-1636061935023-0&eri=1&sc=1&cookie=ID%3D6b9eb1c18f7c422c%3AT%3D1652464200%3AS%3DALNI_MZX8xl4X1f4QYqcKaIxhgDeuy01rg&abxe=1&dt=1652464201332&lmt=1652463981&dlt=1652464199642&idt=627&biw=1600&bih=1200&adxs=285&adys=3299&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1030x50&msz=1030x50&fws=0&ohw=0&psts=AGkb-H-q8PVunkIMf4f1DnLgNP2jNhUAFK3HiksIoJyc7BpcmYanN7uK_WDEIO2i9lekThnerkxlpXlKY5MnN7Grg17UkIxtIFQ&ga_vid=409443788.1652464200&ga_sid=1652464200&ga_hid=1332066531&ga_fc=false&btvi=3&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9bd2ff81cede0a0050bf341345d75c34bd392e0a4001856aaaef3c060f4c1d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10393
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://filemodsbr.boasaude.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F77A 0
0 41ms
41ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsucuzl3ngaHYta-5kVWjB-6UNiz2ujpFekAC9ogRVzoBtNAaDpt3EpoE6bnoIuQIJbogczQNgXbNOM0QxNk5QFftQS3dN0qnDTgs02vibCv71UP0T-mMeRLSFtOknKLNs4YKfrJaLPvqy_zsZQV89o1KpTSnjPPh9vf-PdPqDNms76vRtspUyEPBNZH9MoziGN77rYiFrR_sUh2vHc55rjFU21SHGsIcaXjJusVhpwONeV51t47nJKxftGbPMLQr0bFbLxUj-eQ1cMD3FCYol6VJRupRUE7UuzdavplKt_S4VbYDW44UhimknauhBub0Q9RJmp2mO5b2cRZZRw&sig=Cg0ArKJSzLT8W4EAv1TvEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filemodsbr.boasaude.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 13 May 2022 17:50:01 GMT

GET activeview
pagead2.googlesyndication.com/pcs/ Frame E9F3 0
0

GET
H3 200 container.html Show response
cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3707 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:00 GMT
expires: Sat, 13 May 2023 17:50:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2137 640 B
318 B 19ms
19ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhiIhpmxATAB&v=APEucNXoxtrNBPlLOuRuWjnx_9NNViQIJ-9wZNIvnxOHpQfVR9PDqioPc-y31Kcvhpw5mU3jmSzXmHY93jjbNc4PbCEGZRnuOJYtAD69vaeCkKxPESDvyyv3qo0v3KF8_K_Sx6vZrCDHZ4Va7AZRHicgtPGpWlR5PboIwQK2xrttozkZqEL34rs

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 295
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:01 GMT
expires: Fri, 13 May 2022 17:50:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 5962 106 KB
37 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Origin: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 08:23:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33984
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 14 May 2022 08:23:37 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/elements/html/ Frame 5962 6 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:31:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1090
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2626
x-xss-protection: 0
server: cafe
etag: 8548655983161038638
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:31:51 GMT

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/ Frame 5962 19 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220511/r20110914/abg_lite_fy2019.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a17fb8522bf74cf6b5cb185b7f6c7523977c79fe051071bc0e38aa1f59b8174d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:49:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7989
x-xss-protection: 0
server: cafe
etag: 11406487492938680093
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:49:10 GMT

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame 5962
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=e774d0b4&atb_dpuid=nayoki&atb_dcaid=display-pp_paket_m_alw-on
https://d.adtriba.com/px.gif

42 B
227 B

8ms
7ms

Image
image/gif

52.58.148.89
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 52.58.148.89 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-148-89.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Fri, 13 May 2022 17:50:01 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Fri, 13 May 2022 17:50:01 GMT
Last-Modified: Fri, 13 May 2022 17:50:01 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame 5962 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/window_focus_fy2019.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:46:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:46:53 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame 5962 15 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

965195159be784009cc31e4aff2505c066643cf8cdc99df7f56c2eab2abeda82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 434
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6412
x-xss-protection: 0
server: cafe
etag: 1643562372680595834
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:42:47 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5962 0
0 15ms
15ms Image
text/html 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQDNGVv-Amt1YiCeLhOn5OE7ppqdXWZRkVii8VZ-MnzDULo9k89AOE0GqtgQDiQheKVc5t4RBmVYIH2e7p3zxy1TAlA4g
Requested by: Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5962 121 KB
37 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f53136d93b874d5ba193020ce13caae15abba12c500047c98985c3334a5c8c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37626
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652269989122821"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 13 May 2022 17:50:01 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5962 42 B
63 B 40ms
40ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bf235UxdqEqGib_E2akpJjZ-Hs4vp4qryrMvJO1j2pWYnuTgEkTt03dH0cbNXf6SxZFlBRccDquB3sdp8Xvnc9ba-S2ZhqSKtU8kFUeRjYpC_GOvY

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5962 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 10 May 2022 08:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 292496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 May 2023 08:35:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5DF3 1 KB
749 B 9ms
8ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 15829
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 13:26:12 GMT
etag: 48472445140208031
expires: Sat, 14 May 2022 13:26:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 5962 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 166b689b3099dcfcaa56f0ea17167654569e6a8d556355b35cec05716a97a73e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2137
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELCjL8Jm0PjWb52F5mpMSX8&google_cver=1

43 B
61 B

31ms
22ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELCjL8Jm0PjWb52F5mpMSX8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhiIhpmxATAB&v=APEucNXoxtrNBPlLOuRuWjnx_9NNViQIJ-9wZNIvnxOHpQfVR9PDqioPc-y31Kcvhpw5mU3jmSzXmHY93jjbNc4PbCEGZRnuOJYtAD69vaeCkKxPESDvyyv3qo0v3KF8_K_Sx6vZrCDHZ4Va7AZRHicgtPGpWlR5PboIwQK2xrttozkZqEL34rs
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
via: 1.1 google
server: OXGW/18.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELCjL8Jm0PjWb52F5mpMSX8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 2137 43 B
305 B 45ms
23ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhiIhpmxATAB&v=APEucNXoxtrNBPlLOuRuWjnx_9NNViQIJ-9wZNIvnxOHpQfVR9PDqioPc-y31Kcvhpw5mU3jmSzXmHY93jjbNc4PbCEGZRnuOJYtAD69vaeCkKxPESDvyyv3qo0v3KF8_K_Sx6vZrCDHZ4Va7AZRHicgtPGpWlR5PboIwQK2xrttozkZqEL34rs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
server: OXGW/18.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 2137
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEImySM8nexEgvrY13RLt4TY&google_cver=1

23 B
172 B

35ms
35ms

Image
image/gif

104.89.28.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEImySM8nexEgvrY13RLt4TY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhiIhpmxATAB&v=APEucNXoxtrNBPlLOuRuWjnx_9NNViQIJ-9wZNIvnxOHpQfVR9PDqioPc-y31Kcvhpw5mU3jmSzXmHY93jjbNc4PbCEGZRnuOJYtAD69vaeCkKxPESDvyyv3qo0v3KF8_K_Sx6vZrCDHZ4Va7AZRHicgtPGpWlR5PboIwQK2xrttozkZqEL34rs
Protocol: H2
Server: 104.89.28.165 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-28-165.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
cache-control: max-age=0, no-cache, no-store
expires: Fri, 13 May 2022 17:50:01 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEImySM8nexEgvrY13RLt4TY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 2137 23 B
172 B 86ms
34ms Image
image/gif 104.89.28.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhiIhpmxATAB&v=APEucNXoxtrNBPlLOuRuWjnx_9NNViQIJ-9wZNIvnxOHpQfVR9PDqioPc-y31Kcvhpw5mU3jmSzXmHY93jjbNc4PbCEGZRnuOJYtAD69vaeCkKxPESDvyyv3qo0v3KF8_K_Sx6vZrCDHZ4Va7AZRHicgtPGpWlR5PboIwQK2xrttozkZqEL34rs
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.28.165 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-28-165.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
cache-control: max-age=0, no-cache, no-store
expires: Fri, 13 May 2022 17:50:01 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 88D5 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 41258
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 06:22:23 GMT
expires: Sat, 13 May 2023 06:22:23 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11579970159570582265/ Frame 0968 38 KB
6 KB 9ms
7ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e51ae319089c6762c2fa67f8264ee6547e413b1b9271c2f5f845e43e63a2082d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 467398
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5874
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 08 May 2022 08:00:03 GMT
expires: Mon, 08 May 2023 08:00:03 GMT
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5962 0
27 B 53ms
53ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstemH6tyfHQrr9FHaP4Gh3VXoUVWCqPffHZ2HTXOaQzNhCDnJpM4wjHrEcbWd8iT1E_F8o06Mb0T1cgkf3Yt-hgxkRq7Bx-mJVM3Kgfvwauv8xnT6dFCdH2-rCKUaETNVf5evVdMVwXCoMv5X1JTGeo4GQwuiAiD_ClTDydmICcJoXfTm5Au0Mc_mNc-iyGRd3XCFX3pc9aPHaGR0v9jnd2GOWuHUBpwe0iEA9arCnV6ZEXuWyOEyCdDq3P1tcqoxb2mXwuEjwtnxX_dC3J0qpHCgWe3SGjardReG3OEOstLPPVkulfRfQEQmGDj5s_i-U7gejEEv_Q69jM-Lxj9nNuWUBoAmMu9qhJM2lKV_yPOrh5pPPH6HcO5ae5mM6SnfrGSIb84l8Btxw1SZetLgjRtB1XY6l4J8ujWMwvc62RJelbY6XPqc71x9KiSgaeX6dFrJRjYj6Dlv5hU_TrlGd3XLbo_9dO6sM1-OTfcPeWV7Q0kh7S-FitDw8AFOxrbHCqsXRHjD80T_ABf-jpJcNbUxYAUy8dbILbvRccQi6zjNjXSuATz878giTxJgbaHQ_uzWk3SPUxnMTGWfeOtidK-GwcP0ZdXVrnNejMKuQBQBv8vJs0db5qo75-BRMS-aJ5Y1Az301OHZj5ZGnUAo0R_qfBlhoMjYvJW3PUqH4IH01Sq6EHzac-xHyUliDESrowsDtLMLS53v_te50Lp4QwY_a7Ez3O8o1-kZmabJZw87lqbb5mSONwp15wT41yXE4IzeJ-Xrl9rvdwwqJ5DVOt53zUhIoxmSpX7jHYhPgsQt5aATIADS4xqFPFd-wTLAWMEk8_03nWRijWAYc8OeRaBA7avr7VeXtDzg0Oq58KYL9JuqxGSzR6j0U5XgFqiq8n99aUu6ShLpOrYMglTZVH1l5yQXVgk1O8l2P7pDuYdgbt02SjbchO1h2ULCNPf_4kEw8r01XGjs7vR9e-VALWdzgO-gPoFjJw5nP8-sGNmY6vcqFAwWY1_9vPxsHhQSZyfn5D-NlP7dK1ryuJ8lyFGBqKTUmkZEHrvPB8iUe5n-Nd-99VkMgBfsk-JH-0jFQTS1MYfez26TgIjIYEvrIPVB4Fn5RmcfGtunmS9ZG5TRn8wRksPpcRSTmM40ex4eKlsEZ13US0wBBF10WbkuhxvXMkR64QTUICiyBjyeByQmDqc5IEN2vz&sai=AMfl-YS88wyEYT8-jgcrd8hYMY1_ViPD5Y97-iM9HyWmcpjKCjvldsKX5xEgtlCXKAAWA_MbBy3JgjHwpeltu9snEdxL-Cua9EJXC5F1SHGBQko3BGmlh77t9oO3RlesGs2Yvwyphg2JnC8mCuzIQEwM5bM-sU_slmuEjY7coTIx2oR7J4WjQ4gAnpUmeN4y5vKHR5AcFz6Guon-9mToucACpEoX4VFImEV8fqPAbf7lOzHdxr0AE_I9FYBuVzv85KGF6QR9hc-QDsc2-mtG855xuZdfQse2SLWaip07Wz0&sig=Cg0ArKJSzBQMU-X8q7prEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=40&cbvp=1&cstd=38&cisv=r20220511.41987&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 13 May 2022 17:50:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET activeview
pagead2.googlesyndication.com/pcs/ Frame F77A 0
0

