pcloak.blob.core.windows.net Open in urlscan Pro
20.60.220.36 Public Scan

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4a1b3a20-598d-441c-b9a4-6fb0137a1a23
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM2ODc3ODk2NzUxMjI4Mzk5OA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame E5D9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECP5tnLgBqOC97Z9cKObQtY&google_cver=1

43 B
114 B

36ms
35ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECP5tnLgBqOC97Z9cKObQtY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjNmbXcATAB&v=APEucNUz9Ch3iEOhHwGjc4YxYyK5JK9Zh2bshki5s-dCo4dd8zIyWMS4pMFsT4E8mJ0FY0CdhLzTlkEksyDqKMo_T1-IsrhqDWnK3czhJU0wcxqYzwq6tNXcKN3DM74Av0e2y3JRIys2I-bEIBEa8-SOvVUcdG0mrjEt2SbrOxpygDxTA7bwV_I
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECP5tnLgBqOC97Z9cKObQtY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame E5D9 43 B
304 B 102ms
36ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjNmbXcATAB&v=APEucNUz9Ch3iEOhHwGjc4YxYyK5JK9Zh2bshki5s-dCo4dd8zIyWMS4pMFsT4E8mJ0FY0CdhLzTlkEksyDqKMo_T1-IsrhqDWnK3czhJU0wcxqYzwq6tNXcKN3DM74Av0e2y3JRIys2I-bEIBEa8-SOvVUcdG0mrjEt2SbrOxpygDxTA7bwV_I
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame E5D9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEHuZPzkDXn7Lmo-2_KjaXwU&google_cver=1

23 B
163 B

52ms
52ms

Image
image/gif

104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEHuZPzkDXn7Lmo-2_KjaXwU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjNmbXcATAB&v=APEucNUz9Ch3iEOhHwGjc4YxYyK5JK9Zh2bshki5s-dCo4dd8zIyWMS4pMFsT4E8mJ0FY0CdhLzTlkEksyDqKMo_T1-IsrhqDWnK3czhJU0wcxqYzwq6tNXcKN3DM74Av0e2y3JRIys2I-bEIBEa8-SOvVUcdG0mrjEt2SbrOxpygDxTA7bwV_I
Protocol: H2
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Mon, 03 Jul 2023 23:22:20 GMT
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEHuZPzkDXn7Lmo-2_KjaXwU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame E5D9 23 B
163 B 160ms
62ms Image
image/gif 104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjNmbXcATAB&v=APEucNUz9Ch3iEOhHwGjc4YxYyK5JK9Zh2bshki5s-dCo4dd8zIyWMS4pMFsT4E8mJ0FY0CdhLzTlkEksyDqKMo_T1-IsrhqDWnK3czhJU0wcxqYzwq6tNXcKN3DM74Av0e2y3JRIys2I-bEIBEa8-SOvVUcdG0mrjEt2SbrOxpygDxTA7bwV_I
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Mon, 03 Jul 2023 23:22:20 GMT
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 34CE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEEAv5vgKCLxJhMW6cSs8Aig&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEEAv5vgKCLxJhMW6cSs8Aig&google_cver=1&__user_check__=1&sync_id=7535c2ec-19f8-11ee-9229-199d37980406

43 B
547 B

38ms
38ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEEAv5vgKCLxJhMW6cSs8Aig&google_cver=1&__user_check__=1&sync_id=7535c2ec-19f8-11ee-9229-199d37980406
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJHlswIQ8KXioQIY8ICq0gEwAQ&v=APEucNXW4A5v6gJxb_SsD3WkSLqCPhrCm190oQhO_d8CTvdLQgCNmOjnskH7KuKeQZw4JhKLxLUsb3LmGq9EoLOfaqsTbUvMWMQo56gbfnVwwDkCfbojEyCEXM5jnxCZHfXELpfRulH2qi2jxlZ2W0n3SKlfO6LsDSip7KUr7359V7d2QdotHDw
Protocol: HTTP/1.1
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 2
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEEAv5vgKCLxJhMW6cSs8Aig&google_cver=1&__user_check__=1&sync_id=7535c2ec-19f8-11ee-9229-199d37980406
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 51
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 34CE
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NzUyY2FiN2QtMTlmOC0xMWVlLWE1MjAtMWEzY2Y5ZDEwNTA2

170 B
188 B

40ms
39ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NzUyY2FiN2QtMTlmOC0xMWVlLWE1MjAtMWEzY2Y5ZDEwNTA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJHlswIQ8KXioQIY8ICq0gEwAQ&v=APEucNXW4A5v6gJxb_SsD3WkSLqCPhrCm190oQhO_d8CTvdLQgCNmOjnskH7KuKeQZw4JhKLxLUsb3LmGq9EoLOfaqsTbUvMWMQo56gbfnVwwDkCfbojEyCEXM5jnxCZHfXELpfRulH2qi2jxlZ2W0n3SKlfO6LsDSip7KUr7359V7d2QdotHDw

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NzUyY2FiN2QtMTlmOC0xMWVlLWE1MjAtMWEzY2Y5ZDEwNTA2
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 98
Connection: keep-alive
Content-Length: 0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame 34CE 0
125 B 136ms
31ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.57 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BD0E 0
20 B 57ms
55ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9721164041720&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BD0E 0
20 B 55ms
54ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9721164041720&version=m202301230201&ct=76&x=1&cor=2186336911989968100

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BD0E 95 KB
37 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AIrChUudQEhZJ0ArT0dXwY6busD7m4hez-Vqbnyh_NuVrrIC5xFCqBqyG2o3qNCzD9CcRpOpCnx2M05zEzOqDwbGioduxE3HGDj1WOp5z6hdEO1eY&cry=1&dbm_d=AKAmf-BB4tWiot9DMuvgImhw1AZlGU6RR-65ZcPFCiSAXwp7pb52UBClQnlbcmOWvKh2yQqIOsngQXLm7cqdS9dZzmUgEa5ifSotCQxGVPMU4mDU94le_buB8r-3UIN2YN5VVFiYaW9cyA_FOYXrZkR3zUmLStBqGhCkZ_wLvs3wHZYnTtJgFPsZiHXRfE84uSFx85I9lG1fgjT0zilJNG8kSVLcIZPjlOH7sg9kXo8aPFW1X-Gv3OzB-dfeN4tu8pR34TuH_GP6bKJVIEu_Cxwy1BYD3jneGphQiRGOmOREKj0TpQZRwSygTuQC0otwVQ1V3fce7DCnbZfecXRe_MfLyy9p_J_vibuQZ71tX_LNyyu-NwHygwcbzvsCcqQ-ZpdMty762hTo5o2wnSbiqwCtddNViCMu2dV6M7vOFF2-lq1u6PZUa46noboNUNcvSEuCTVqp9aYOUf-0tQklpQtfVO4bhSKj58miRUJ4CVLVcyX76R5GbNpbcFIjOTJY9kY9qDG1v4aV2JCoQ2LxdyHmEoQhiy9_XmOH2bFNdVIswqlJ0ltiqsi1wofMvrR8BNmUbk66g-LirMIAEBDV7IFoPLbHwLUSNlVHkoGmwieXNaxXyhVH4WmJ-MbUCB1Fe7zSbjRWYUZbn-bU-jaCcLQtI-5Mf4iXw7ESq1GCdfmjc-F8zXwpA-Bg_ShElnKQPj66dZrHnIe1xEBx2owTLDu50QJvjJuNYbu6FgV05xZ4wTm6DBQxsEbDyvVLpq0--o35Nxe6XRI4jC6J13uPQkxptOx1BwgnJePSlSnIb1L2OWdgsCvfS43TvWrhcriaQcqdGRdWYZESxGf4I-nh-E4vIyAAi-TO2c7Fers8BCnSIamMDVjyhFLcIrdke-iEAmQyRf2MgcJ6ClDCALbRjLmCfhGaa_sI05fEkuKq1oL_KIAYIVzfKNVpJJotuR7zjMLHaz1hBwF7OqKgj7CQ0ZpAqScNcTGE0DVFXP-2r-3cdGJL0BRdQB7DCbBhvmT2pF_adSfAgnjCJ-O1A0isC3AvcJ7n6sJvYKsQqof-rqXYhZgtYaRPrtMVV8yM-SIUROumRlOF4efp2hiaFKNEiEE2RYjDcpkUhillDFuG1Bod_R5iS8Xh8hs7n5X50CqYS1EugwMPyYQTAfyvH5Voh5_G1xNpTOqqYv-dBK9W6LhSK7-Vpfj-dcDcqIX7VtWCWCQpFQDA4KWGwg63LPAwmazsNiPHRJjlwrwzvXiSFVwhs9PGjDCw5eIKOgkveqbzf5qA1GHrOq4t_ZNK1EVycAw3z-xgvk_pGYyjZz_qmusQcGw-OKifcEmblZ_7W9uBYW98fzSN_fOPPjkMMcaJ9jKzg0_qeODzdXYhzW5xLsOG1FB6FYgS8qvaRoQUA37AIyy-pPiV7ZLHiElOZ-ftyBDT-nsKdrnf51LSXdT_o0yuAcPlPtTCYQJsqugQcRAX-_EcjrftFVSUlmhc1rp3_a7zlqLAqObfy81NifgwEU6x8CiPzIXKHF7BfSTtS6X1fvNxTXkBr5uvWGlRaa7Tn4CZHG0Xfv2lCdoOxADdDyw2JRQdmcb9NM6MZJ600PP2mUmFt-IsPw2yQKY09N5O67uIiruiJkg72GDD5lylDjcUF2G7aS7r26FnoCufQAsYCDnhr2wYTA-iU0PwfnSe4dURLyTZXhNCWvYZbVqsvf2rGg1Oj0n66U4x82bhychJ7uRENIKPEYRS7hoql3TAW9Si1acRibWxOytb9Qfeps30_OoNMRAVx8Je2cHYaEcHScRVuSefubBBpPtyxwaArIRIuFU68JbfJVJP_YyZ_qPIhN9l9ojGthG5KMH_rgaB10wShwLrRHnEU3lPfP73x8R98OvlnnVwtKOzzLXWd0r-haDAOCx49fZZl-_8xgpeCvmj5LK37rMHCjgPU6rcIgiZeOIuPk_bpwFZ0EJgAsgdSj4SUZ4LMA0AB5lls6PR6_x2Qzk5gMD5syrAq33kO1sI2gn_IZwBsb5jgeOFBxj7SDB8bBN5H7KGph62Lne9D5tRQ1YLyGhUn8YXdOYGDTtksXmfT4vd-vM0ACbBT39AVBM53vsTTgW078IxXpV0yHhf0PMiUr3IrDldot4SUVdVKfJ6a9LwHs11BU3P8MTXtzg3ZFQoq8DZ8L0PT3LOBnN60_L3tVRzvtHAhbHE-AlWL_eZW2UIrYyzv8lAu7fP97NHFiYEfTZMewsmWe6AOVlngO214kJPmvebMpPi59svFtZaoWSvnM-bubJQNOeTurJmvWXuNpQxDleIPWLmBYJSNDdyBcMYQ0y4MfOIJw88XyvLQRyDN074jlpn9wW17p0WxC2pKyhS0irLj51h2FMFq13mi-xBgTrrRw4-ZfTuTO_B6DnEjlVYW_8W4hi4XkCZf9dP7FQbq0WSFXXcewn09AndyJ6EGXkdOHjJ1dF0DH61JkYtIBX_O8tmJaXdswMy-NXpULTBEDnZoaCUuo-C6J7KxVCl7ArmzKlbNFBHHaPMNgLjM0oMPVxDXh-x8jIrTscSPkpeSk9uPZWm8COPHb0oYcS7RBeeYPNPHf4R274bEuFojUMQKoWEpZ0lphFczams62VRX5BV5rmCIMf9Cr2E9X2_a5_-OhY-EsTdIR5ALOjYMFVOjHSz7vbCzteRqQrAMJ0Gm2R_hGWVyrOp6WhN9pZTRLxmNFsrOX0p_fdVbVJI2eZ3jAi8CiKoDni7A3dv0o70WWzeCUuMmSUHlkInCEHMRdBsFGoDqYBGCpZGbXK0bTsKU0Dc-h9fpHN6gjp0SLcnQzb2dZ0bwZwFVMB3FG7oSaGaPu_cKSu7ZOPETNxeUm6ji9yvndSO06VNwn1C_XlKaCvmvHJCAv9GOqbIAfbLtHZS3J1h-MXvyODJoOIxnbZYevFsVx7AVFGzaqawAX-vGMn7cnYSIBfLsJo3tSTk8k69rAeHvCoZaprjht8jG95ZmRqXftA7V65ctCA2cM8WNJkNn8ZI34ZLDZU7vRMD6Ib25sH6f648zH5IzrmGPWfJJXjZWWgqGCrOa5ZHoBV2lI-Tk2NBqAINQJy1Ae7z0tqQJw2vbBuwB-d6ZCc-vgkJd0_Jzjpca35RVOr9OEeAO4k0BeJv0FlZYQp7fh_YjslVjp7obCkL-upKHleY9_kdJh8rmLE3-v9jO8hPj8izwEdTu4RpwdSBXH6q7ePEfL5r66KEUDsP-qou4MlUprNuJoq88gqheeAN8EDdDYmFDJi593kFPgoMj6xGOZkPu_aUEzu92cklom0bPZuphyZdAbZFR-3pKdVEsH5gDl_aTrz7RtYB8bYAR8oHgFu2p2olyWB9DyLWHMdrcQJ2EwHCbE5Lg7mv42SJ86boLoNFb1zs5M4JkcOp-9NG4jQ4e8r2sfgAyoMtV7jnmVHqTcN8SiiCgGlrpKYHAnvt0Fd-i_E7IgVhsq-t63QHzrdl&cid=CAQSOwBygQiDDHZ6arnIXMVRTk6nZ-IzJiAh0cCT-PUyirqZb9-XBQe1VvWhRJtG257q8Xo-xd_9BxiAaXqUGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=2186336911989968100&adk=1599433117&idt=65&cac=0&dtd=44