GET
H3 200 container.html Show response
cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame DC74 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://filemodsbr.boasaude.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:00 GMT
expires: Sat, 13 May 2023 17:50:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 a8355064648aa7a1ab68278019a58f4a.js Show response
s0.2mdn.net/sadbundle/11579970159570582265/ Frame 0968 65 KB
17 KB 10ms
9ms Script
application/x-javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/a8355064648aa7a1ab68278019a58f4a.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ddcd6353390a194d3a68b5f7c2fbf5ccf142dbb32421c927042af27e9c400

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 10 May 2022 02:22:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 314851
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17337
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 10 May 2023 02:22:30 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 5DF3
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEG2UynKk_hhWEN-svnO08nw&google_cver=1&google_push=AYg5qPJehVJzlukSTOKXSE1MKCYTwUS-vLtWMF3OJbRNkyUFrvt8NRnTap61FgkQgKwaxhXXHOuvjSp3wnq-uCidKj0Lp42Fn1YT&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEG2UynKk_hhWEN-svnO08nw&google_cver=1&google_push=AYg5qPJehVJzlukSTOKXSE1MKCYTwUS-vLtWMF3OJbRNkyUFrvt8NRnTap61FgkQgKwaxhXXHOuvjSp3wnq-uCidKj0Lp42Fn1Y...

43 B
450 B

204ms
194ms

Image
image/gif

2606:4700:4400::6812:230b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEG2UynKk_hhWEN-svnO08nw&google_cver=1&google_push=AYg5qPJehVJzlukSTOKXSE1MKCYTwUS-vLtWMF3OJbRNkyUFrvt8NRnTap61FgkQgKwaxhXXHOuvjSp3wnq-uCidKj0Lp42Fn1YT&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJehVJzlukSTOKXSE1MKCYTwUS-vLtWMF3OJbRNkyUFrvt8NRnTap61FgkQgKwaxhXXHOuvjSp3wnq-uCidKj0Lp42Fn1YT%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 70ad3bee3e030200-ZRH
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 380
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 70ad3becec8c0200-ZRH
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEG2UynKk_hhWEN-svnO08nw&google_cver=1&google_push=AYg5qPJehVJzlukSTOKXSE1MKCYTwUS-vLtWMF3OJbRNkyUFrvt8NRnTap61FgkQgKwaxhXXHOuvjSp3wnq-uCidKj0Lp42Fn1YT&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJehVJzlukSTOKXSE1MKCYTwUS-vLtWMF3OJbRNkyUFrvt8NRnTap61FgkQgKwaxhXXHOuvjSp3wnq-uCidKj0Lp42Fn1YT%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 5DF3 0
191 B 103ms
22ms Image
text/plain 66.155.71.25
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEHfWbGxdNZh7uZ4x8GiPTZY&google_cver=1&google_push=AYg5qPJhvCuiWnonyuHzvOMJS1TtRmSrFHuOkaM9XOkTuEBjUtjov5QSxJibmKJANry8p9-7iA1joO9Q5kML5V1OQy18c7XXbIJT
Requested by: Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:00 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5DF3 0
12 B 31ms
29ms Image
text/html 142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LaVfwNRpM0Md7Uwamp7IspYi5Fre5qbFpL17c

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 401E 586 B
315 B 21ms
21ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjfyrvGATAB&v=APEucNV4Kub28j-3HKixeuKY08_51nRVFTFPPOBcQ-t3zePip3pTSQB77rsW74MmKhqEewZGcL5VfxVqxFz81hj9pmkTdG_minjBJ9i_9lRvFfSGjosz3Dcl_bXuF6h6iJuErBw6yuUQ42GKE1wFhcHvxqdoa1yiOlDyRkRtOLbz8YH1kc0T7qU

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f12c6133a12eead81c368fe146cb489bdb7331b5e3b5ceb9ea52eac1e3feb815

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 294
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DC74 14 KB
10 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DY7r3xAbC_WpXBpiUGrKuuId2xY5L916ArHutjbzyKrpGE7O7SxTbPoiQhO4p6F7P8s7RxUO2YLgNPXcBDJ1lM1SDGRwNKVIe1ZwWyDAbiQWjk3M3NUr372S7Yso-hvel_ERb-hrQK3bEEv3HTz3fsOEYx4Q&cry=1&dbm_d=AKAmf-Abctg_fH3BeVH1OKuRhoyY_Mw__cD_ympvprsQEW0Pua9CI1CcuKnhbGHxQpIgJRxpV7vVXGUPVuwGCl4e3ajNU2oy-AV5jXD2JV6VTsEHZErGyoDNi2T3xNvqP-iEZgdq0HNDL7dcRUDsUhy20wkZLnA_JKY5rEvLlpz7QuGyQTapTMFtlnfcVoIEs1-MxbLwaQnidZuyNEyvzx-5Z54mCTD7U2AE-9tKAY94LrFR25U7GAGS07feZWXQMZfO0Na4BxI_ZWaHPS4MzAFp8tc7xcSDlgt6oTPY7Xon1nYAAZ6VW_WSpE_t2thmeb--6QQKLPOqStQittr4DlwzDHelNPqdNAF82BwM9mvjyfjEmPWtN5Ocht2gSAdrdGuUcH6h02ynwgaPRGz22bPZsYGSX3sdy8V0b38LdrU47fzlTwIB-KE1tlGQ9ICCbzA0InFATbAMMxgmqSoQhNjeo5xLfC-yebxWavEa7yeM72ZqDlQR35L-5JWkN_W4uKL3rZT_qMV9cWk4-_FVhOmUqsBuNbraUv3ZymDXTCg9HEM25ZthJjNQ4R93f68_V1R_0zWtoDlfu-YLcOvqaw_Mny-MZF1CbyWS4-C5jOhSmnKaVPlYmVDmdSkmyX4Cf6P048mtYk2FmwWskfiCrCj4ffOf1MVYtZT7Ic4ZzrJU7wyTE3MTq9QVJJcjCzEunYUCJGw7wV67RxxnAjvlAb_w4qmW18rRso9Ka-ne0r9gq2vXY6xtblkhTH-HNF4AzFasFHExr65dJi5w2vevCNdJ2ODI-5x9tRuAMKDgOtTmHuRavhmYlMjCwXzYMwyUVCI_VrfPfrtMgdDsLyYR4cS8rlkJqpPiM1Qon3ruSXue1P8Wehj1cu0KOMKOanxX2vDj9dhz_xk3JKpQ_1ErF7lw_sGJv53OfRkze9SKaE3bOQAbhgeMyupJng6LgGPLZE7OdJiZTaZawse-dtXrcZmg8tVnNOi9oTkDkhnG0iv5rJYTKFO-Vv7u99cVUwKx_R1sskJWO2jGksvBllyLx0viG6ASJtFlGDGg122kn1urYiNTbxOgAlM0i_lmwvI8d_55kODQCI0vfsKu-f_GNIVPnnzYMnfVvPoa5rGK-iadc_fvgq_D8N639k3fll9UNcaPrwd4FZU7CcKWuhvt8doKlQwZHR8_qxrzqA93S5vg1Qh3Lz1V9LYrgsG2EGpL7KvazXTAWt4dEgvLw9D5XZArrQyExNlGvtd39fQq8e41cug1tCvkAsNvf4ORJS1o1SS0Exp-l9SzDyyzfD0JTnYOYgSI5ZYagyJuZkXoNVOXre4mgXPGg5XyE06ubkHakbX7u5aehyhxRR8CGyasm3CnukmTeKaeLFSoWT1lJRpwS3Eao6vgSVlcTituU-hUfqCpjHaBEBjVXvKUL_tH5_haJtg1knPwBPs-Ovft3Rzri02dyJ7XTovyu_ETwfOmQA_k1yB6TWziiPAXLVNPFrmZVEdJ7pDZlZViTUZkM8oRvHqzMqLmDrfZ9x7wHlc4XA_rTdWpR6xtFurhFKjxh-UgjYgMEHnxBWFLosf0WedxEJm0IKL-vCtmvpBDNM2VQVL1crqSIrPaENyB0rpCYztcPBe3fgEJQX6v9nUQNEcohvUKu0k9_vX5NDHEN2XOoUd8jdby7FKgh4lSQDqS4b9AdH1TKdja7z0cG3z9G1k4zEEpfKc7c6sTmocTD3-vaAHfa7dDXHsr-sZ-FFb6tx_t1CkSK8pcc4_YXKpyd3VgfqUAT-WqZJ0_lniHnGLpVueYdZk9W-dpPzeRxdR5uZD9W7s5QjehMQTqXaKAdXeOPqWkXQlewciXC78BwKtyKuEf0ww6c90ya82fpjGPuqIAk8u-TdUDYHia7aKa7JTGYXTTQGNZnkqJ4IJfnO4vuP-tOxYAs-AYvhcgM1q0tDZM0cSqkcTxAgP87N1_QkWoE9IBH2Cw_Q751YJgliEos4i6JLyqSGgkGnVIund_ExaUoRBlB-vaWD-krDvs2TCYS3IImy9SPoX2RA5JAV3CuJo002ptozPQgvn76dqDG3bhx029ZaJNwH-j7cU2uAm3Buc-F35WVvJDi1MfzWR3S6SsLplLk2-X6RrFRIc2z-ItnUx1Vv6snu8UE9-dUhAvEGYyixwu-90Yrqx_MAleApTd719jQ4xpa19tIkKlIydoDTJsrayD_WN8Oi8jnZgw8QfEzf3K5Tft_5ffeeks4o67fbiTAuTUSc7-ofNnOlD2tBbj4c1T8wN3PgkulPvPHW5c_JOBk3vaYWFhFlozNn8y3Lzp7x17olZwE6n1d38V1cAZc44QMpRzurIs1Wyvs4e-1u2F5jTcCa4fN-_LKAAFc3pH3B9hbad-l0mAHYc0lUdpBZwCrwggyIdDLCYpQAzd6udee-MKfjBaJFfn2maiNBudD_IFBBljON1bURzp3BUjIMTsrHtjVGpKu8AaUzKk_PC7pp8TrjVLVeBJqXYrmc6C47dHgtWFgfyg1lWXi9vmh7fjQjZ6K_Dso3C4cFhkD3z7BzBo2kAV3qf8VZ6b-ZWbeFWwe6eh_yhTcCsBt0fZYSBJNI6EwetEm9ZGkneYHDjeuTKmspb7CM2kegXVZN6sRYPGdl16oIa6Lzv-zovOc7YfobUHbirHgdol7KLi7TiQLL_p-V79TaK6SmnCBBu9XLPKstDLaUSaR6-gZf_1wF0Q6fcJJuKiSx9uZ63tf-dnqAbxZqy8XWsBRq2-mq3_sd6vDiFvyc6wIrCn0TdShE52BW3RAD5MRYSQf7Qo7xg6geEx5YPqrMsEdgJK_UD_0MhrilvP43sh9ANPqNl-XPiD0FBCJLF14CZn0Y6dX_xyd6EVvxKrfsbIopQX7njjOfn8H3VlMkPlF_YCxFDzhg3m0xiamw-OFqBoMWnjQeJBsWM_5iKO7K4QWaMoseSL28ngaLREKqBpxJl5jdV51FpAv5th6W_VThuGFBzUHKzOy7nx2k3gf6IGiRrlaPgREKAe9H6jOK3BcAtD7LF3clXPHfsalaRzSWhqQun032iUjv_1-97qacwLGFp4c9mRStd8-NhJadyYXrqWlLWA7SPhcqVlRzLhZdAmqpoVkf91-oN1AcaxBAnhmlsj_wLBbU0e71zzMQwcCb92YKe5kej1p2bZdSFZpTApldmWZKEP6D9g8DQjyrL2JcEUDKgt9xHnGy-Cz94EK3BghEh7DkhiQOx5fToMyh9Mesu9y8KFKh6szm0qMLH67sodP80_lnXM&cid=CAASJORoUcVTF_xOIfvu01C5XH_-Am15J3hnsdjJ9GG-77usisf6Lw&rfl=1%2Chttps%253A%252F%252Ffilemodsbr.boasaude.top%252F%240

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

472e7914fb6d3faa9558d8f87b6ece3302e5eb6736abc8e0d607f6d296122714

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10599
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DC74 42 B
63 B 39ms
39ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BWurX4IyY567ja-OoGcnRNCGgSz6irhFNS6c3yAFo7PXy6Ri8nQek1MWp0GSZ7CcAB0J6IPjUqeMmcQD-1_RuWRaUziIvjDcJSIA9h-PKCxKmi-bU

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame DC74 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/window_focus_fy2019.js

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:46:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:46:53 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame DC74 15 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

965195159be784009cc31e4aff2505c066643cf8cdc99df7f56c2eab2abeda82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 434
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6412
x-xss-protection: 0
server: cafe
etag: 1643562372680595834
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 27 May 2022 17:42:47 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DC74 0
0 16ms
15ms Image
text/html 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTHnFB0CpaRAL2_uxowLwXqb12byvRIpFtMTTEskGC6zU3fO2koLet336M0zkjknhwJQVxo2uuyPNxyLbKfXoGqXrv27A
Requested by: Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DC74 121 KB
37 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f53136d93b874d5ba193020ce13caae15abba12c500047c98985c3334a5c8c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37626
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652269989122821"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 13 May 2022 17:50:01 GMT

GET
H3 200 Yd3cEgPtLOfKcy7GxWkHziCM9jl-6RVWGk-YTJsF5Kc.js Show response
pagead2.googlesyndication.com/bg/ Frame 88D5 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yd3cEgPtLOfKcy7GxWkHziCM9jl-6RVWGk-YTJsF5Kc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61dddc1203ed2ce7ca732ec6c56907ce208cf6397ee915561a4f984c9b05e4a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:01:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2925
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13574
x-xss-protection: 0
last-modified: Mon, 09 May 2022 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 13 May 2023 17:01:16 GMT

GET
H3 200 c9b81def51feb7e0425e93720bc43f33.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 4 KB
2 KB 9ms
7ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/c9b81def51feb7e0425e93720bc43f33.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec097aca3533bc67ba3f8a2ad5aa84337956c0097a37b253098f4b3dfb8ecd36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1527
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 9d041072092fa59ca88c5499c7d5a0c0.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 1 KB
604 B 15ms
12ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/9d041072092fa59ca88c5499c7d5a0c0.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341bfe7ab41e39dcc51bc37f5ded087569b6bcd9cd18ddb6ae72e453dcae39e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 575
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 3212338bb0be0b574ad231e216e32f4c.jpg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 6 KB
6 KB 13ms
9ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/3212338bb0be0b574ad231e216e32f4c.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e01229bbb5b2f75d84278ab92afb8d3613223493bb7f58700b7f26b5bd7c71d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 01:21:59 GMT
x-content-type-options: nosniff
age: 59282
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6140
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 13 May 2023 01:21:59 GMT

GET
H3 200 4a532b5fd6e760358f181fd4c94c03af.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 3 KB
992 B 14ms
10ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/4a532b5fd6e760358f181fd4c94c03af.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a5eb5c1ae0109e7938c686f26feb14a879910c40369ffea20bf11454d8a120e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 963
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 46a20774c1da411f51bca4b8ca9b3774.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 2 KB
751 B 14ms
10ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/46a20774c1da411f51bca4b8ca9b3774.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

475316d3002b7bf04d39e01825b8443b2748411e616908cbc2a87e49faa1f1ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 722
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 41086e9e644dfd6edb1dee1a27276fbe.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 1 KB
518 B 16ms
12ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/41086e9e644dfd6edb1dee1a27276fbe.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06e0e91a01af508f9eb830feafe8dbf0b381e0333ce3667489e6cf48809c927b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 489
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 edab4929a40146fb821d586457d137e6.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 5 KB
2 KB 15ms
11ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/edab4929a40146fb821d586457d137e6.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5c486bf7d530918b59fe569c9b232ff2356ec265bdd25c3977a4dbbd9da123e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1633
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 9c31fe11844006970ffaccbcad1fd41f.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 4 KB
2 KB 15ms
12ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/9c31fe11844006970ffaccbcad1fd41f.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43a9a2154c658cf0a3a1aebe3d5ce4ea817564fc27e85b90f2651cf46f37deda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1712
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 756d757e6528c3a0a9338cc41f9a61b1.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 299 B
256 B 19ms
15ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/756d757e6528c3a0a9338cc41f9a61b1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

572bc0584a0476c0e03db0b475dcf119873378e8e950ddd66ba027264432f2b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 227
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 20cd3c9c87a3dcad42074ff89b4391e0.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 8 KB
2 KB 17ms
13ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/20cd3c9c87a3dcad42074ff89b4391e0.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16dde9a1942cbd39c1f882ebd1e6f3768b933c64051c589feb1243c4fcd050ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2458
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 ccddd80afeb32369f13a2e1a87086966.png
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 2 KB
2 KB 17ms
14ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/ccddd80afeb32369f13a2e1a87086966.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b78344a18cc46582ecbd6c65057aa0d36c76a8f2d9d23a738eba4a905f27a51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 10 May 2022 01:44:27 GMT
x-content-type-options: nosniff
age: 317134
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1855
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 10 May 2023 01:44:27 GMT

GET
H3 200 d4759bcbd6e2fc771310419f7fc638e2.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 921 B
423 B 18ms
15ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/d4759bcbd6e2fc771310419f7fc638e2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf6723bc6fdabc360afa8360ff6fa68bbaf5678344c2ef5367019c1c68f9e39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 394
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 be2b5c351419b2f7c03f69e7ec92ff4d.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 765 B
452 B 18ms
14ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/be2b5c351419b2f7c03f69e7ec92ff4d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5747c3811adc4308396178b6d5133ba0a3d1fbf75cb34408516070f334328020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 423
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 563d35e070b536fe99ac6f90cc143021.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 262 B
219 B 17ms
14ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/563d35e070b536fe99ac6f90cc143021.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f824255471c27fa4d1711fb3dc95cd1abb01d4267cddb88a80da9de0ad9e568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 b2fd061c261eb0e777cafda26676ca70.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 584 B
376 B 15ms
12ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/b2fd061c261eb0e777cafda26676ca70.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b64cb33a2123464bcac5582bdbfc206899c514c0dabf159a6ec0c86acef122f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 347
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 0cde5efc0567bcab21474422961ea657.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 904 B
400 B 19ms
17ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/0cde5efc0567bcab21474422961ea657.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce4076cd760ba035ee9d326f3a1bf9157dfeac50fb058a9aedfe53b2fd10ad91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 371
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 e2b684e2986ea6141e36de2511a816c1.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 1 KB
627 B 19ms
16ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/e2b684e2986ea6141e36de2511a816c1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aca9d549981e9a27a786545ba75fed3bc70738752aa299e95af6669f199464a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 598
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 401E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDsRRypR_gOkNE1Hc0aaR7o&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDsRRypR_gOkNE1Hc0aaR7o&google_cver=1&__user_check__=1&sync_id=1d19e0f0-d2e5-11ec-9c8e-10d4c6b20306