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61d02738bf43e95644b1e74f9bfa7bd2d51e394469bf9edf130d52a674d9991e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38179
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4E3E 0
20 B 59ms
59ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5066984137592&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4E3E 0
20 B 57ms
56ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5066984137592&version=m202301230201&ct=76&x=1&cor=9191009336661159000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4E3E 92 KB
37 KB 79ms
77ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CUHUMXrdbjq2IxE5zcGjAEM_4QcKKQ8xRiPTF0H-i90jAMtQbtWRIxEHlQqbyj__WYOp0kNZmmt1jRwK2ZTSx2vQ4vpf5R7hQMzwqIOq3gAPN2VNI&cry=1&dbm_d=AKAmf-Azuaxf-a8sYzg-NoBbhOC-zhxjWeDmsodxRMMglRsO62FaGB3fJRSF-v0iP71bldwAGidPlBsvbuumSCgV0QpNr07JNDGksibOCAk38CcfyGoTBGuCKrcWthwuDizu35HUsH7beNqmGI-BrwykMm9gA5mnMQYbu6nuWrYKowt-EnTW7x-m0ypUbg9g4F1-jkAHw_jOQZPNJEsxWnuM16z0mhyZYCSgAkNGUL27fvXXMCIDJ9SEjpI0FxgJN6p_SQbK_X9yfPUeT85q3lX4dKoFw8NHPuZ2PclyTkQor0cjTllhA4kTts_0-zQr6FH3cFr2uGhlrh4_VuB4zjoANrffsGtPlSTaVgmgpUgondl3FDlmYDbJQljUKy2nxxUuNkGNfpwBDKl5iBt1rfCDhshURk0stJaswAzHwIsW2nfoNqE-AMICJdI73DEk71rnQWLp2odsGl6Bnq9SadzV-sM3fumIrYb5rN--55nW90b1JfEn-iUJCN1gRF1xnFZUnqaVICP7V0aK9EA625o8QO4s92RNCNfZMRTcw16r3c4GCyvsjcHnese8-7MC3yn4jjnELf5j45PGvimmplmVlChwGnHaG8tim6_sRpSogfjNlsP0jz8XOTnl9OSFtrAc6iTH5GUIUkvb06dv1XUdMz0Bc1iIZZaRDOb4Ur032NNTJYmvyFkG-zlh5ZNOIMewzQhH62_Xun4C1sNzzLbnmCJsCNCcyk3n9RohMaqoz1l2ECR7G4SLntkCXsxTFaiQVluOPZRXP4T1WePJ9kS7DhMyrWOmBJxEXP0deyHg1-l0XOb_8t6UKrZc0_bLdkzO9OpL5r5IgIzCPKrrduP6icAfAW78-4LA7A-Q3tSrsWDFhMYlUVM1215gtBSCsgbnJrJk9YS6mDFhjLcO5uPYj9vBrCdVHof4hdx3ki6vq-CxA6pFDEj4sOSPzxNV1jJto4olEmroZdFRa0ESHN0bujTDNjSWBCAtPVCu3qMOGz3fneYJLQn0S6yt3hil8MNIcf3XjcIKfbVsIlr-Jg1RIoae7uXye9HdCCdmGfB4PDzaJJTSsm8f21asFXwyE8s-ck46dpzZJazgi_MgUkDafgz8zE6nYW5Dz47YfTzRy77VD48u_sy5LieDxsrfn2XPQ_kyJmFd-45NPkrktxMwTsNrp55NayY8qjqebL9R4mes2_R9PUdL6V1MTHAfQ-KWpCXFd3rxP2Vn99HEkV3mgT_G9LbR48alW4hR57q7ixJiZ8o1G-_j-_Je1kzOlXmG82xhy7Uvt2zKXYaKCtD9vpHUJmA4_S_UV6MWq_cSpsVmigdqSFKh36KCwSXKjm0i1PW0QCL3iV_VrkRD2pVEHzglFhegL0rDbAMa6PtEle-HdX7LBEFQP5XIP2uZPzDZKaUskc76gtjnUlgU6P9Ch1ZKKKFHAj9CWdIQ7wx88AGYh1grN3fMoTfEYuf0AbuVzyjj2I5xrAbRLTGXa450oWyAAVP_XPZcHCcxO5BrEWjjTzsHqUJ3YLwOsM-XUbDsXivDtjzfcuHnrM0wMEniDLuym6nSpnBlga12r2Q0of-RgbFZdjQW44EgHD8SwBrUl9-vtocPvItyH6Nz0Pn_o6wbfbF6nCDWBgIhqhxQehIN1-1keZtzP-TR3s6JXPnHHjmyqgmE9ZQvfEpPMJBQw7jeLvMRboApEbn0KkaAB26_p0-cxSezdpPrhe_urcFi0wm4cuOXL5eM9YkCHvGJ4nXz5bCj07AONS8T95oB27oD_xBXLQ4An-0wOy2wtLZijLh78W71SCpkYdDsmLe0y5m1Tr3Z1cbRGWbJUH51qn15LfeKtDFlS5yLKezZvc8TBkX77C050Lk7F4BBWaFKnh1M8PDBqmyFDkg5EQ4xJ9_Wbumi6LkFFRp1wVNysHHhLWhFx4Av1hfM2ZnMHpUp-rwb7ae5c99S2IytCub3WjeNdH7O4e8kFr4PYdALo5BETmgh6q3K9pzJEJV8l1JnM88Kbvu95V3uxtbn65fIZsVPCt2j8ezWdANi2In_hpSao_MZACc9RkvZO0f3Qu0Izkd0lSbZ49N3y0PbDC3dtWibUvTcaLAZK25eMOk4Z6Ad4ginZHlMMUjXD6skHappRZmqdYrjMpjbk96Kyo5-EbRrD8TM7g5IOA9Ls6y2Rs2eUaDQCgEIEEVfojYkKLRie8q6RqjLc-hBgBaqh7Roaf5MvkZ2Ycp5slmgTZA5UKJrP3NL32MtjBKfrX1MI8pyGprzCV8tvRknOA3fnMGK9RRlV6bTkk51jOymI_APxKlMvqqGYa7aa2hci8k765nxRa9nLZD5kyfuscIVoDgv-H09nqlq5h2FSTlc0i6OaiMuNI2a30uKLlJ7tDZTVfGQxlFEwQrb_USXcjRHOpum_22tKRveg0t8O_35gArQkofcoQ-K3qbxy5GyPrutNXkZdTVuX4cv1-EudYvPUbz6jbzjg8FKH_HcrkfWU7AyrGM5xtx_Np6VqkE6f7bl0uJtC16c0xfjMQIgfS1YKkdR_doGmz05FNYrho5Sbxt0WnvzmBxNfFuFuLgauXs93ih_bgUMX_hWH283dC2TYgJiuC2vlgu9yaXVcVsRFZIQ7jecnc1cg1OSbBe7MQUJQx6ACeJLbkXH8PCFoA-AQ4MZip1c-j5zMHsKg7ghG-S3diSzRzPju0s3NwzZmMqXny-jLXUkBip5IHJYt_YGcZC_1UJM543NvHdCVuUsF3y_sXgMicMHj-NGdw2m086mw3rOs7lYlCK6jz0jNsZ9ugqkGtm_NuSVhhVVSqIe82yMRw-GofPDhh2aWREnkRU8kmysYo1S8iE3pkHfOyhqcOparQJmwu2IomS6yzXgqzV5eUGGcs8EFIvC_QbadWdaIaGNuRxjICrM4R4NT0l5WUQXtBz0w-QOXmOdWtekLDA5cTNpVKnfzvMZGbJ5ACY_c3IqY38YClm0dIWDTaRgu68Y7lKZG0kiEUlJ_uulYzWoxkWHqQArVOChWteBqUlUWKzHaXwL7wDYPIcCZJnJ4f7imYPkwMIvufuDYfUwqOBsp3bhK_UPKPoC-pGsv65aoRLjciSp_t3vrtTkN_H_-TNynf5n6CS4OwBSLZw8InJFjT9xAL9DtzZBFUKah71P8egeO7XjAEJJosVqQicHRsTmsX5STuk00MV7nkfgApX6lD1H6yDh-oBZ-xOFj9MJYxITmJDjvOSIKyEQtn3ztpfPm0Rc-ndroU4CNAMiTL0VdvDc1a0K2e-xujkD9Fj6wVwcNrnliHO8Vh4XPG6IJDIUq4xmxcdu92uqhKLSUgKrP_rmQhgNupXz00D7XjUDMiejq2BN150bXs7Xa_7T2CG5wGrcl9xBqr_zXR6VO_Vw3pMDW2bGuJhmXnwqQ5Yc1l_pDM6dKXOWYOMAVisc1Vy5AdwHP6t6yIwIshZ9mNVzeqLaLBEXKdy9WXEHnkMDLZSWeCJWnKfeIhvqhs_rBYborywMMlxxu7Q4s7uhaR_nt2HkddnRldTwb7xe_MzvAcSq5euaQycR4HX5JH-fxYTJJSMvocvyjvUm5_bFCGE4qhvKa50THNWVlCudfyPf3uUAzHYAuCpc2w&cid=CAQSOwBygQiD4M317ZcIeH3uYgh3fMVU7UweichxXU6cyRsYhhDFckt3wmvx68JVogCGB9mrlfupjVQrfPgVGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=9191009336661159000&adk=2465470143&idt=63&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdaeb6e5969dada1b47f782f0b127a95c6b27e8844e72891f198d9592a4f8538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37949
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
rtb-csync.smartadserver.com/redir/ Frame 7F4A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEELHa0cvC_m7VNk8P6yXDes&google_cver=1

43 B
114 B

144ms
37ms

Image
image/gif

185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEELHa0cvC_m7VNk8P6yXDes&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjfobXcATAB&v=APEucNVMF4cCy1HDk7A63KoQenGxUDuSiuW9rCeTf2FImhrNQhopt4bEGf2JQsLIT_O55UCBxzqGTyS-zbNVg5x_EO6N3DT2JjLhwHy8B0ufoQNhI-8wYHZBDFz2T072X5Uk4e0WHtGx_Cv1vmrliiGu6tNVJW1oBloJyun9WOx-g-GjY2t9jss
Protocol: H2
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:19 GMT
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEELHa0cvC_m7VNk8P6yXDes&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
rtb-csync.smartadserver.com/redir/ Frame 7F4A 43 B
113 B 244ms
37ms Image
image/gif 185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjfobXcATAB&v=APEucNVMF4cCy1HDk7A63KoQenGxUDuSiuW9rCeTf2FImhrNQhopt4bEGf2JQsLIT_O55UCBxzqGTyS-zbNVg5x_EO6N3DT2JjLhwHy8B0ufoQNhI-8wYHZBDFz2T072X5Uk4e0WHtGx_Cv1vmrliiGu6tNVJW1oBloJyun9WOx-g-GjY2t9jss
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:19 GMT
content-type: image/gif

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48DC 42 B
63 B 54ms
54ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CkRciVUMgHpsZVOjCTGb7bnP-fpcrZGuOMmNOr7Q6IS41tFq_UjIG8cl_6l4oe_oRWp-DQO-kX7sOHLQ1A6tdyt557gJOs9UgE2CmTgcZsdEE5jYk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688426539836&bpp=2&bdt=118&idt=115&shv=r20230627&mjsv=m202306220101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4741162245852&frm=8&ife=1&pv=1&ga_vid=2009876620.1688426540&ga_sid=1688426540&ga_hid=926749968&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=1946496577&scr_x=-12245933&scr_y=-12245933&eid=44759837%2C44759927%2C44759876%2C31075631%2C44788442&oid=2&pvsid=2896560028346402&tmod=1937665132&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.5rccfcav9fcx&fsb=1&dtd=120

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48DC 0
20 B 56ms
56ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=13506009272160894950&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 48DC 85 KB
29 KB 44ms
42ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