43 B
549 B

25ms
24ms

Image
image/gif

185.94.180.126
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDsRRypR_gOkNE1Hc0aaR7o&google_cver=1&__user_check__=1&sync_id=1d19e0f0-d2e5-11ec-9c8e-10d4c6b20306
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjfyrvGATAB&v=APEucNV4Kub28j-3HKixeuKY08_51nRVFTFPPOBcQ-t3zePip3pTSQB77rsW74MmKhqEewZGcL5VfxVqxFz81hj9pmkTdG_minjBJ9i_9lRvFfSGjosz3Dcl_bXuF6h6iJuErBw6yuUQ42GKE1wFhcHvxqdoa1yiOlDyRkRtOLbz8YH1kc0T7qU
Protocol: HTTP/1.1
Server: 185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Fri, 13 May 2022 17:50:01 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 144
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 13 May 2022 17:50:01 GMT
Server: nginx
Location: /partner?adv_id=7025&uid=CAESEDsRRypR_gOkNE1Hc0aaR7o&google_cver=1&__user_check__=1&sync_id=1d19e0f0-d2e5-11ec-9c8e-10d4c6b20306
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 11
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 401E
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MWQxOWRhZTItZDJlNS0xMWVjLTk2ZDktMTNhZTE3ZGMwNDA2

170 B
188 B

30ms
29ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MWQxOWRhZTItZDJlNS0xMWVjLTk2ZDktMTNhZTE3ZGMwNDA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjfyrvGATAB&v=APEucNV4Kub28j-3HKixeuKY08_51nRVFTFPPOBcQ-t3zePip3pTSQB77rsW74MmKhqEewZGcL5VfxVqxFz81hj9pmkTdG_minjBJ9i_9lRvFfSGjosz3Dcl_bXuF6h6iJuErBw6yuUQ42GKE1wFhcHvxqdoa1yiOlDyRkRtOLbz8YH1kc0T7qU

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 13 May 2022 17:50:01 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MWQxOWRhZTItZDJlNS0xMWVjLTk2ZDktMTNhZTE3ZGMwNDA2
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 14
Connection: keep-alive
Content-Length: 0

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55946/ Frame 401E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_dbm&_origin=1
https://pixel.advertising.com/ups/55946/sync?uid=CAESEJ4dr1CBRcy4V9ZJKkzVyOc&_origin=1&google_cver=1
https://pixel.advertising.com/ups/55946/sync?uid=CAESEJ4dr1CBRcy4V9ZJKkzVyOc&_origin=1&google_cver=1&verify=true
https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEJ4dr1CBRcy4V9ZJKkzVyOc&_origin=1&google_cver=1&apid=UP1d114f22-d2e5-11ec-bf71-06c845b44618
https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEJ4dr1CBRcy4V9ZJKkzVyOc&_origin=1&google_cver=1&apid=UP1d114f22-d2e5-11ec-bf71-06c845b44618&verify=true

0
17 B

9ms
9ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEJ4dr1CBRcy4V9ZJKkzVyOc&_origin=1&google_cver=1&apid=UP1d114f22-d2e5-11ec-bf71-06c845b44618&verify=true

Requested by

Protocol

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.0.46 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
server: ATS/9.1.0.46
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEJ4dr1CBRcy4V9ZJKkzVyOc&_origin=1&google_cver=1&apid=UP1d114f22-d2e5-11ec-bf71-06c845b44618&verify=true
date: Fri, 13 May 2022 17:50:01 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 401E
Redirect Chain

https://pixel.advertising.com/ups/55946/sync?_origin=1&redir=true
https://pixel.advertising.com/ups/55946/sync?_origin=1&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/55946/sync?_origin=1&redir=true&apid=UP1d114f22-d2e5-11ec-bf71-06c845b44618
https://ups.analytics.yahoo.com/ups/55946/sync?_origin=1&redir=true&apid=UP1d114f22-d2e5-11ec-bf71-06c845b44618&verify=true
https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVAxZDExNGYyMi1kMmU1LTExZWMtYmY3MS0wNmM4NDViNDQ2MTg%3D

170 B
188 B

31ms
31ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVAxZDExNGYyMi1kMmU1LTExZWMtYmY3MS0wNmM4NDViNDQ2MTg%3D

Requested by

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVAxZDExNGYyMi1kMmU1LTExZWMtYmY3MS0wNmM4NDViNDQ2MTg%3D
date: Fri, 13 May 2022 17:50:01 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 200 1f919b0412977966595ef751686a6826.svg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 4 KB
1 KB 8ms
8ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/1f919b0412977966595ef751686a6826.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c24a4ad3d4e23f8037feb38744e17fabeb0c2d3b5714c049d091dfc5f6811280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 08 May 2022 18:19:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430252
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1396
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 08 May 2023 18:19:09 GMT