372ee4f606f66d460727f0502b688f2049ce405679f274e8fb1ed175417479a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29790
x-xss-protection: 0
server: cafe
etag: 4661881725859498467
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 48DC 3 KB
1 KB 28ms
24ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 21:02:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 21:02:30 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 48DC 20 KB
8 KB 27ms
24ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abaf64de0855592138133fdf15c746a6e47a07d5f7a34a9513a06994c89f91af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:33:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 20918
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 5477749917372345267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:33:42 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 48DC 0
0 35ms
32ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTeyeG58I8mCcXQFhTA631V9JEPVaE7UwqZ39JWXkkFOb7tyIlh5CO7PHQJDoMVdF-srOi4qCFLXUGIIKvyV3Iu9iaf3w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688426539836&bpp=2&bdt=118&idt=115&shv=r20230627&mjsv=m202306220101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4741162245852&frm=8&ife=1&pv=1&ga_vid=2009876620.1688426540&ga_sid=1688426540&ga_hid=926749968&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=1946496577&scr_x=-12245933&scr_y=-12245933&eid=44759837%2C44759927%2C44759876%2C31075631%2C44788442&oid=2&pvsid=2896560028346402&tmod=1937665132&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.5rccfcav9fcx&fsb=1&dtd=120
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 48DC 179 KB
56 KB 36ms
34ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DFB2 1 KB
643 B 25ms
24ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23384
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 16:52:36 GMT
etag: 48472445140208031
expires: Tue, 04 Jul 2023 16:52:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 629F 0
20 B 59ms
59ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2376678986822&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 629F 0
20 B 60ms
59ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2376678986822&version=m202301230201&ct=76&x=1&cor=6531176856135113000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 629F 89 KB
36 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A4iSxLkCajtN94ZaSqXPGgE3IqBaRO9b402PUi5W_aZe57pQQhGFkofJEM-vOCoOsSOlIprRuM_fpFJS_ljcVKk_IQkg&cry=1&dbm_d=AKAmf-DGqteuY7oy8dRNusWcs-QaRCnx34ndhZwXUV83ye19BtKMeNerv8pGUC1ge7vNtiHaNmnU-TJ7DOafdGqfjvUElc0x3mJubcwBEnNnBDDq2UT1pP4PMZ4b79X5SX2EwAJk2bfnKV6fzv9VowxzyjC1zgvN4JGLQb5WzStNkR-AOymOAjfJHHyuMzTkuNaMUv4rPpGceByP1B3J3KN3Xne126IYweKiBrZ9BHGhuCjaFjgEOEZi_eJlzniWqY5sM2LuDyrDSh3WTX9603TBkG9Cwn1DMJRoIFpEC5BqRMjI9vd9T72Nz3mSl-b3UG3yP7ijNBwmkK6zhd5rEu1FkE60POjhUDSY62nQ-DQi3tPATXMlTRikQSiVDpWLy6FwILl9jon6z3inhG_eE0kjZGxWdoXh4L0O07n8T-ZijkPB95d9pDhUzA4PsUVfg95ranbIHN2dXvS23iTN-z366PSqSUGVKcsk8QxfbQVBrF9iUQf5YSYoQAltHIW1PPDye7yshv4jGUpTNy2Vx0QvQKxYSWlNTKbCs2a9GTCT-T6wEXWLUYykAqJ290Lqf4SbdjS_EHZstFvqR32KxVIn4UG3cwlK4BwWrFX_72g6QnlpyNqADIvFgBLx0vc3qrvKYL4ZdjZN4IbL77fXrdrwMzlG-iOVMa5EjJmzyJ3qSTlI7FQEcJfIpyrCCi2Pv5ZD6Yc2ReMCJmEHdSR4ZBgmQ7lHrLNUKDkeyK115RlID55FSMH6ugeYLQbWJ5vgkohz4xsha5rhKO-aHXBENTd2edXB4SSQqj0MMqZ1qnoNQVkYhKIFhu2PRs9866aIDREf8LXf3KuMY1aVBefsIeky3YUEy41W53R-X19wHWEGhmBmlU3oh-73LbnljKV-3mrySysR5S_RR5Lv-IZ3ABMxRKip77_ALImTvEyjJ38fE5RfZDby2M-fDyjS3RXJawMZvcLWwwiDiDmC2Wnb2VUn7VRXSRPkSZivagyip9z17RJYoRAP7nMSaUThwKUxQtewbxYriXKz7YKOaFUvkpvfJtp1RwhHZuhkjgwb45ROv9pmvC4ACcd5qCA2HE-r4IiWw_8zx7t4tYKyeLkR1gelFnqe1j1Dog4XvvWXHGE7UOpkaXfEgkqfPF6l-Jg7uZCpWWlJDhIGSU8Iz3Q6glxYs44o1073NErThQCjwsd5yyX8EfHW_KgaCaLlezUaIg8j050EHIPvP4IhpF2omvQmAFHw1kpjrL-rUOHNBWHbCOmuS5VUGYOSCytH4e78hCyqYdPA_I6DjGvPi1aZcJJp_8e4NckuQowCEkCNpgqkMNL79ebnCpKHla0FbrlMfWY2VyStLRbdBsjhM7_ys3z1SLbITxRFPnnINuiJ5k-ZnAuCyvCxEDgSadRzugsRLMWHYT_NW2PUINxF6zOVR37uRO881-Pa9DmxqjdLDZs0XWsFYgJFH5zR1wTWhi1KXJ3qUSH-hOAVMnv7gNVgvV6QHAFrGb_XncDWD0Mll0n5o1YUfgn-bp2cerxQHtau_0IKaDN1N1zJDEmPqzIVsIqXrFakLplSoBaniSze_XJN27BD2swZBgKj2lpRImm20i1zHGzxZoCyWT5zC24x0CdCw1rzO91Avmi22RvtwdP_uVnAawj8-EGh4vpEkt1qld0g32zkLQrEWQBkQzCmuRzqrPY3slHy1a8kSGp2hxBsjAd0DpD7Fl34FaHUdcypjwKEoYR1gqVE8536PEhmEmPPxcRmoqqy960O9wxcmK_wf8MXN3t9YoOcJZk6C3su2MyFCqyBvIaVxnmk3uF5dbCm1p_VxwPidLel20LfcuKmHdiR-Ojia4Coa29gCU3UAewNkrEKPfb82I2OntbNdZa8piKsljkNx7bh1mY16vsya3mVdNn_FmvbFmvnVadsKBzp3-bsaXSnwU_Eq3L4OR0SpRNo86hMKsh-pgI2aaCtKEUCt31OEE3NF--RXHA6vHexkgZC7GOOfPBTMJGFOQU0Fx3sNmkNsAmO4HTcVsbqzQABCzVUTUPnA1fgyoypOaUJw1Onq4_gWWp5GB_MelIsvfGrGEOMTqQlORuHcA0dxDf11aHlV4Hz7RdvFPwVPV5x66KUYLwCF9LsaAqpff8PMQviWdJ67bF0dXu41j8JIdaL6JnOOfZHG_uvwENuROgEmMhKTU45KrlsQshMUr_-h5ZkIlYDMXK7WfL9fbwyGva7wX74lID4Tg9g5axKzF61D5g0rsqinjY615IcjEnh0DVL1EpHPHFCmgLZS876e5_cS6bH9qDUH6502BsSBc254zNOjL1YmhFA83lYheX4PadLfWC8Khdp1kdGHC99xLR_A8-Sjx6Tyttn8AHBX5UsOqp0c3JlcAEoO-oX6OauV4nozk4HXZ-vnG_iZ4P1QBNqDpbTai4qR43RuIfx3rke25VDvun_X3VQ3M0C2LP96Q-iwh0fokccaQ-WfYCpcnGqbERn8Vrq5YmM6iD0auSYIG4cBZ_mooBksoC0gx-934DzsRi1FthRfW8mDqE_7hz3z48q4hubPU7hKOYK12H-ochWxBMLt5OMkjHpO9wof1pJG1s2AginKHB-kEYeZnK1tmeU2IqL4qjzEpS5YKgJkdFYY995SCtT7_AxcDfyamt_hTbuqFvHqg1Ju1YoSlIH4nU9SPdeGsQZtiV4NYaWJos8yhLqVB0Fyx8EQL7S1awyv6n2qy-V8vPrCv3B033MYMulToEhpIRJn4h54cUxA7_Vgxr2jJGxCLOsI3XPHGyQfEYpDPyLMnQtetTHq3zVrYSx8nuFAcPNJf3WSAeaXCgQRpEMLQFfR7PxlC_BX5AH1hzdduaSiKtGpmLQ76j12mpB9YLX5fgoxRANCMY7Uv_GqN1tQ3I53eGb2uNwzCkIabTGYBuZ695_Bc3C6-dExI88LiLEd2Hl1ntMOo9aMY1M8BnaOz-pl6GL03MVFHkvh4VOeVK5F3GJoHe5s-YuvxiEmj-XDMm5dSligizDGDqxKoSVi2tk0xm8psHRj4qROGc72f7D8-z9ufXoVfuIICYn8OfB1uUrker4okQXFGHyRd69GoLSZzRVoEQsQ1xfbY0waf72m8_RdVg015d6G-WfVKnkE5caPpM7nxe1rkkEFeGw4IklCR8Bcdx2MKjf7TfR3ygzsH8GCSuoPSmlB8F4-ERXaLEUNcFwrTu5y3uNYPOkYMp_uwRSaTcBUvelz_uCfy2POsFJ02MNXkGQnQ1orKndKX-lypLOzq_HP2RV3qB17jWdUlFQWcI5ymLLCxwjeuf-Y4U9W6h_TlXEkMxxJZdouPOvfm6IUvzw09eSba6henMZ1OOpOVPdn2SPr65akNjzgqEErGDvNKOUcNe0AIrIQgizvUXUd71faSIyGHCwu42bSLH7m0keI5GRYrIMRyahFzN6NGwmldbFkuOVjWoZLFx_WROod8hUjJe4hKS_VHGisHcw41OonTiCXOWeBfJE_i7QnFHhrqmwPgnegCg1qERx4WExstSUIZtz7cjlYyrld-N_pbp48HWwhOmswL_X51N1Ba1EX5kMarCrubUBJ-U6-wLsjEa07ild0xCXKZLTsqrby-eFRy_XxgZC-LeCuIsmQJrSw4ecru7gi9fNsMjrKtYXuymUE5S9BtEzGH8nYpQv_sfRzFDU3GedMJWKOYTy4QFXh3v7_2t-zUZCubg8siS3YtJ4dCFtlHv6&cid=CAQSOwBygQiDt-NH8THXzpnvcFHfnsOPG0Qs-iJCzZfpIaFyQ98albDrOVxZxJh8QQQqTZqCygtYC5_YohPBGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=6531176856135113000&adk=212707235&idt=59&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fed9f97a3b5d0987521c06f189cb3688ac17b011fe51ecf6440a060b709debe3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36939
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4F5C 0
20 B 57ms
56ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3172506028357&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4F5C 0
20 B 57ms
56ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3172506028357&version=m202301230201&ct=76&x=1&cor=10751858688525875000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4F5C 92 KB
37 KB 68ms
65ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CpTQWZEECBWngQkxeZCp088yNXtQRHJICAOT_V0kkg3J42geynfFwOWPr4DSzXP07oUepW5dazbliV0ZtkerVEGKVEYe6xHuGpiCYvvFhAfP7csVI&cry=1&dbm_d=AKAmf-Ah11cdAnJZQRYWEFHaVWSOUF8ws9PRa-hVFutmX2dOm2PmdaiT4W6s8sqGVXFmRo7FUr1Yb_dsH9b2f0nz-RMxEwAqwcTvuChD_ezyPYXz1m0Y33C1XgOcF6u5iwMRCYTcvjSIJhCDGf1D3kKSZlgdH9ve7BuyElPqLF3OS8WQwwDMdz_49k19CAANRhWk2B2RzibwEo8YOxvAYpjMdvmKRXuu07tIy2NKhtD2lvEpMBu2DTwGtt88Nypjr9OdEqScLCNDQFb-OsY0hUh97o1RXOcNJXpkvYjZKsuv09B9M-cG-K8OqMY8gf7PiEMfGmX0nwgV4ZFGPVUizPDsM3kHbYKOgymyNEWko8rQSak2yrsTV-4axn0zyWGebNJkNM4sIY3l_nonYU2abxN6KnxZg8l63H-QBNM2WCyWn_zeVmgIEJ46tUD4xBmyUbpzwtZQaHAyf41_02gZ8K6hlfWxb-zGMuAUN0o3M2kU4nKgRogSH-eNhofZlylNawuCvfhD266AHzquUjEaoBG7qSXa2S41hZKqQsuHC_0LjadKXj_veZKFkGfkUWkS79qZQmUjAiq44Pg0qcQ3kFWvKJ3DBjQsEVP8dGHmaZxfxDX9D8AOfYbqa8hxVwN6LhpvSn_CZmc_eSqaKl_C--szfcff40A1YIT5H5VsszfIVTSn8QaZYS_4jMx73cLZUdHaYF4mzke5kLQP05hXSF62H-RMuu0J05UJnLrg4Grji2JXZcKaP_d-kwnvtYDnUFAcrJ4jtzFZCIYovfYzYUf2gjE3UV-jYK3OvUPHRxL_C24qI9u2PUNCY6ophuMhi-8uLFfjuYusH-wyFJaKcgfGtyB8GhXhZWvROE1nLmzbloGT1fkTYpVJy8Xdl8rVNMIXnj0sWWa-ALzwETalY6TH9p2IXxGKpxMEx9ua6ykoXRSdr97l95YNhM1qucUJyHHOwr5DhVkfwwBK1I7xvdSeZeVY157AnXMcBJ51po7xikT06ak_hlTKujjgZ7xdF3DkMIWPNHBeKUsUdy--bKO0MgiHJ69b6uoYRdoBjhzO1FsR08AGbPfpu0hlzvbD0VEsJ_wvy8pD4U8KvWrYQqkREh9jcYZxPSd5BmnhvzkueL0x_KoW8ora0IayuVhGGVYB-AtdEmgvsQZe5icThTU9f0u207c8MVhOI4lzvz-_-xRBnn5nE2RVe_neyFm09hzOIhKwgbchm9sX_ooatT3J0gXdsNWFkLzN79n-4NHzsmIAjuoTttl4gZL2BiYPzorX7Vao5OCLrlKjFCweAXAsYPXvTgBlTWEIvbZ3IaYmdpBDfVvUoXD0_PvItyUpmkKd6ErZgC5io4I3aDf44NEWbcKqFLACTc8dQKkjoEMHt0moCYYMNUj1LZFscXjiTqToOrZH96MbgoZQlFkkkSjHQGQFiSsTsOO97EVUxpteRvTV2RKE67SLjI2khvfMGoVXjWkwIPXR14OsIkow5CA1CzwyCB0Hhw6CrYazvLMJR-0RS2ruk92j0eZ4903YRh07nu9RRfYiaBJ8sYd-W89XJR1j4A8ePzZ4ErdktRYP9OgpwjnAFhDNB22cFoLWKhIgBDYZAgXVfbP-2JjRIT4lF2s2FOpG9ghglGNngVvCghnAdlyb_uaNC8WQlH3lPXZLgcm5QkwzuD5T1g-HxYTWrnGTZ384Y3HkDkfJ4HC0NQUkUhRh7yUZdKP4sYiMDiykxdScIARSUNTuysGbDdEqA9CybtcqV9pwX8z_fMRglvrAe6RtKPUA9VlkguVajPO32rNkFQYLf8MPjfpwJVJmBgdY30UvzYyAYC7fCiE9Po2qTCCX5Jjgh0SVJuiiOxeW8zOLzdvHGmU-sHysQyzLWwZVVvQGDataII4_2UiJYTawOvfwEYZDtrC1hZ_UAazARWuzPamztA33xWK90jt7Cwhd5PV3wBVf5D1eesCxgXnVdKJChcdoPxB8hCkIhrcSEEa2tr-L3JdI_4ToTBE5HB7qA76St5XkTwvYT-mc9Kox5MQ3e1zvBjlX2vo-nfYG2dLZpvaYUNcxxQ4TFuu5ud3pfrD-pAIpgPVXftNrGGpv5GzhH6Ahpb0E36vtiNjKzOxSt4raj03Hc0v4ubV70Z9ihdIO1kJ-IlxzpUmKxYob1HZfKfD3WSWBonxbhR4PGenE41UTagUskYRJBjZ48I1Sr9zYfSXPoe9ehkBDOKr4xcw81VUXC-wRDDHO-nUGUnQw-YK-BhaCDNwcb-FJYiTPkw3o37vi_LvpsvgBUeBqjZoFaGHQFqSPRYRreNTE__IKoRN0JyxCFWeVUWP6UF9VfrbUoJ_lLvTAgssqLxGeNgpfwmE80dOkedOu6trk6CIudHN_s9f65l70OEZbxKTaTjfiF5ak1LJAfly-y_Ovl-M8uWeHUdkFcwgdBNNWmLAz4RNagrZl82t4EF77pGAJjfLZWNfWz4C9cV3Spq39PipBAlZ6NAlK2fKZssi77fKAfhdsoV9IlBTOO5QivfWKApQ9PxnTg1SCJTWjEsLd7EPmmUurj4npkSZQsUjiI12HzjdrmA9uI-fC8LikTkuGLUPKM29i11XvtBz6wtQuhOYCmgSreCqoDW1P_A96FBstMQCsDytEK87uCLhFmNaPTWi_O1G0Iu3DhD8GfViPGUZ9y8CqSSmqyuZTh78ETM4Wa9OTQ0JzIshBEaHohCww6_FbYUcbSeS3Kbq4ytwfwePZ1qiWqcbWb89E6siYDSSZDSKA1SfbY4p4b7zwC4gW628HRWpEcLIYsdCluqHPZcssz-HIyWo1A2K1lm5ze71ePR5RZcBM06s9eaRnAuHiXiiKkjzo7SM-sy7-Sy3uprH0juRHUoJhNhZpHYTxD-sb5gVigJcmWtfinAk_-UM0f3buDHksh3SUOVkJj3Crx2mqKcw0hqtFhLfZViRDRKqBJdVHDwS6B5d4gIA8Fa5Hy28Dgubm1LaViDc7Y3WYTaQg7RUfEDPXWLruNIeeS6a-6o_iU2GME7j7-aeITX0bi08VoF59O5j2PhVPvwL1lSGjJ3MZ9Kq-IfbB1WSJzJ1Ogj60Z_aAj4ignMrKOYE6c4f1k98pvoUpKWrjN6_y6HYbmc8RSCrH_dSv4xTlZ4S_w3sEM4qjm4lrdH9aNbOeC0n-X2w4f2fcTJ77zDnh5CYHHtg-_YsqYBPbN3vzHDWBN2UFlzV3duQW4jwLrpKPqYUGkygGIanalNbyM9ovHzb23OyR65W8wt0Dav33JqMweGNeQskUHL4dCKlbiYnkyqHfLVEG3C3Sm-lOz-qDJim9Jyg2PK5QdzBLJMaVNChp99Z3I1gSo6GkdUXZXl2nojsxqP5hq7NXynxLLXWfmG1-sSlWqZYdzdwjawlFHj6ikCfpWKaR-acILOtci-5rSPJOgznCHLxCz_cgSt3xWL9RpS8idtqm4Rh1RGknMpvkAvLDq1HY8j_Id0LINK1fKEBQkvvSkCZX5q0gbA4LPLuzhw87xDfEasSEL9BLX884XT3booZyavnwCFVUW4JDkQArEqJapYsAd3jOBMi2C5h8NWIdwMU_c0HJ9CJYDAg00FMq8WF1rsS5m-L2uscocQzc__nBiDwkI5bBV_imZU5HVykzeyTbGZtSWlwS69X5cTLwIGGE6Zp2AoZ0cD3zJJvDg-0O2c63LmNf31vqBBTliuarm_JqEgidZfbKV48I8rG5HS4V6_VoiewUqVCXGSHJBrHOS5GAQ94mc_m_bK2YvOU&cid=CAQSOwBygQiDMzoSU9lK63anHlxMgylrB_z-PAkXqNXkWahw-H1Ni6lpYvnizRvJ60Po-XMyayKa86JaqQi9GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=10751858688525875000&adk=3587751834&idt=48&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c355c8ac90cadd84baca4b13543ef28df03fdce52fcc14583da36e875cafab37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38109
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CE67 0
16 B 38ms
37ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjfobXcATAB&v=APEucNWXSB-lU8wScrrPv2XdYSiSSxeqk2fGx1rzxxgPiNjYRffPVD9TgtDkF7pKvyWXQ4PAa3ZmonkGhuaR3RL8MfhJkEhE0gVfpCtz0Uw6czbTtR9ksfmYRgyKw7g4hBUbmNBWMzhsciaeQdjuwQMDYwHydGeRhcnqf9CvVrkNB7XLrZQEJT8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688426539836&bpp=2&bdt=118&idt=115&shv=r20230627&mjsv=m202306220101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4741162245852&frm=8&ife=1&pv=1&ga_vid=2009876620.1688426540&ga_sid=1688426540&ga_hid=926749968&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=1946496577&scr_x=-12245933&scr_y=-12245933&eid=44759837%2C44759927%2C44759876%2C31075631%2C44788442&oid=2&pvsid=2896560028346402&tmod=1937665132&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.5rccfcav9fcx&fsb=1&dtd=120
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 23:22:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 31A4 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50fccd815c37c4f9e41b0edfd0d821c10b482723a0420526ac6415d593e7b8ad

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 5ed7638be4b07a92411bbffe
ng2.virgul.com/tck/imp/ Frame CD6E 0
209 B 70ms
63ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed7638be4b07a92411bbffe?g=1&t=gb&r=153366@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1688426539085&userId=vnet6c8dc43f-05f2-4af8-b887-1ac62d79bed6
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 03 Jul 2023 23:22:20 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame BD0E 172 KB
60 KB 112ms
54ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Origin: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34185
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame BD0E 11 KB
4 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AIrChUudQEhZJ0ArT0dXwY6busD7m4hez-Vqbnyh_NuVrrIC5xFCqBqyG2o3qNCzD9CcRpOpCnx2M05zEzOqDwbGioduxE3HGDj1WOp5z6hdEO1eY&cry=1&dbm_d=AKAmf-BB4tWiot9DMuvgImhw1AZlGU6RR-65ZcPFCiSAXwp7pb52UBClQnlbcmOWvKh2yQqIOsngQXLm7cqdS9dZzmUgEa5ifSotCQxGVPMU4mDU94le_buB8r-3UIN2YN5VVFiYaW9cyA_FOYXrZkR3zUmLStBqGhCkZ_wLvs3wHZYnTtJgFPsZiHXRfE84uSFx85I9lG1fgjT0zilJNG8kSVLcIZPjlOH7sg9kXo8aPFW1X-Gv3OzB-dfeN4tu8pR34TuH_GP6bKJVIEu_Cxwy1BYD3jneGphQiRGOmOREKj0TpQZRwSygTuQC0otwVQ1V3fce7DCnbZfecXRe_MfLyy9p_J_vibuQZ71tX_LNyyu-NwHygwcbzvsCcqQ-ZpdMty762hTo5o2wnSbiqwCtddNViCMu2dV6M7vOFF2-lq1u6PZUa46noboNUNcvSEuCTVqp9aYOUf-0tQklpQtfVO4bhSKj58miRUJ4CVLVcyX76R5GbNpbcFIjOTJY9kY9qDG1v4aV2JCoQ2LxdyHmEoQhiy9_XmOH2bFNdVIswqlJ0ltiqsi1wofMvrR8BNmUbk66g-LirMIAEBDV7IFoPLbHwLUSNlVHkoGmwieXNaxXyhVH4WmJ-MbUCB1Fe7zSbjRWYUZbn-bU-jaCcLQtI-5Mf4iXw7ESq1GCdfmjc-F8zXwpA-Bg_ShElnKQPj66dZrHnIe1xEBx2owTLDu50QJvjJuNYbu6FgV05xZ4wTm6DBQxsEbDyvVLpq0--o35Nxe6XRI4jC6J13uPQkxptOx1BwgnJePSlSnIb1L2OWdgsCvfS43TvWrhcriaQcqdGRdWYZESxGf4I-nh-E4vIyAAi-TO2c7Fers8BCnSIamMDVjyhFLcIrdke-iEAmQyRf2MgcJ6ClDCALbRjLmCfhGaa_sI05fEkuKq1oL_KIAYIVzfKNVpJJotuR7zjMLHaz1hBwF7OqKgj7CQ0ZpAqScNcTGE0DVFXP-2r-3cdGJL0BRdQB7DCbBhvmT2pF_adSfAgnjCJ-O1A0isC3AvcJ7n6sJvYKsQqof-rqXYhZgtYaRPrtMVV8yM-SIUROumRlOF4efp2hiaFKNEiEE2RYjDcpkUhillDFuG1Bod_R5iS8Xh8hs7n5X50CqYS1EugwMPyYQTAfyvH5Voh5_G1xNpTOqqYv-dBK9W6LhSK7-Vpfj-dcDcqIX7VtWCWCQpFQDA4KWGwg63LPAwmazsNiPHRJjlwrwzvXiSFVwhs9PGjDCw5eIKOgkveqbzf5qA1GHrOq4t_ZNK1EVycAw3z-xgvk_pGYyjZz_qmusQcGw-OKifcEmblZ_7W9uBYW98fzSN_fOPPjkMMcaJ9jKzg0_qeODzdXYhzW5xLsOG1FB6FYgS8qvaRoQUA37AIyy-pPiV7ZLHiElOZ-ftyBDT-nsKdrnf51LSXdT_o0yuAcPlPtTCYQJsqugQcRAX-_EcjrftFVSUlmhc1rp3_a7zlqLAqObfy81NifgwEU6x8CiPzIXKHF7BfSTtS6X1fvNxTXkBr5uvWGlRaa7Tn4CZHG0Xfv2lCdoOxADdDyw2JRQdmcb9NM6MZJ600PP2mUmFt-IsPw2yQKY09N5O67uIiruiJkg72GDD5lylDjcUF2G7aS7r26FnoCufQAsYCDnhr2wYTA-iU0PwfnSe4dURLyTZXhNCWvYZbVqsvf2rGg1Oj0n66U4x82bhychJ7uRENIKPEYRS7hoql3TAW9Si1acRibWxOytb9Qfeps30_OoNMRAVx8Je2cHYaEcHScRVuSefubBBpPtyxwaArIRIuFU68JbfJVJP_YyZ_qPIhN9l9ojGthG5KMH_rgaB10wShwLrRHnEU3lPfP73x8R98OvlnnVwtKOzzLXWd0r-haDAOCx49fZZl-_8xgpeCvmj5LK37rMHCjgPU6rcIgiZeOIuPk_bpwFZ0EJgAsgdSj4SUZ4LMA0AB5lls6PR6_x2Qzk5gMD5syrAq33kO1sI2gn_IZwBsb5jgeOFBxj7SDB8bBN5H7KGph62Lne9D5tRQ1YLyGhUn8YXdOYGDTtksXmfT4vd-vM0ACbBT39AVBM53vsTTgW078IxXpV0yHhf0PMiUr3IrDldot4SUVdVKfJ6a9LwHs11BU3P8MTXtzg3ZFQoq8DZ8L0PT3LOBnN60_L3tVRzvtHAhbHE-AlWL_eZW2UIrYyzv8lAu7fP97NHFiYEfTZMewsmWe6AOVlngO214kJPmvebMpPi59svFtZaoWSvnM-bubJQNOeTurJmvWXuNpQxDleIPWLmBYJSNDdyBcMYQ0y4MfOIJw88XyvLQRyDN074jlpn9wW17p0WxC2pKyhS0irLj51h2FMFq13mi-xBgTrrRw4-ZfTuTO_B6DnEjlVYW_8W4hi4XkCZf9dP7FQbq0WSFXXcewn09AndyJ6EGXkdOHjJ1dF0DH61JkYtIBX_O8tmJaXdswMy-NXpULTBEDnZoaCUuo-C6J7KxVCl7ArmzKlbNFBHHaPMNgLjM0oMPVxDXh-x8jIrTscSPkpeSk9uPZWm8COPHb0oYcS7RBeeYPNPHf4R274bEuFojUMQKoWEpZ0lphFczams62VRX5BV5rmCIMf9Cr2E9X2_a5_-OhY-EsTdIR5ALOjYMFVOjHSz7vbCzteRqQrAMJ0Gm2R_hGWVyrOp6WhN9pZTRLxmNFsrOX0p_fdVbVJI2eZ3jAi8CiKoDni7A3dv0o70WWzeCUuMmSUHlkInCEHMRdBsFGoDqYBGCpZGbXK0bTsKU0Dc-h9fpHN6gjp0SLcnQzb2dZ0bwZwFVMB3FG7oSaGaPu_cKSu7ZOPETNxeUm6ji9yvndSO06VNwn1C_XlKaCvmvHJCAv9GOqbIAfbLtHZS3J1h-MXvyODJoOIxnbZYevFsVx7AVFGzaqawAX-vGMn7cnYSIBfLsJo3tSTk8k69rAeHvCoZaprjht8jG95ZmRqXftA7V65ctCA2cM8WNJkNn8ZI34ZLDZU7vRMD6Ib25sH6f648zH5IzrmGPWfJJXjZWWgqGCrOa5ZHoBV2lI-Tk2NBqAINQJy1Ae7z0tqQJw2vbBuwB-d6ZCc-vgkJd0_Jzjpca35RVOr9OEeAO4k0BeJv0FlZYQp7fh_YjslVjp7obCkL-upKHleY9_kdJh8rmLE3-v9jO8hPj8izwEdTu4RpwdSBXH6q7ePEfL5r66KEUDsP-qou4MlUprNuJoq88gqheeAN8EDdDYmFDJi593kFPgoMj6xGOZkPu_aUEzu92cklom0bPZuphyZdAbZFR-3pKdVEsH5gDl_aTrz7RtYB8bYAR8oHgFu2p2olyWB9DyLWHMdrcQJ2EwHCbE5Lg7mv42SJ86boLoNFb1zs5M4JkcOp-9NG4jQ4e8r2sfgAyoMtV7jnmVHqTcN8SiiCgGlrpKYHAnvt0Fd-i_E7IgVhsq-t63QHzrdl&cid=CAQSOwBygQiDDHZ6arnIXMVRTk6nZ-IzJiAh0cCT-PUyirqZb9-XBQe1VvWhRJtG257q8Xo-xd_9BxiAaXqUGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=2186336911989968100&adk=1599433117&idt=65&cac=0&dtd=44