GET
H3 200 16e2073035968668e0268512ee5031a5.jpg
s0.2mdn.net/sadbundle/11579970159570582265/media/ Frame 0968 17 KB
17 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11579970159570582265/media/16e2073035968668e0268512ee5031a5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bfd1106b87f96ff783e71e722d5ea8cd707006bca6b293d2860c20e03cf864e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11579970159570582265/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 09 May 2022 23:29:19 GMT
x-content-type-options: nosniff
age: 325242
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17252
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 16:09:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 09 May 2023 23:29:19 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DC74 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DY7r3xAbC_WpXBpiUGrKuuId2xY5L916ArHutjbzyKrpGE7O7SxTbPoiQhO4p6F7P8s7RxUO2YLgNPXcBDJ1lM1SDGRwNKVIe1ZwWyDAbiQWjk3M3NUr372S7Yso-hvel_ERb-hrQK3bEEv3HTz3fsOEYx4Q&cry=1&dbm_d=AKAmf-Abctg_fH3BeVH1OKuRhoyY_Mw__cD_ympvprsQEW0Pua9CI1CcuKnhbGHxQpIgJRxpV7vVXGUPVuwGCl4e3ajNU2oy-AV5jXD2JV6VTsEHZErGyoDNi2T3xNvqP-iEZgdq0HNDL7dcRUDsUhy20wkZLnA_JKY5rEvLlpz7QuGyQTapTMFtlnfcVoIEs1-MxbLwaQnidZuyNEyvzx-5Z54mCTD7U2AE-9tKAY94LrFR25U7GAGS07feZWXQMZfO0Na4BxI_ZWaHPS4MzAFp8tc7xcSDlgt6oTPY7Xon1nYAAZ6VW_WSpE_t2thmeb--6QQKLPOqStQittr4DlwzDHelNPqdNAF82BwM9mvjyfjEmPWtN5Ocht2gSAdrdGuUcH6h02ynwgaPRGz22bPZsYGSX3sdy8V0b38LdrU47fzlTwIB-KE1tlGQ9ICCbzA0InFATbAMMxgmqSoQhNjeo5xLfC-yebxWavEa7yeM72ZqDlQR35L-5JWkN_W4uKL3rZT_qMV9cWk4-_FVhOmUqsBuNbraUv3ZymDXTCg9HEM25ZthJjNQ4R93f68_V1R_0zWtoDlfu-YLcOvqaw_Mny-MZF1CbyWS4-C5jOhSmnKaVPlYmVDmdSkmyX4Cf6P048mtYk2FmwWskfiCrCj4ffOf1MVYtZT7Ic4ZzrJU7wyTE3MTq9QVJJcjCzEunYUCJGw7wV67RxxnAjvlAb_w4qmW18rRso9Ka-ne0r9gq2vXY6xtblkhTH-HNF4AzFasFHExr65dJi5w2vevCNdJ2ODI-5x9tRuAMKDgOtTmHuRavhmYlMjCwXzYMwyUVCI_VrfPfrtMgdDsLyYR4cS8rlkJqpPiM1Qon3ruSXue1P8Wehj1cu0KOMKOanxX2vDj9dhz_xk3JKpQ_1ErF7lw_sGJv53OfRkze9SKaE3bOQAbhgeMyupJng6LgGPLZE7OdJiZTaZawse-dtXrcZmg8tVnNOi9oTkDkhnG0iv5rJYTKFO-Vv7u99cVUwKx_R1sskJWO2jGksvBllyLx0viG6ASJtFlGDGg122kn1urYiNTbxOgAlM0i_lmwvI8d_55kODQCI0vfsKu-f_GNIVPnnzYMnfVvPoa5rGK-iadc_fvgq_D8N639k3fll9UNcaPrwd4FZU7CcKWuhvt8doKlQwZHR8_qxrzqA93S5vg1Qh3Lz1V9LYrgsG2EGpL7KvazXTAWt4dEgvLw9D5XZArrQyExNlGvtd39fQq8e41cug1tCvkAsNvf4ORJS1o1SS0Exp-l9SzDyyzfD0JTnYOYgSI5ZYagyJuZkXoNVOXre4mgXPGg5XyE06ubkHakbX7u5aehyhxRR8CGyasm3CnukmTeKaeLFSoWT1lJRpwS3Eao6vgSVlcTituU-hUfqCpjHaBEBjVXvKUL_tH5_haJtg1knPwBPs-Ovft3Rzri02dyJ7XTovyu_ETwfOmQA_k1yB6TWziiPAXLVNPFrmZVEdJ7pDZlZViTUZkM8oRvHqzMqLmDrfZ9x7wHlc4XA_rTdWpR6xtFurhFKjxh-UgjYgMEHnxBWFLosf0WedxEJm0IKL-vCtmvpBDNM2VQVL1crqSIrPaENyB0rpCYztcPBe3fgEJQX6v9nUQNEcohvUKu0k9_vX5NDHEN2XOoUd8jdby7FKgh4lSQDqS4b9AdH1TKdja7z0cG3z9G1k4zEEpfKc7c6sTmocTD3-vaAHfa7dDXHsr-sZ-FFb6tx_t1CkSK8pcc4_YXKpyd3VgfqUAT-WqZJ0_lniHnGLpVueYdZk9W-dpPzeRxdR5uZD9W7s5QjehMQTqXaKAdXeOPqWkXQlewciXC78BwKtyKuEf0ww6c90ya82fpjGPuqIAk8u-TdUDYHia7aKa7JTGYXTTQGNZnkqJ4IJfnO4vuP-tOxYAs-AYvhcgM1q0tDZM0cSqkcTxAgP87N1_QkWoE9IBH2Cw_Q751YJgliEos4i6JLyqSGgkGnVIund_ExaUoRBlB-vaWD-krDvs2TCYS3IImy9SPoX2RA5JAV3CuJo002ptozPQgvn76dqDG3bhx029ZaJNwH-j7cU2uAm3Buc-F35WVvJDi1MfzWR3S6SsLplLk2-X6RrFRIc2z-ItnUx1Vv6snu8UE9-dUhAvEGYyixwu-90Yrqx_MAleApTd719jQ4xpa19tIkKlIydoDTJsrayD_WN8Oi8jnZgw8QfEzf3K5Tft_5ffeeks4o67fbiTAuTUSc7-ofNnOlD2tBbj4c1T8wN3PgkulPvPHW5c_JOBk3vaYWFhFlozNn8y3Lzp7x17olZwE6n1d38V1cAZc44QMpRzurIs1Wyvs4e-1u2F5jTcCa4fN-_LKAAFc3pH3B9hbad-l0mAHYc0lUdpBZwCrwggyIdDLCYpQAzd6udee-MKfjBaJFfn2maiNBudD_IFBBljON1bURzp3BUjIMTsrHtjVGpKu8AaUzKk_PC7pp8TrjVLVeBJqXYrmc6C47dHgtWFgfyg1lWXi9vmh7fjQjZ6K_Dso3C4cFhkD3z7BzBo2kAV3qf8VZ6b-ZWbeFWwe6eh_yhTcCsBt0fZYSBJNI6EwetEm9ZGkneYHDjeuTKmspb7CM2kegXVZN6sRYPGdl16oIa6Lzv-zovOc7YfobUHbirHgdol7KLi7TiQLL_p-V79TaK6SmnCBBu9XLPKstDLaUSaR6-gZf_1wF0Q6fcJJuKiSx9uZ63tf-dnqAbxZqy8XWsBRq2-mq3_sd6vDiFvyc6wIrCn0TdShE52BW3RAD5MRYSQf7Qo7xg6geEx5YPqrMsEdgJK_UD_0MhrilvP43sh9ANPqNl-XPiD0FBCJLF14CZn0Y6dX_xyd6EVvxKrfsbIopQX7njjOfn8H3VlMkPlF_YCxFDzhg3m0xiamw-OFqBoMWnjQeJBsWM_5iKO7K4QWaMoseSL28ngaLREKqBpxJl5jdV51FpAv5th6W_VThuGFBzUHKzOy7nx2k3gf6IGiRrlaPgREKAe9H6jOK3BcAtD7LF3clXPHfsalaRzSWhqQun032iUjv_1-97qacwLGFp4c9mRStd8-NhJadyYXrqWlLWA7SPhcqVlRzLhZdAmqpoVkf91-oN1AcaxBAnhmlsj_wLBbU0e71zzMQwcCb92YKe5kej1p2bZdSFZpTApldmWZKEP6D9g8DQjyrL2JcEUDKgt9xHnGy-Cz94EK3BghEh7DkhiQOx5fToMyh9Mesu9y8KFKh6szm0qMLH67sodP80_lnXM&cid=CAASJORoUcVTF_xOIfvu01C5XH_-Am15J3hnsdjJ9GG-77usisf6Lw&rfl=1%2Chttps%253A%252F%252Ffilemodsbr.boasaude.top%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 10 May 2022 08:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 292496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 May 2023 08:35:05 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 736C 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstYv5F_ge527CTA1zO_IVxO_JPj27fKcKoJsY79ivevSMR2dNZTAP6YALYDDzNffeslLgiT_BeGdjQNwjGqjIbkddVOEMovctrw69EQzC8leHI&sai=AMfl-YQqWuphDnEXzvQ8PkE6PdFsdUq_tJaXE8WaRn-uTfiFW-mHCxIH6y9X32Rol27xH2j2KNPFiPebeuobCNyIN0Asy74fyJBusR8RN7_-KkSbnD8S8A3U003t86_RCKEk&sig=Cg0ArKJSzMNd0G4pnpM_EAE&cid=CAASKORote9cDBOYwNl_ddLrrcqJdx5rDLOVXmayMenGMpfp_5M_ifc6TEc&id=lidar2&mcvt=1016&p=804,1002,1476,1302&mtos=0,0,1016,1016,1016&tos=0,0,1016,0,0&v=20220511&bin=7&avms=nio&bs=0,0&mc=0.59&if=1&vu=1&app=0&itpl=20&adk=3248737131&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652464200620&rpt=172&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 1gnfsk4df5lz Show response
hal9000.redintelligence.net/zone/ Frame DC74 11 KB
4 KB 45ms
13ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/1gnfsk4df5lz?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCuYLoSZp-YtzPIIzP3gOmg5XADKblvaBp7ZKcp8kP8C4QASD_vu4sYJXikIKgB8gBCakCLtwKvpttsT6oAwGqBOwBT9C6d2J1r2AY-VZ7O137jIMKQN-JuNw3tDbxYKlgf6w9ZMOkUxiUScTQenYxARCjU484YuR511D_DQ5Ha2RJcLBtpTrtuWedq4lmVwa4BkVkDH2v9djrSq8OZfmJUJ2Fe4nu1pSg63r5nNR5SQY-SUHuN9x1FG7YXWgW7Yn0SJPaGxGT0ZmgRGpZlcpH76SHRPCN6PnsohMTFj95e0CYRIkRBmEarAtmIUgkQmuOtRZ3Xn3HBlxW_rJVyxpuz8xzIfvY98NS2IcwjDw2terQ5TCD3HHYx4xKCmDHhpJM2gbCSE8SNxT2UxM89TXABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJORoUcVTF_xOIfvu01C5XH_-Am15J3hnsdjJ9GG-77usisf6Lw%26sig%3DAOD64_2AxpNyMeDvhtzoDhqGVsO2SZ12RQ%26client%3Dca-pub-3423085545296231%26dbm_c%3DAKAmf-C64YdQQWYVtdoCCMHFG2B4csQnuBWMJiZcmz2jU8HoiHtp5gDzHCbs5wDqwyEaltDSivFEoPEyBmmp2ukFvfaRCJWIwSJI7pgkqnvHzGl5aNRrkalKg5IX56h4iLDS1y88V-I9yksyq8m37z13G-GPToWiYw%26cry%3D1%26dbm_d%3DAKAmf-AjMCclBxWl9qw8ulIgwdceSBsV-X2R08b-LdoYN-ed0d91iyDj2NQtDG1KOnyxTjktYk8TJfY2EbC-nV4xbiGf3PIIoIPxTOL2hL_Rf57EuTsJ_sUc1BfhS53GJONlr6bRak6p_wLfFMgsW569P-it_LxeDqK6bi54zf3nhhrJzLyvUo_mVD1q5u1wvzNsdWL7gOapUxXVPyoNF6l-Tpy4dWpwzpcc5h2wYQea4x3uitlxwAVA-reTng0vbBT3H-fYOLHNb9QDULwWq7k4H4gi5Uo_XEjSnpOGEhhLYqwx4qoWWEhbAu6QwkykvhK-4rAWlXsxuCKdpyhxwYY57vxgrZ1LRuyw56MJg2PW_FEOHVxmnrPsU5Z9RsUuhCEhfBMnRzy9foaO3z87FyxB4TmZvyFGjP8iLDQjA4qsJjcHmsRAz8HjWSLiygYr44D6wDXlyrzW1ZHx8qKw07gOIhK3XF2N5Q%26adurl%3D
Requested by: Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 67fc47926246541d2cd2275eb2b624cc1d44b9826840ed3031877e2a2786a45d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Fri, 13 May 2022 17:50:01 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3943
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5962 0
26 B 44ms
44ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstemH6tyfHQrr9FHaP4Gh3VXoUVWCqPffHZ2HTXOaQzNhCDnJpM4wjHrEcbWd8iT1E_F8o06Mb0T1cgkf3Yt-hgxkRq7Bx-mJVM3Kgfvwauv8xnT6dFCdH2-rCKUaETNVf5evVdMVwXCoMv5X1JTGeo4GQwuiAiD_ClTDydmICcJoXfTm5Au0Mc_mNc-iyGRd3XCFX3pc9aPHaGR0v9jnd2GOWuHUBpwe0iEA9arCnV6ZEXuWyOEyCdDq3P1tcqoxb2mXwuEjwtnxX_dC3J0qpHCgWe3SGjardReG3OEOstLPPVkulfRfQEQmGDj5s_i-U7gejEEv_Q69jM-Lxj9nNuWUBoAmMu9qhJM2lKV_yPOrh5pPPH6HcO5ae5mM6SnfrGSIb84l8Btxw1SZetLgjRtB1XY6l4J8ujWMwvc62RJelbY6XPqc71x9KiSgaeX6dFrJRjYj6Dlv5hU_TrlGd3XLbo_9dO6sM1-OTfcPeWV7Q0kh7S-FitDw8AFOxrbHCqsXRHjD80T_ABf-jpJcNbUxYAUy8dbILbvRccQi6zjNjXSuATz878giTxJgbaHQ_uzWk3SPUxnMTGWfeOtidK-GwcP0ZdXVrnNejMKuQBQBv8vJs0db5qo75-BRMS-aJ5Y1Az301OHZj5ZGnUAo0R_qfBlhoMjYvJW3PUqH4IH01Sq6EHzac-xHyUliDESrowsDtLMLS53v_te50Lp4QwY_a7Ez3O8o1-kZmabJZw87lqbb5mSONwp15wT41yXE4IzeJ-Xrl9rvdwwqJ5DVOt53zUhIoxmSpX7jHYhPgsQt5aATIADS4xqFPFd-wTLAWMEk8_03nWRijWAYc8OeRaBA7avr7VeXtDzg0Oq58KYL9JuqxGSzR6j0U5XgFqiq8n99aUu6ShLpOrYMglTZVH1l5yQXVgk1O8l2P7pDuYdgbt02SjbchO1h2ULCNPf_4kEw8r01XGjs7vR9e-VALWdzgO-gPoFjJw5nP8-sGNmY6vcqFAwWY1_9vPxsHhQSZyfn5D-NlP7dK1ryuJ8lyFGBqKTUmkZEHrvPB8iUe5n-Nd-99VkMgBfsk-JH-0jFQTS1MYfez26TgIjIYEvrIPVB4Fn5RmcfGtunmS9ZG5TRn8wRksPpcRSTmM40ex4eKlsEZ13US0wBBF10WbkuhxvXMkR64QTUICiyBjyeByQmDqc5IEN2vz&sai=AMfl-YS88wyEYT8-jgcrd8hYMY1_ViPD5Y97-iM9HyWmcpjKCjvldsKX5xEgtlCXKAAWA_MbBy3JgjHwpeltu9snEdxL-Cua9EJXC5F1SHGBQko3BGmlh77t9oO3RlesGs2Yvwyphg2JnC8mCuzIQEwM5bM-sU_slmuEjY7coTIx2oR7J4WjQ4gAnpUmeN4y5vKHR5AcFz6Guon-9mToucACpEoX4VFImEV8fqPAbf7lOzHdxr0AE_I9FYBuVzv85KGF6QR9hc-QDsc2-mtG855xuZdfQse2SLWaip07Wz0&sig=Cg0ArKJSzBQMU-X8q7prEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=215&vt=11&dtpt=175&dett=3&cstd=38&cisv=r20220511.41987&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5A0D 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 41258
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 06:22:23 GMT
expires: Sat, 13 May 2023 06:22:23 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 NhRng2ZenZRcaPRuU0zAmqgyTOhBGXWeehn8uWk0bEI.js Show response
pagead2.googlesyndication.com/bg/ Frame 5A0D 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NhRng2ZenZRcaPRuU0zAmqgyTOhBGXWeehn8uWk0bEI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36146783665e9d945c68f46e534cc09aa8324ce84119759e7a19fcb969346c42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 10:31:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26336
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13698
x-xss-protection: 0
last-modified: Mon, 09 May 2022 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 13 May 2023 10:31:05 GMT