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame BD0E 30 KB
11 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BD0E 41 KB
13 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 490371
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 4E3E 172 KB
60 KB 98ms
69ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Origin: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34185
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame 4E3E 11 KB
4 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CUHUMXrdbjq2IxE5zcGjAEM_4QcKKQ8xRiPTF0H-i90jAMtQbtWRIxEHlQqbyj__WYOp0kNZmmt1jRwK2ZTSx2vQ4vpf5R7hQMzwqIOq3gAPN2VNI&cry=1&dbm_d=AKAmf-Azuaxf-a8sYzg-NoBbhOC-zhxjWeDmsodxRMMglRsO62FaGB3fJRSF-v0iP71bldwAGidPlBsvbuumSCgV0QpNr07JNDGksibOCAk38CcfyGoTBGuCKrcWthwuDizu35HUsH7beNqmGI-BrwykMm9gA5mnMQYbu6nuWrYKowt-EnTW7x-m0ypUbg9g4F1-jkAHw_jOQZPNJEsxWnuM16z0mhyZYCSgAkNGUL27fvXXMCIDJ9SEjpI0FxgJN6p_SQbK_X9yfPUeT85q3lX4dKoFw8NHPuZ2PclyTkQor0cjTllhA4kTts_0-zQr6FH3cFr2uGhlrh4_VuB4zjoANrffsGtPlSTaVgmgpUgondl3FDlmYDbJQljUKy2nxxUuNkGNfpwBDKl5iBt1rfCDhshURk0stJaswAzHwIsW2nfoNqE-AMICJdI73DEk71rnQWLp2odsGl6Bnq9SadzV-sM3fumIrYb5rN--55nW90b1JfEn-iUJCN1gRF1xnFZUnqaVICP7V0aK9EA625o8QO4s92RNCNfZMRTcw16r3c4GCyvsjcHnese8-7MC3yn4jjnELf5j45PGvimmplmVlChwGnHaG8tim6_sRpSogfjNlsP0jz8XOTnl9OSFtrAc6iTH5GUIUkvb06dv1XUdMz0Bc1iIZZaRDOb4Ur032NNTJYmvyFkG-zlh5ZNOIMewzQhH62_Xun4C1sNzzLbnmCJsCNCcyk3n9RohMaqoz1l2ECR7G4SLntkCXsxTFaiQVluOPZRXP4T1WePJ9kS7DhMyrWOmBJxEXP0deyHg1-l0XOb_8t6UKrZc0_bLdkzO9OpL5r5IgIzCPKrrduP6icAfAW78-4LA7A-Q3tSrsWDFhMYlUVM1215gtBSCsgbnJrJk9YS6mDFhjLcO5uPYj9vBrCdVHof4hdx3ki6vq-CxA6pFDEj4sOSPzxNV1jJto4olEmroZdFRa0ESHN0bujTDNjSWBCAtPVCu3qMOGz3fneYJLQn0S6yt3hil8MNIcf3XjcIKfbVsIlr-Jg1RIoae7uXye9HdCCdmGfB4PDzaJJTSsm8f21asFXwyE8s-ck46dpzZJazgi_MgUkDafgz8zE6nYW5Dz47YfTzRy77VD48u_sy5LieDxsrfn2XPQ_kyJmFd-45NPkrktxMwTsNrp55NayY8qjqebL9R4mes2_R9PUdL6V1MTHAfQ-KWpCXFd3rxP2Vn99HEkV3mgT_G9LbR48alW4hR57q7ixJiZ8o1G-_j-_Je1kzOlXmG82xhy7Uvt2zKXYaKCtD9vpHUJmA4_S_UV6MWq_cSpsVmigdqSFKh36KCwSXKjm0i1PW0QCL3iV_VrkRD2pVEHzglFhegL0rDbAMa6PtEle-HdX7LBEFQP5XIP2uZPzDZKaUskc76gtjnUlgU6P9Ch1ZKKKFHAj9CWdIQ7wx88AGYh1grN3fMoTfEYuf0AbuVzyjj2I5xrAbRLTGXa450oWyAAVP_XPZcHCcxO5BrEWjjTzsHqUJ3YLwOsM-XUbDsXivDtjzfcuHnrM0wMEniDLuym6nSpnBlga12r2Q0of-RgbFZdjQW44EgHD8SwBrUl9-vtocPvItyH6Nz0Pn_o6wbfbF6nCDWBgIhqhxQehIN1-1keZtzP-TR3s6JXPnHHjmyqgmE9ZQvfEpPMJBQw7jeLvMRboApEbn0KkaAB26_p0-cxSezdpPrhe_urcFi0wm4cuOXL5eM9YkCHvGJ4nXz5bCj07AONS8T95oB27oD_xBXLQ4An-0wOy2wtLZijLh78W71SCpkYdDsmLe0y5m1Tr3Z1cbRGWbJUH51qn15LfeKtDFlS5yLKezZvc8TBkX77C050Lk7F4BBWaFKnh1M8PDBqmyFDkg5EQ4xJ9_Wbumi6LkFFRp1wVNysHHhLWhFx4Av1hfM2ZnMHpUp-rwb7ae5c99S2IytCub3WjeNdH7O4e8kFr4PYdALo5BETmgh6q3K9pzJEJV8l1JnM88Kbvu95V3uxtbn65fIZsVPCt2j8ezWdANi2In_hpSao_MZACc9RkvZO0f3Qu0Izkd0lSbZ49N3y0PbDC3dtWibUvTcaLAZK25eMOk4Z6Ad4ginZHlMMUjXD6skHappRZmqdYrjMpjbk96Kyo5-EbRrD8TM7g5IOA9Ls6y2Rs2eUaDQCgEIEEVfojYkKLRie8q6RqjLc-hBgBaqh7Roaf5MvkZ2Ycp5slmgTZA5UKJrP3NL32MtjBKfrX1MI8pyGprzCV8tvRknOA3fnMGK9RRlV6bTkk51jOymI_APxKlMvqqGYa7aa2hci8k765nxRa9nLZD5kyfuscIVoDgv-H09nqlq5h2FSTlc0i6OaiMuNI2a30uKLlJ7tDZTVfGQxlFEwQrb_USXcjRHOpum_22tKRveg0t8O_35gArQkofcoQ-K3qbxy5GyPrutNXkZdTVuX4cv1-EudYvPUbz6jbzjg8FKH_HcrkfWU7AyrGM5xtx_Np6VqkE6f7bl0uJtC16c0xfjMQIgfS1YKkdR_doGmz05FNYrho5Sbxt0WnvzmBxNfFuFuLgauXs93ih_bgUMX_hWH283dC2TYgJiuC2vlgu9yaXVcVsRFZIQ7jecnc1cg1OSbBe7MQUJQx6ACeJLbkXH8PCFoA-AQ4MZip1c-j5zMHsKg7ghG-S3diSzRzPju0s3NwzZmMqXny-jLXUkBip5IHJYt_YGcZC_1UJM543NvHdCVuUsF3y_sXgMicMHj-NGdw2m086mw3rOs7lYlCK6jz0jNsZ9ugqkGtm_NuSVhhVVSqIe82yMRw-GofPDhh2aWREnkRU8kmysYo1S8iE3pkHfOyhqcOparQJmwu2IomS6yzXgqzV5eUGGcs8EFIvC_QbadWdaIaGNuRxjICrM4R4NT0l5WUQXtBz0w-QOXmOdWtekLDA5cTNpVKnfzvMZGbJ5ACY_c3IqY38YClm0dIWDTaRgu68Y7lKZG0kiEUlJ_uulYzWoxkWHqQArVOChWteBqUlUWKzHaXwL7wDYPIcCZJnJ4f7imYPkwMIvufuDYfUwqOBsp3bhK_UPKPoC-pGsv65aoRLjciSp_t3vrtTkN_H_-TNynf5n6CS4OwBSLZw8InJFjT9xAL9DtzZBFUKah71P8egeO7XjAEJJosVqQicHRsTmsX5STuk00MV7nkfgApX6lD1H6yDh-oBZ-xOFj9MJYxITmJDjvOSIKyEQtn3ztpfPm0Rc-ndroU4CNAMiTL0VdvDc1a0K2e-xujkD9Fj6wVwcNrnliHO8Vh4XPG6IJDIUq4xmxcdu92uqhKLSUgKrP_rmQhgNupXz00D7XjUDMiejq2BN150bXs7Xa_7T2CG5wGrcl9xBqr_zXR6VO_Vw3pMDW2bGuJhmXnwqQ5Yc1l_pDM6dKXOWYOMAVisc1Vy5AdwHP6t6yIwIshZ9mNVzeqLaLBEXKdy9WXEHnkMDLZSWeCJWnKfeIhvqhs_rBYborywMMlxxu7Q4s7uhaR_nt2HkddnRldTwb7xe_MzvAcSq5euaQycR4HX5JH-fxYTJJSMvocvyjvUm5_bFCGE4qhvKa50THNWVlCudfyPf3uUAzHYAuCpc2w&cid=CAQSOwBygQiD4M317ZcIeH3uYgh3fMVU7UweichxXU6cyRsYhhDFckt3wmvx68JVogCGB9mrlfupjVQrfPgVGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=9191009336661159000&adk=2465470143&idt=63&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame 4E3E 30 KB
11 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4E3E 41 KB
13 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 490371
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 629F 111 KB
39 KB 46ms
24ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Origin: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34166
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:54 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame 629F 11 KB
4 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A4iSxLkCajtN94ZaSqXPGgE3IqBaRO9b402PUi5W_aZe57pQQhGFkofJEM-vOCoOsSOlIprRuM_fpFJS_ljcVKk_IQkg&cry=1&dbm_d=AKAmf-DGqteuY7oy8dRNusWcs-QaRCnx34ndhZwXUV83ye19BtKMeNerv8pGUC1ge7vNtiHaNmnU-TJ7DOafdGqfjvUElc0x3mJubcwBEnNnBDDq2UT1pP4PMZ4b79X5SX2EwAJk2bfnKV6fzv9VowxzyjC1zgvN4JGLQb5WzStNkR-AOymOAjfJHHyuMzTkuNaMUv4rPpGceByP1B3J3KN3Xne126IYweKiBrZ9BHGhuCjaFjgEOEZi_eJlzniWqY5sM2LuDyrDSh3WTX9603TBkG9Cwn1DMJRoIFpEC5BqRMjI9vd9T72Nz3mSl-b3UG3yP7ijNBwmkK6zhd5rEu1FkE60POjhUDSY62nQ-DQi3tPATXMlTRikQSiVDpWLy6FwILl9jon6z3inhG_eE0kjZGxWdoXh4L0O07n8T-ZijkPB95d9pDhUzA4PsUVfg95ranbIHN2dXvS23iTN-z366PSqSUGVKcsk8QxfbQVBrF9iUQf5YSYoQAltHIW1PPDye7yshv4jGUpTNy2Vx0QvQKxYSWlNTKbCs2a9GTCT-T6wEXWLUYykAqJ290Lqf4SbdjS_EHZstFvqR32KxVIn4UG3cwlK4BwWrFX_72g6QnlpyNqADIvFgBLx0vc3qrvKYL4ZdjZN4IbL77fXrdrwMzlG-iOVMa5EjJmzyJ3qSTlI7FQEcJfIpyrCCi2Pv5ZD6Yc2ReMCJmEHdSR4ZBgmQ7lHrLNUKDkeyK115RlID55FSMH6ugeYLQbWJ5vgkohz4xsha5rhKO-aHXBENTd2edXB4SSQqj0MMqZ1qnoNQVkYhKIFhu2PRs9866aIDREf8LXf3KuMY1aVBefsIeky3YUEy41W53R-X19wHWEGhmBmlU3oh-73LbnljKV-3mrySysR5S_RR5Lv-IZ3ABMxRKip77_ALImTvEyjJ38fE5RfZDby2M-fDyjS3RXJawMZvcLWwwiDiDmC2Wnb2VUn7VRXSRPkSZivagyip9z17RJYoRAP7nMSaUThwKUxQtewbxYriXKz7YKOaFUvkpvfJtp1RwhHZuhkjgwb45ROv9pmvC4ACcd5qCA2HE-r4IiWw_8zx7t4tYKyeLkR1gelFnqe1j1Dog4XvvWXHGE7UOpkaXfEgkqfPF6l-Jg7uZCpWWlJDhIGSU8Iz3Q6glxYs44o1073NErThQCjwsd5yyX8EfHW_KgaCaLlezUaIg8j050EHIPvP4IhpF2omvQmAFHw1kpjrL-rUOHNBWHbCOmuS5VUGYOSCytH4e78hCyqYdPA_I6DjGvPi1aZcJJp_8e4NckuQowCEkCNpgqkMNL79ebnCpKHla0FbrlMfWY2VyStLRbdBsjhM7_ys3z1SLbITxRFPnnINuiJ5k-ZnAuCyvCxEDgSadRzugsRLMWHYT_NW2PUINxF6zOVR37uRO881-Pa9DmxqjdLDZs0XWsFYgJFH5zR1wTWhi1KXJ3qUSH-hOAVMnv7gNVgvV6QHAFrGb_XncDWD0Mll0n5o1YUfgn-bp2cerxQHtau_0IKaDN1N1zJDEmPqzIVsIqXrFakLplSoBaniSze_XJN27BD2swZBgKj2lpRImm20i1zHGzxZoCyWT5zC24x0CdCw1rzO91Avmi22RvtwdP_uVnAawj8-EGh4vpEkt1qld0g32zkLQrEWQBkQzCmuRzqrPY3slHy1a8kSGp2hxBsjAd0DpD7Fl34FaHUdcypjwKEoYR1gqVE8536PEhmEmPPxcRmoqqy960