GET
H/1.1

200
OK

request.php Show response
hal900030.redintelligence.net/ Frame DC74
Redirect Chain

https://hal900030.redintelligence.net/request.php?zone=1gnfsk4df5lz&nw=20&renderingType=javascript&namespace=304cd8eb33&subid=&uid=3077d40204b3021c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900030.redintelligence.net/request.php?zone=1gnfsk4df5lz&nw=20&renderingType=javascript&namespace=304cd8eb33&subid=&uid=3077d40204b3021c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

143ms
121ms

Script
application/x-javascript

136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/request.php?zone=1gnfsk4df5lz&nw=20&renderingType=javascript&namespace=304cd8eb33&subid=&uid=3077d40204b3021c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=320x50&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCuYLoSZp-YtzPIIzP3gOmg5XADKblvaBp7ZKcp8kP8C4QASD_vu4sYJXikIKgB8gBCakCLtwKvpttsT6oAwGqBOwBT9C6d2J1r2AY-VZ7O137jIMKQN-JuNw3tDbxYKlgf6w9ZMOkUxiUScTQenYxARCjU484YuR511D_DQ5Ha2RJcLBtpTrtuWedq4lmVwa4BkVkDH2v9djrSq8OZfmJUJ2Fe4nu1pSg63r5nNR5SQY-SUHuN9x1FG7YXWgW7Yn0SJPaGxGT0ZmgRGpZlcpH76SHRPCN6PnsohMTFj95e0CYRIkRBmEarAtmIUgkQmuOtRZ3Xn3HBlxW_rJVyxpuz8xzIfvY98NS2IcwjDw2terQ5TCD3HHYx4xKCmDHhpJM2gbCSE8SNxT2UxM89TXABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJORoUcVTF_xOIfvu01C5XH_-Am15J3hnsdjJ9GG-77usisf6Lw%26sig%3DAOD64_2AxpNyMeDvhtzoDhqGVsO2SZ12RQ%26client%3Dca-pub-3423085545296231%26dbm_c%3DAKAmf-C64YdQQWYVtdoCCMHFG2B4csQnuBWMJiZcmz2jU8HoiHtp5gDzHCbs5wDqwyEaltDSivFEoPEyBmmp2ukFvfaRCJWIwSJI7pgkqnvHzGl5aNRrkalKg5IX56h4iLDS1y88V-I9yksyq8m37z13G-GPToWiYw%26cry%3D1%26dbm_d%3DAKAmf-AjMCclBxWl9qw8ulIgwdceSBsV-X2R08b-LdoYN-ed0d91iyDj2NQtDG1KOnyxTjktYk8TJfY2EbC-nV4xbiGf3PIIoIPxTOL2hL_Rf57EuTsJ_sUc1BfhS53GJONlr6bRak6p_wLfFMgsW569P-it_LxeDqK6bi54zf3nhhrJzLyvUo_mVD1q5u1wvzNsdWL7gOapUxXVPyoNF6l-Tpy4dWpwzpcc5h2wYQea4x3uitlxwAVA-reTng0vbBT3H-fYOLHNb9QDULwWq7k4H4gi5Uo_XEjSnpOGEhhLYqwx4qoWWEhbAu6QwkykvhK-4rAWlXsxuCKdpyhxwYY57vxgrZ1LRuyw56MJg2PW_FEOHVxmnrPsU5Z9RsUuhCEhfBMnRzy9foaO3z87FyxB4TmZvyFGjP8iLDQjA4qsJjcHmsRAz8HjWSLiygYr44D6wDXlyrzW1ZHx8qKw07gOIhK3XF2N5Q%26adurl%3D&documentReferer=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&ancestorOrigins=https%3A%2F%2Ffilemodsbr.boasaude.top&random=4095430007440&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: 648063a0d1ac68322bf3596146bdddda2d256945d788493722ca52e44116643a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 13 May 2022 17:50:01 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 21439100132642304444984011958030
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 970
Expires: Fri, 13 May 2022 18:50:01 +0200

Redirect headers

Pragma: no-cache
Date: Fri, 13 May 2022 17:50:01 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=1gnfsk4df5lz&nw=20&renderingType=javascript&namespace=304cd8eb33&subid=&uid=3077d40204b3021c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=320x50&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCuYLoSZp-YtzPIIzP3gOmg5XADKblvaBp7ZKcp8kP8C4QASD_vu4sYJXikIKgB8gBCakCLtwKvpttsT6oAwGqBOwBT9C6d2J1r2AY-VZ7O137jIMKQN-JuNw3tDbxYKlgf6w9ZMOkUxiUScTQenYxARCjU484YuR511D_DQ5Ha2RJcLBtpTrtuWedq4lmVwa4BkVkDH2v9djrSq8OZfmJUJ2Fe4nu1pSg63r5nNR5SQY-SUHuN9x1FG7YXWgW7Yn0SJPaGxGT0ZmgRGpZlcpH76SHRPCN6PnsohMTFj95e0CYRIkRBmEarAtmIUgkQmuOtRZ3Xn3HBlxW_rJVyxpuz8xzIfvY98NS2IcwjDw2terQ5TCD3HHYx4xKCmDHhpJM2gbCSE8SNxT2UxM89TXABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJORoUcVTF_xOIfvu01C5XH_-Am15J3hnsdjJ9GG-77usisf6Lw%26sig%3DAOD64_2AxpNyMeDvhtzoDhqGVsO2SZ12RQ%26client%3Dca-pub-3423085545296231%26dbm_c%3DAKAmf-C64YdQQWYVtdoCCMHFG2B4csQnuBWMJiZcmz2jU8HoiHtp5gDzHCbs5wDqwyEaltDSivFEoPEyBmmp2ukFvfaRCJWIwSJI7pgkqnvHzGl5aNRrkalKg5IX56h4iLDS1y88V-I9yksyq8m37z13G-GPToWiYw%26cry%3D1%26dbm_d%3DAKAmf-AjMCclBxWl9qw8ulIgwdceSBsV-X2R08b-LdoYN-ed0d91iyDj2NQtDG1KOnyxTjktYk8TJfY2EbC-nV4xbiGf3PIIoIPxTOL2hL_Rf57EuTsJ_sUc1BfhS53GJONlr6bRak6p_wLfFMgsW569P-it_LxeDqK6bi54zf3nhhrJzLyvUo_mVD1q5u1wvzNsdWL7gOapUxXVPyoNF6l-Tpy4dWpwzpcc5h2wYQea4x3uitlxwAVA-reTng0vbBT3H-fYOLHNb9QDULwWq7k4H4gi5Uo_XEjSnpOGEhhLYqwx4qoWWEhbAu6QwkykvhK-4rAWlXsxuCKdpyhxwYY57vxgrZ1LRuyw56MJg2PW_FEOHVxmnrPsU5Z9RsUuhCEhfBMnRzy9foaO3z87FyxB4TmZvyFGjP8iLDQjA4qsJjcHmsRAz8HjWSLiygYr44D6wDXlyrzW1ZHx8qKw07gOIhK3XF2N5Q%26adurl%3D&documentReferer=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&ancestorOrigins=https%3A%2F%2Ffilemodsbr.boasaude.top&random=4095430007440&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Fri, 13 May 2022 18:50:01 +0200

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 88D5 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BwfmiSZp-Yq6DEqGrrASF_ISoCgAAAAA4AeAEAg&bg=!mZqlmt7NAAZL3OSAa9w7ACkAdvg8WtPkdrndVnHAlcvmQ-EHeHVwuNEcH12CPyRMrjW671xGiHhX9gIAAACyUgAAAAJoAQeZAzkwD_KJEV34RiLUYNPigiu1XTzZZSWKWiB-3zsyTQ5llmQ8Iqrfq_PXG_GejCSDI9wH1mHm3QL4kUTZ4oN3q68L67oE4Ijd7Zk6e2TawB7HFQUwyvFK6Z-1maEx7wck7Qmwjxih9TU_2-pYgF4B40drPUxfYy5z1r4ouG8rpwEgJCJ0lcRVvzxXR2uWdTALhJk035zeV4_Vx_sGHaSOuxHknER7E-gyiHMOm30GZXaraERQ5fQE6eR4tXTBLeQfQCZLpeukkFZ94vokzOEcANlHJqNScGQHU9J0lIonARd_Z7t5S5hORX_emM-iY-majiUBfzV8mBSNxcOZwK-dnfHximnLJnR_h3KOplUxcB_X7zgnlq4j9gaJVNk2JSoyisLizuO0qRXy3e6vaWxDRLl7O3bgMYAxx-rQm4-HZQC0jDs2y0uMhLkAScQm7-JWO3dtbiFUEVJPPeSOYy77S4mQ2YdASnol8IE08uDe94XSM74EtwcKQMKgFtX3QH2jMdI-phbJUGTtdOLYjQnws3QBMvH_DElCl8alxILqYOWZJBIyTDiR4o38oO-Tt-SMfMQJiuJgZuXKMrYymKwjSpJQyqpJ1-GtxbFUZMZN1C6p15g-ZH4cGLXw-ThaVQAo0UeH5aZbvPFeTJAr1QFqx-TVW4dNXw8_EIwqrrU4Q0An96G0ViiFQTEWz9W9gEx0ZWWWxSo7Y-rCUFbjLvePKZLxY3SilBmZ9W2JIPYJ-nuS1UdBZQ7aH3VZrlv9EFl-MKIJcXLbcjPHaRESNj1BamE39yAaPe_ADMgJaun7P4diAc3mJdbzbTeLvm4GyTJ_FIIk1PukQc6t0XvBhb3cZeB2iGZWccAGrfZ6rm3xQzKMT9y1nmU2Vltneu0S3vX0pX5BachoyCye63aVCF9MNmbJBgUCAGSqxre3NXrNU1ShMZG_fpeQbk442dVD5UfNNy0EVXuDsxIRFsqMSl02rxN8UUEJAhxoucxb2o8vMduQkZE1B3vgh3l05oLMJUfv2fHO68_em6pB7qcyA0BXhBjQZmANjJyFBrKtOtu2tSSA1qXYh0YbOMSnWlrDvG9eK8YYNMhOD84StRY

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A0D 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BsVz8SZp-Ypn7LPmEjuwP-PqXGAAAAAA4AeAEAg&bg=!xMelx4PNAAZL3OSAa9w7ACkAdvg8WimGYS4Dw2JAWRaFIC39Ao8ZC80PwyEKzmsbszsSF8rhT0URgQIAAABeUgAAAAJoAQeZAu5-kNrxEEsBNXao7FpIpUg2Eover9Mn1RKUMm_5TmbiXTiGpimIZJAoahzEUgLGpxxYXMCZbChk-OgKyZRWE-SGv_-wIyAmhz-7UpNjT1RmABiUpeCb2Q2QUGkbRqgoi7kkMtftf3swO1iTKDzKRctlTEsZih7kM8G5sHACd6AsLnSbMFbt5JWMoXmJtAqxPGw7WT6-irjoKHhBunMkZHb76S-Vg8PStiRF_qIdFiE3p6nx_wJM3OvMK-y4iZVef2rmxKDJHPfdoeelDQAb6qxSgR1D-0ISUIban3oDLcX0A17ru3CJhwQWOJePyG2T9XeuNQNee8t7Jx_d1A4jJjaxeI4u0TNaYN-i2Z6IBvdAsjqBTWnqEIdtWMvlNvzNDjPyRL9CnegreYtkMMo6VJeTJL67lqvqz3YwNmQWegu0LpO8QzkbmgeGVJmgLjm9-wpCB4eSv8VfEQo0aYIKWHgysvTRk-h9emnFQgfKACQVMtH6kinAaNePy7JHzPT6Q5T79zkI6Hk_fg0ediyH78xa0lvDJ-LlSFThmX1aMRFgXsgqOHFiaKrLFym_zmCSinNb4Hjvxcc_q9URkGiOxAdoeOB8TjApK7gOcXm0aLiedR_9SxBDF5FuSknN_VGCOirIOfyOYE2g8mfNwk-4QETG2vdPjc1cL0XkfiPauhXUf9MJWz0vFC4wiagufN7QhKyvKu_wwb-sSg-vBhynd01bk0oASiNjqZprqyC-mBWYAacLKV7XtUQcrFhP3niii4PSpoPf9vGPJBQkYP4SJNAaqMYtASpE8cvRVCIzkwO9o8Q6W6r-V9dqvR2uFX1YqqjxjVWQ4WGM4ox2HZMCVoxNmRpLfKDVrB3Y56wqXED_mHri_bNaOPp34zdWOvfByg1k_SGeFbGuVIslp300KSQE_-08mSutOOvoq_GC7b9P7Jz5svXEccC54o-ak_4xdhtiVFjAeR5eGpSi1e1xx-Q0H0pnzSdrRJ13EPwA0V4

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame D3D0
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58739e35f36ecdaea4b4?subid=21439100132642304444984011958030&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=21439100132642304444984011958030&actionid=981741&produktid=&dt_url=

0
629 B

55ms
21ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=21439100132642304444984011958030&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=1gnfsk4df5lz&nw=20&renderingType=javascript&namespace=304cd8eb33&subid=&uid=3077d40204b3021c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=320x50&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCuYLoSZp-YtzPIIzP3gOmg5XADKblvaBp7ZKcp8kP8C4QASD_vu4sYJXikIKgB8gBCakCLtwKvpttsT6oAwGqBOwBT9C6d2J1r2AY-VZ7O137jIMKQN-JuNw3tDbxYKlgf6w9ZMOkUxiUScTQenYxARCjU484YuR511D_DQ5Ha2RJcLBtpTrtuWedq4lmVwa4BkVkDH2v9djrSq8OZfmJUJ2Fe4nu1pSg63r5nNR5SQY-SUHuN9x1FG7YXWgW7Yn0SJPaGxGT0ZmgRGpZlcpH76SHRPCN6PnsohMTFj95e0CYRIkRBmEarAtmIUgkQmuOtRZ3Xn3HBlxW_rJVyxpuz8xzIfvY98NS2IcwjDw2terQ5TCD3HHYx4xKCmDHhpJM2gbCSE8SNxT2UxM89TXABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJORoUcVTF_xOIfvu01C5XH_-Am15J3hnsdjJ9GG-77usisf6Lw%26sig%3DAOD64_2AxpNyMeDvhtzoDhqGVsO2SZ12RQ%26client%3Dca-pub-3423085545296231%26dbm_c%3DAKAmf-C64YdQQWYVtdoCCMHFG2B4csQnuBWMJiZcmz2jU8HoiHtp5gDzHCbs5wDqwyEaltDSivFEoPEyBmmp2ukFvfaRCJWIwSJI7pgkqnvHzGl5aNRrkalKg5IX56h4iLDS1y88V-I9yksyq8m37z13G-GPToWiYw%26cry%3D1%26dbm_d%3DAKAmf-AjMCclBxWl9qw8ulIgwdceSBsV-X2R08b-LdoYN-ed0d91iyDj2NQtDG1KOnyxTjktYk8TJfY2EbC-nV4xbiGf3PIIoIPxTOL2hL_Rf57EuTsJ_sUc1BfhS53GJONlr6bRak6p_wLfFMgsW569P-it_LxeDqK6bi54zf3nhhrJzLyvUo_mVD1q5u1wvzNsdWL7gOapUxXVPyoNF6l-Tpy4dWpwzpcc5h2wYQea4x3uitlxwAVA-reTng0vbBT3H-fYOLHNb9QDULwWq7k4H4gi5Uo_XEjSnpOGEhhLYqwx4qoWWEhbAu6QwkykvhK-4rAWlXsxuCKdpyhxwYY57vxgrZ1LRuyw56MJg2PW_FEOHVxmnrPsU5Z9RsUuhCEhfBMnRzy9foaO3z87FyxB4TmZvyFGjP8iLDQjA4qsJjcHmsRAz8HjWSLiygYr44D6wDXlyrzW1ZHx8qKw07gOIhK3XF2N5Q%26adurl%3D&documentReferer=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&ancestorOrigins=https%3A%2F%2Ffilemodsbr.boasaude.top&random=4095430007440&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 13 May 2022 17:50:01 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 13 May 2022 07:50:01 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Fri, 13 May 2022 17:50:02 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=21439100132642304444984011958030&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: 2D8D9844:BA84_91EFC182:01BB_627E9A4A_BB61C01:14CED

GET
H3

200

activityi;dc_pre=CJ3Jlu6E3fcCFYmChQodWrUK4Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=897248785632.2897 Show response
8019191.fls.doubleclick.net/ Frame 6AB9
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=897248785632.2897?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CJ3Jlu6E3fcCFYmChQodWrUK4Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=897248785632.2897?

391 B
343 B

72ms
57ms

Document
text/html

142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CJ3Jlu6E3fcCFYmChQodWrUK4Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=897248785632.2897?

Requested by

Host: filemodsbr.boasaude.top
URL: https://filemodsbr.boasaude.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f6.1e100.net