O9wxcmK_wf8MXN3t9YoOcJZk6C3su2MyFCqyBvIaVxnmk3uF5dbCm1p_VxwPidLel20LfcuKmHdiR-Ojia4Coa29gCU3UAewNkrEKPfb82I2OntbNdZa8piKsljkNx7bh1mY16vsya3mVdNn_FmvbFmvnVadsKBzp3-bsaXSnwU_Eq3L4OR0SpRNo86hMKsh-pgI2aaCtKEUCt31OEE3NF--RXHA6vHexkgZC7GOOfPBTMJGFOQU0Fx3sNmkNsAmO4HTcVsbqzQABCzVUTUPnA1fgyoypOaUJw1Onq4_gWWp5GB_MelIsvfGrGEOMTqQlORuHcA0dxDf11aHlV4Hz7RdvFPwVPV5x66KUYLwCF9LsaAqpff8PMQviWdJ67bF0dXu41j8JIdaL6JnOOfZHG_uvwENuROgEmMhKTU45KrlsQshMUr_-h5ZkIlYDMXK7WfL9fbwyGva7wX74lID4Tg9g5axKzF61D5g0rsqinjY615IcjEnh0DVL1EpHPHFCmgLZS876e5_cS6bH9qDUH6502BsSBc254zNOjL1YmhFA83lYheX4PadLfWC8Khdp1kdGHC99xLR_A8-Sjx6Tyttn8AHBX5UsOqp0c3JlcAEoO-oX6OauV4nozk4HXZ-vnG_iZ4P1QBNqDpbTai4qR43RuIfx3rke25VDvun_X3VQ3M0C2LP96Q-iwh0fokccaQ-WfYCpcnGqbERn8Vrq5YmM6iD0auSYIG4cBZ_mooBksoC0gx-934DzsRi1FthRfW8mDqE_7hz3z48q4hubPU7hKOYK12H-ochWxBMLt5OMkjHpO9wof1pJG1s2AginKHB-kEYeZnK1tmeU2IqL4qjzEpS5YKgJkdFYY995SCtT7_AxcDfyamt_hTbuqFvHqg1Ju1YoSlIH4nU9SPdeGsQZtiV4NYaWJos8yhLqVB0Fyx8EQL7S1awyv6n2qy-V8vPrCv3B033MYMulToEhpIRJn4h54cUxA7_Vgxr2jJGxCLOsI3XPHGyQfEYpDPyLMnQtetTHq3zVrYSx8nuFAcPNJf3WSAeaXCgQRpEMLQFfR7PxlC_BX5AH1hzdduaSiKtGpmLQ76j12mpB9YLX5fgoxRANCMY7Uv_GqN1tQ3I53eGb2uNwzCkIabTGYBuZ695_Bc3C6-dExI88LiLEd2Hl1ntMOo9aMY1M8BnaOz-pl6GL03MVFHkvh4VOeVK5F3GJoHe5s-YuvxiEmj-XDMm5dSligizDGDqxKoSVi2tk0xm8psHRj4qROGc72f7D8-z9ufXoVfuIICYn8OfB1uUrker4okQXFGHyRd69GoLSZzRVoEQsQ1xfbY0waf72m8_RdVg015d6G-WfVKnkE5caPpM7nxe1rkkEFeGw4IklCR8Bcdx2MKjf7TfR3ygzsH8GCSuoPSmlB8F4-ERXaLEUNcFwrTu5y3uNYPOkYMp_uwRSaTcBUvelz_uCfy2POsFJ02MNXkGQnQ1orKndKX-lypLOzq_HP2RV3qB17jWdUlFQWcI5ymLLCxwjeuf-Y4U9W6h_TlXEkMxxJZdouPOvfm6IUvzw09eSba6henMZ1OOpOVPdn2SPr65akNjzgqEErGDvNKOUcNe0AIrIQgizvUXUd71faSIyGHCwu42bSLH7m0keI5GRYrIMRyahFzN6NGwmldbFkuOVjWoZLFx_WROod8hUjJe4hKS_VHGisHcw41OonTiCXOWeBfJE_i7QnFHhrqmwPgnegCg1qERx4WExstSUIZtz7cjlYyrld-N_pbp48HWwhOmswL_X51N1Ba1EX5kMarCrubUBJ-U6-wLsjEa07ild0xCXKZLTsqrby-eFRy_XxgZC-LeCuIsmQJrSw4ecru7gi9fNsMjrKtYXuymUE5S9BtEzGH8nYpQv_sfRzFDU3GedMJWKOYTy4QFXh3v7_2t-zUZCubg8siS3YtJ4dCFtlHv6&cid=CAQSOwBygQiDt-NH8THXzpnvcFHfnsOPG0Qs-iJCzZfpIaFyQ98albDrOVxZxJh8QQQqTZqCygtYC5_YohPBGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=6531176856135113000&adk=212707235&idt=59&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame 629F 30 KB
11 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 629F 41 KB
13 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 490371
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48DC 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4493967863916&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48DC 0
20 B 59ms
59ms Ping
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4493967863916&version=m202306200101&ct=76&x=1&cor=13506009272160895000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 48DC 92 KB
37 KB 71ms
71ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVvqG1mgzTPCwt8dayS55aAhaM_Xyfo3Lr3YG0wRLtHFj9uc-9BkakiEnoxUFjwsLQoYY0j26T65nps86TzeUyLG8dkufLHPoQQqhoDN_KtiBlpWI&cry=1&dbm_d=AKAmf-A5fDKpkvTe8Q8Gr2OoZiH5E94AWF-ndzenAsurdmPaFuK9epxZ8N5KvV2EGVtlQsnOStpSo3v6F1wk27rdUn-LIwpN1ALlZ96Ux9quxjHwUfowhu8CuscpFYOKGB4ONdSh6nHxnkOL2g-6FY05lPF_wfHGcL_8XbYZJ9UJOV4JUBDN362SgtZCW7HYeCqTJWsfDuJDyN_mK3204xpEoEYCyxcR1QbZK_DVInummCPH9J70l_2_ANSa2DoujYNJg3eGsQz6DMoCuR14CBzDVo23utJ-zAOZ_vwKWbSLdQMtoiZRPJi_HT4RSS78FtTdlwyXRyKhsEawV3PiVXoOAOZz05vogEsSPqy3NQ5xFctBI7Qbh2Igct8hThtOP-M-YIEWaPiMJAxwy4z5wl3aQV0-lSbSDSG0M2KMoc-EagZgMEDYMNowiaZQJAxopSQqTZDyqcToq0l7sOweOQn33XgX6XtckDqoOufQYlnw01LFRUWobNug-vqvhKwm0cWfeN-tO-sxUsKpnYd1mH4vZbtxYN3cQJKvUlyNpx0_xqlRV_UwLVu1PmegvZDlZPy3LUVKIBkvjoRY_h1vKAkmbjMyK0LcVulLGZrxLVaN1peMM7RjF2pK0_maGFNA-mdmllcyk8n2IVFE5uj5RIvH6ptcov9H0k8I142IB2KY2I9kE3vAan2QO5ACZ1yWsW62h4Ntntb2JC9AqXseg4_Yi3L7ACZWr7FsLloRCITlbDmWyObVCr00VRZ37oeUa2WBsKIn5bAuVfherz9dcD9Jsl0sGnGWolsQn77O2WZ9Mtnvydxxk60VJCzTVzfsajNlZVKF42-DM7BNx4mMhSiupe0tO3lNKjCegBVz2FAl2BhDR_V4yKWIQZ4VngK1CTZji7VQUh6DjmgJgeCobaCUnvl9GEMbFhtUQI7xlBQDA26LQP6a-FCUW2OB3UeEkGOHyJFzCMpKStxhqWf4OodOC2HorvzikweFnUXZOXJzZ0U0KHTB8XwqSpzpeiMQQq7Y3UI5CqtDR6MqE_qsyx3MdOUyMkBel8do-OszbYNLRYHfKOIgXBOYZ8eiqFGhE6Dmzjh1aYNjXBN8Q_rYjv09rMoflBsjfeAKa7VEblef8pCcHmuGpczoOCPabZNmtpMLbymK0O7_lUNTMa-KzEFyMM2ELP6sc_wg6MufSQzGxi97kQwkODEeRUMipVC5CtDrob0SoGGD-mKtg0UOKCxRxuT7B3o7UI1iO622drtsDoPHtFxpJspeyjVDvotYUIYDeeNjgwSXiriz-MpbCI9O5CUMHvtigmcmWfozyQfa-x3upOHX6gHO-786nk0vJl2Eam4lPR7ihEFqT9ZFKbtpjdnVHBnZh3LuW8bDxjcdkd2LuXbC5KrCWU73ZpFb6XRU_-a8qmcyCUtVQ58gUYr6aV6-CFO6qQpQ4XeItOZ_MDYlM4YC5ApI4bN-zcd-w5TPmw36--5cGnb2iGLJa9mUcPdaD2qNuLVo-F9ydTTGzuDGG8CufTwNYPQu9vbQldNfuNrfUBEY5ukbWjJjCSGlamo21KF707n5Alu6ya8fYU5cbdHB_nV7gFrBkj40UdrMNrqsIuPavsfk5vV24hAIk8-W9CHRzMqWk_MBsednfJvWcgX9Bq-Uyp4cIIZiKo7GqogOIKmnp88ZLeKsLp76uR9fwlnRjvn912Pkr-DMdfRUZe7AwK1WZYJ7VXjgMiswDZx9_ONKdCion1qeFdOW-OBYrvQt-9nYgI9QvPDLE3twXtAjMgHtU3yjC40pfSJjpgYU4E8mjYW0Ud4cw-lIfuTotLFfAOXlTrkH961TApZvS-10BHr4MICFP53A3xpRVdPr9iaRP73saJFCMC1sjZZ-zTdW1la93beHHZw9-eWX6HCqC5dnhIHAY48gbnpOwarO9NcVPCQnx0qzdYZRoCP2E7fdqs1gnAuXm0D8z9XCb5Vl7apb5sABiYYNUkVLxPyD3mIMeAuxavUxP7r0jmvNeQ4-JSyiJKd_keoJ0aY5qsBrrfiXFcicfU9VmagZl0mVSPGOvNJLblMZRbxYGVw021ymsWkqfETaHRGhxXgIj9PYnO3qbJnLpaBr7_gtPKIBDBRBJXhx9NxpJwBoaDdvhScLXjgGwIwjsAnWWCP0m4vTE7ZzMY8uhZ3024kMUIu2Ws1xkCSgyeHcZH1QGFQUDd5aE4EPJFARA65LjaHcGSc-6cvhhJSv9NaFjU0mY-h5Zz6fj5XclVnoN2cDzcDC0eGnmKQgX5eaPAPIJj3IejGc03lVUmMpyxN8duOwQRVeIOujtF0Hw5ZdCXFKLE8pFIANmf_aH2joP81GblAE-xqB9kJbxBbWkvIxIJLqFSgOj61MwiQIZvs2l9Bs_64T7doG7Zh3IrIi5Uol7smzFvnjb4RaTdy_k4R8epQ1Ze-qiVXItOfH6ohL6tpFI8ULCeX4lwulP_scrBsoJy63OxICEZtjV3NCYcltsCnkjwPfCoxCUt4tCpvOKO8AanHO-t9HtpUTLfkTa5LvueFIQA1Wmp6VKGAymg8cd0mVhH4nn9Lhbh4MiAXFETig6wcS9ACyF9oU3MwD6dHC5ItYVAamei4DGBFBDbmnVIjziSt1wvPX35pVOOzMfVBCHjTo5U5NIpovrGuZhH4EEUX6zsJuT1aW4KPgrrPVgNCQj-lasPJ80vdOj6G9NECAnniE9Qp73pwmi72PiZ1gt8GHcCt4aFXlvhEdoi9L_MrD8NIm5oPemlto-MdLvxuaGC93Yjf8vKZvfXNqzeVu1agPkLxnyQOh5sXbesJZ1f1j3gPMI7wabh7kQuYc7RIy0wiaraFNO8pnHT9KoJcZ-ZuUVDGQTEUD4Gmx3E2uLzeCrDpWUBiRCI601oLKUIdQgRnuQYV2emqp0or1NO-UoiXDmApFz7YCzD2MNA_uNaveHtWcMdu92XyJdO2Ou19C4zXNhDRMyiezKKNAWV7ResdPOeVEzlv2mp0Om6wfsAzsIq9mEkspkDbCh1TNsL_VuKWkIXke_cQzdz1hy8O7MtLCOWjoi8pEHUXX1OzMr-w1oQVM8e34MfdIgTnawnuo3SqAPpqM8v6oFBWA-fTGAEopfvPoCebdyGTjZIP5UCfwvN-WtZ8ZSIlIB5TUfHUzt5QzLNft0EOVK7eNEH-mSIKNjifm1ljU_eYiZSCOxailNV0R6Vi1F88YXcQorqTyfpafo7MABjRziUOhGT0jt1uKgONvhOI8mLj2yWO2LTI6Q4D6TMt67XBRc6OCXm4lNRf8q4fyABXg68c1ZkOy53v7DMXFHrUj-ITng2qnzQC5_jU5zgsl68Vw2iWg8-DjPeDQewEjv7pKDG-GMlqxdzFm7qfAzVzHvtDBbNCB4c0QRvNHNagjOSqxHDMSbWPtQPd8jJk9ioy-V26pn8wjjAJ3sUREixvcHSeZyxPiW07PIJi8pyvSrOoiv9Y_nwzpubOJHwrKaetyLw5tvmYTjWFOe47v3rO_d2DMw3Au2expJ4_MI2virFIN-Ajbg7VENguNjh7Evb7pL7YluT3_l-lyqJiWNpoBC34xgmX975MQE3vLxBbsv7ydVXrGoWd3GWlEE1RPsAFzisPNzyJRMlzrVcIhTW9H5kwJvnh802946_Ztuy-kA0TlmOt0PS5aAXdUuyN2XvjNe54EZ7rfpHCGR58PBEC7aMfUx9PQ1Npb6tji5VrELVI9RQN771y6TmKT0Zg6LA&cid=CAQSKQBygQiD17CB29X2JQH2g7jr1qPQUrILqROc7n0SgPvutoUlsMqMhmNgGAE&dc_eid=31075530&dv3_ver=m202306200101&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=13506009272160895000&adk=2719198038&idt=88&cac=0&dtd=10

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef79057056a1772b710a81e939167af5ff1d2160411220ac0a8ebffa719ebac7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688426539836&bpp=2&bdt=118&idt=115&shv=r20230627&mjsv=m202306220101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4741162245852&frm=8&ife=1&pv=1&ga_vid=2009876620.1688426540&ga_sid=1688426540&ga_hid=926749968&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=1946496577&scr_x=-12245933&scr_y=-12245933&eid=44759837%2C44759927%2C44759876%2C31075631%2C44788442&oid=2&pvsid=2896560028346402&tmod=1937665132&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.5rccfcav9fcx&fsb=1&dtd=120
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37781
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5777 1 KB
643 B 24ms
23ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23384
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 16:52:36 GMT
etag: 48472445140208031
expires: Tue, 04 Jul 2023 16:52:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame BD0E 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f0a083e23a0124242c65bc2d8f2859938fcd725354845e2221fb1748aa365223

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 tr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame A8CC 3 KB
3 KB 24ms
24ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/tr.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012306200257000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e5a886321d0e00c13f7abff03ca39fd782f42997fd34bcbf4fc93718f3670cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 19:04:08 GMT
x-content-type-options: nosniff
server: cafe
age: 15492
etag: 9957912877679239782
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3057
x-xss-protection: 0
expires: Tue, 04 Jul 2023 19:04:08 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame A8CC 344 B
368 B 24ms
24ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012306200257000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:35:10 GMT
x-content-type-options: nosniff
server: cafe
age: 35230
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Tue, 04 Jul 2023 13:35:10 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame DFB2
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESENu9yUii6sDwpS9aLQL4cLI&google_cver=1&google_push=AaAOQGG8AV4N2IsqnYI957BMsJagDBW5ejDv2CYpNe4Yze8kU708sZDA-eP2UnPG_JHP8gJLSmiZuRwOAXGeVVcKUU0qRRvTgFKK
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzY4Mjk2MDU1MjQ4NzU2OTc2NA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEC9F1MYdx8AefsE85k6cWtk&google_cver=1

43 B
398 B

72ms
28ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEC9F1MYdx8AefsE85k6cWtk&google_cver=1
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEC9F1MYdx8AefsE85k6cWtk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFB2
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEDXW-2JuZpkB_UidULHdRa0&google_push=AaAOQGE_V_gBJwWlUyHzgrnqBYua9T180E-AOTagfsbG-w3zE03LhrjurH...

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEDXW-2JuZpkB_UidULHdRa0&google_push=AaAOQGE_V_gBJwWlUyHzgrnqBYua9T180E-AOTagfsbG-w3zE03LhrjurHywOi-z0pTaCWnkVaf-D9Q69zESjh0winhZ0Ngwj-ahfA

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220023-FRA
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1688426541.569515,VS0,VE88
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEDXW-2JuZpkB_UidULHdRa0&google_push=AaAOQGE_V_gBJwWlUyHzgrnqBYua9T180E-AOTagfsbG-w3zE03LhrjurHywOi-z0pTaCWnkVaf-D9Q69zESjh0winhZ0Ngwj-ahfA
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame DFB2 70 B
265 B 164ms
49ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEESgv9Zv56TjzgCESayQ_TY&google_cver=1&google_push=AaAOQGF7x9tGxQO0Coy5K5iCwKKVG254Pj97Tp_1ylnf0xZ1TF62kPCINs1RjrjHeugc4AxYJbMTxiVCFPzYrIFvE-PRipymzBB-
Requested by: Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFB2
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEJhMZBL7PonRjVsCJr6dokA&google_cver=1&google_push=AaAOQGFvP9J9pDAS-GNyaMuwXb7rjzdy62MaOMN2wMQ5kPcvpdjUyyAL1Fvp1QEldPwl6JXFn760etCuz01...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGFvP9J9pDAS-GNyaMuwXb7rjzdy62MaOMN2wMQ5kPcvpdjUyyAL1Fvp1QEldPwl6JXFn760etCuz01rY831Y0j1YsGFaxQC-g&google_hm=XtO9OExkTW-imgt69W...

170 B
188 B

34ms
33ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGFvP9J9pDAS-GNyaMuwXb7rjzdy62MaOMN2wMQ5kPcvpdjUyyAL1Fvp1QEldPwl6JXFn760etCuz01rY831Y0j1YsGFaxQC-g&google_hm=XtO9OExkTW-imgt69WrKRoU

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:19 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGFvP9J9pDAS-GNyaMuwXb7rjzdy62MaOMN2wMQ5kPcvpdjUyyAL1Fvp1QEldPwl6JXFn760etCuz01rY831Y0j1YsGFaxQC-g&google_hm=XtO9OExkTW-imgt69WrKRoU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFB2
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=--_q9P9NTsiwU1AjgFCSvA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=--_q9P9NTsiwU1AjgFCSvA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AaAOQGGq_cDdwhF8R2haRJgGDORqpOhU3vzK8mzkZRfnJY3U8P6cqhWOWaClR4_4_HPv5T2HrV2Xq1NRdGRzvo9KEzI3fSDIvUjy

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=--_q9P9NTsiwU1