Software

cafe /

Resource Hash

d4dcd42d5b5cc2845751e696dcaeea67043ba9bf60d936a3e2c7b3368c35bd46

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 320
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:02 GMT
expires: Fri, 13 May 2022 17:50:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 17:50:02 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CJ3Jlu6E3fcCFYmChQodWrUK4Q;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=897248785632.2897?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900030.redintelligence.net/ Frame C033 4 KB
2 KB 33ms
12ms Document
text/html 136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/request_content.php?s=21439100132642304444984011958030&a=55bb17cf
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=1gnfsk4df5lz&nw=20&renderingType=javascript&namespace=304cd8eb33&subid=&uid=3077d40204b3021c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=320x50&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCuYLoSZp-YtzPIIzP3gOmg5XADKblvaBp7ZKcp8kP8C4QASD_vu4sYJXikIKgB8gBCakCLtwKvpttsT6oAwGqBOwBT9C6d2J1r2AY-VZ7O137jIMKQN-JuNw3tDbxYKlgf6w9ZMOkUxiUScTQenYxARCjU484YuR511D_DQ5Ha2RJcLBtpTrtuWedq4lmVwa4BkVkDH2v9djrSq8OZfmJUJ2Fe4nu1pSg63r5nNR5SQY-SUHuN9x1FG7YXWgW7Yn0SJPaGxGT0ZmgRGpZlcpH76SHRPCN6PnsohMTFj95e0CYRIkRBmEarAtmIUgkQmuOtRZ3Xn3HBlxW_rJVyxpuz8xzIfvY98NS2IcwjDw2terQ5TCD3HHYx4xKCmDHhpJM2gbCSE8SNxT2UxM89TXABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJORoUcVTF_xOIfvu01C5XH_-Am15J3hnsdjJ9GG-77usisf6Lw%26sig%3DAOD64_2AxpNyMeDvhtzoDhqGVsO2SZ12RQ%26client%3Dca-pub-3423085545296231%26dbm_c%3DAKAmf-C64YdQQWYVtdoCCMHFG2B4csQnuBWMJiZcmz2jU8HoiHtp5gDzHCbs5wDqwyEaltDSivFEoPEyBmmp2ukFvfaRCJWIwSJI7pgkqnvHzGl5aNRrkalKg5IX56h4iLDS1y88V-I9yksyq8m37z13G-GPToWiYw%26cry%3D1%26dbm_d%3DAKAmf-AjMCclBxWl9qw8ulIgwdceSBsV-X2R08b-LdoYN-ed0d91iyDj2NQtDG1KOnyxTjktYk8TJfY2EbC-nV4xbiGf3PIIoIPxTOL2hL_Rf57EuTsJ_sUc1BfhS53GJONlr6bRak6p_wLfFMgsW569P-it_LxeDqK6bi54zf3nhhrJzLyvUo_mVD1q5u1wvzNsdWL7gOapUxXVPyoNF6l-Tpy4dWpwzpcc5h2wYQea4x3uitlxwAVA-reTng0vbBT3H-fYOLHNb9QDULwWq7k4H4gi5Uo_XEjSnpOGEhhLYqwx4qoWWEhbAu6QwkykvhK-4rAWlXsxuCKdpyhxwYY57vxgrZ1LRuyw56MJg2PW_FEOHVxmnrPsU5Z9RsUuhCEhfBMnRzy9foaO3z87FyxB4TmZvyFGjP8iLDQjA4qsJjcHmsRAz8HjWSLiygYr44D6wDXlyrzW1ZHx8qKw07gOIhK3XF2N5Q%26adurl%3D&documentReferer=https%3A%2F%2Ffilemodsbr.boasaude.top%2F&ancestorOrigins=https%3A%2F%2Ffilemodsbr.boasaude.top&random=4095430007440&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: e1a89cb1ed07d37f6cdbd37bf4321259ee892312eceff8eab053654ec1d2db63

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 1427
Content-Type: text/html; charset=utf-8
Date: Fri, 13 May 2022 17:50:02 GMT
Expires: Fri, 13 May 2022 18:50:02 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1A68 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 15830
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 13 May 2022 13:26:12 GMT
etag: 48472445140208031
expires: Sat, 14 May 2022 13:26:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DC74 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be170e64b9ca8661c2c1271d8b4bca957d65ab82779875ef0a63a35c208118c9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1A68
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESED02gKln11NYDy_uHnynz2E&google_push=AYg5qPJJQuVypw3wQRjIWOWbecMS_pqirULXC7eXI7b0Otn3KD6irH0_h0...

170 B
188 B

33ms
33ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESED02gKln11NYDy_uHnynz2E&google_push=AYg5qPJJQuVypw3wQRjIWOWbecMS_pqirULXC7eXI7b0Otn3KD6irH0_h0zASbi93fGJYBOENdG3VjRKywsE5oRwNf0d3ja4DXcB

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1652464202.167558,VS0,VE94
x-served-by: cache-hhn4041-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESED02gKln11NYDy_uHnynz2E&google_push=AYg5qPJJQuVypw3wQRjIWOWbecMS_pqirULXC7eXI7b0Otn3KD6irH0_h0zASbi93fGJYBOENdG3VjRKywsE5oRwNf0d3ja4DXcB
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1A68
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEGWPZrsJxjmoJVccYhMX-WU&google_cver=1&google_push=AYg5qPK_87OYK_VbImQ1zCixP4TaYy0Tjk7ucbrx_uULrjEkPwlHIBWkjig7uMKiuWqZY-LpfL6wXI1zCYhjcf...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA5NzI3OTcwNTQwNTkxMzIzMA%3D%3D&google_push=AYg5qPK_87OYK_VbImQ1zCixP4TaYy0Tjk7ucbrx_uULrjEkPwlHIBWkjig7uMKiuWqZY-LpfL6wXI1zCYhjcfdY6X...

170 B
188 B

35ms
35ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA5NzI3OTcwNTQwNTkxMzIzMA%3D%3D&google_push=AYg5qPK_87OYK_VbImQ1zCixP4TaYy0Tjk7ucbrx_uULrjEkPwlHIBWkjig7uMKiuWqZY-LpfL6wXI1zCYhjcfdY6XJA68cA2NwR

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA5NzI3OTcwNTQwNTkxMzIzMA%3D%3D&google_push=AYg5qPK_87OYK_VbImQ1zCixP4TaYy0Tjk7ucbrx_uULrjEkPwlHIBWkjig7uMKiuWqZY-LpfL6wXI1zCYhjcfdY6XJA68cA2NwR
Date: Fri, 13 May 2022 17:50:02 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1A68
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIyqU_0c8oK5TU9pQt8aR80&google_cver=1&google_push=AYg5qPI1Xpq7261R1G6Wyt4P0_tvkGiyeYOwNVOKAhNFrjoReExov9FSNhDmI-vNa8NMv-nkjcJDVI-tFtInBo9-5h5uben...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPI1Xpq7261R1G6Wyt4P0_tvkGiyeYOwNVOKAhNFrjoReExov9FSNhDmI-vNa8NMv-nkjcJDVI-tFtInBo9-5h5ubenJkSqy&google_hm=Mjk2NzM4MTUzNDQ3NDcwNT...

170 B
188 B

30ms
30ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPI1Xpq7261R1G6Wyt4P0_tvkGiyeYOwNVOKAhNFrjoReExov9FSNhDmI-vNa8NMv-nkjcJDVI-tFtInBo9-5h5ubenJkSqy&google_hm=Mjk2NzM4MTUzNDQ3NDcwNTY2Ng%3D%3D

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 13 May 2022 17:50:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPI1Xpq7261R1G6Wyt4P0_tvkGiyeYOwNVOKAhNFrjoReExov9FSNhDmI-vNa8NMv-nkjcJDVI-tFtInBo9-5h5ubenJkSqy&google_hm=Mjk2NzM4MTUzNDQ3NDcwNTY2Ng%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1A68
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENMtVl71_AcXB3iSLociA4w&google_cver=1&google_push=AYg5qPIQT7hpgWWnzwjh5fXGsK4R9uNi4IoTOZtPBdn5nDZdPhNqIXIpWotGAgiSbgN8jlfioekHs_dP...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESENMtVl71_AcXB3iSLociA4w&google_cver=1&google_push=AYg5qPIQT7hpgWWnzwjh5fXGsK4R9uNi4IoTOZtPBdn5nDZdPhNqIXIpWotGAgiSbgN8jlfioek...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMzE0NTg4MjI0MTQwMDEyMQ&google_push=AYg5qPIQT7hpgWWnzwjh5fXGsK4R9uNi4IoTOZtPBdn5nDZdPhNqIXIpWotGAgiSbgN8jlfioekHs_...

170 B
188 B

29ms
29ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMzE0NTg4MjI0MTQwMDEyMQ&google_push=AYg5qPIQT7hpgWWnzwjh5fXGsK4R9uNi4IoTOZtPBdn5nDZdPhNqIXIpWotGAgiSbgN8jlfioekHs_dPJh5pQvUX3QHj87CIv6E

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMzE0NTg4MjI0MTQwMDEyMQ&google_push=AYg5qPIQT7hpgWWnzwjh5fXGsK4R9uNi4IoTOZtPBdn5nDZdPhNqIXIpWotGAgiSbgN8jlfioekHs_dPJh5pQvUX3QHj87CIv6E
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 1A68 0
75 B 214ms
20ms Image
text/plain 185.86.137.108
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEL4p6I8pydPjnt4MrmtRjN8&google_cver=1&google_push=AYg5qPKrNR7zHFdPlO4kLfhgoTsABhSezQoGUnCp51MyeZweio6kSrgZ0t_oGh4tRwRkrd4hKIJfU8I9PafCrZhUxfL7Jw0YppAN
Requested by: Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.108 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 17:50:01 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1A68
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEE0UAXieSSlEKvR-LO4RPVE&google_cver=1&google_push=AYg5qPJn8c4SMMqalAd851z8L8DGIKnREiXud9ux-1T84PgYGgs1TLTwCdvtPKxFqvvSAVTyxK...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS03MDRKZ3BORTJ1RXh4bDlpNkxMQUlNLnoyWnJEdjVYWH5B&google_push=AYg5qPJn8c4SMMqalAd851z8L8DGIKnREiXud9ux-1T84PgYGgs1TLTwC...

170 B
188 B

37ms
36ms

Image
image/png

142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS03MDRKZ3BORTJ1RXh4bDlpNkxMQUlNLnoyWnJEdjVYWH5B&google_push=AYg5qPJn8c4SMMqalAd851z8L8DGIKnREiXud9ux-1T84PgYGgs1TLTwCdvtPKxFqvvSAVTyxKQdKXh-Wq3-XdXsb9psvZDFcUMSyQ

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS03MDRKZ3BORTJ1RXh4bDlpNkxMQUlNLnoyWnJEdjVYWH5B&google_push=AYg5qPJn8c4SMMqalAd851z8L8DGIKnREiXud9ux-1T84PgYGgs1TLTwCdvtPKxFqvvSAVTyxKQdKXh-Wq3-XdXsb9psvZDFcUMSyQ
date: Fri, 13 May 2022 17:50:02 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

/
onetag-sys.com/sync/i,19/ Frame 1A68
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEFaROphwBn4mxPc_Gllm4Go&google_cver=1&google_push=AYg5qPIg3gytBVj2nDQqEra4CpXNGBRCWHahSHKGO5CPM1fOqXSX_6wxERY2MHllsLkyi-rh5pLjFmfETtz...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AYg5qPIg3gytBVj2nDQqEra4CpXNGBRCWHahSHKGO5CPM1fOqXSX_6wxERY2MHllsLkyi-rh5pLjFmfETtzj5xGwonAaVutMYcDv
https://onetag-sys.com/sync/i,19/?google_error=5

0
148 B

8ms
7ms

Image
text/plain

51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,19/?google_error=5

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 13 May 2022 17:50:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/sync/i,19/?google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 245
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1A68 0
12 B 29ms
28ms Image
text/html 142.251.36.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kuvg0Cn05EVmjkSV5lEWXp5VHF5l1DygCMNq4fU4qzGVZ7VhJo1WO7cyu7-r5I8pT9YFLxjxQ

Requested by

Host: cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com
URL: https://cd4413aee1fdf2a745d329922acbf2cc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.36.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS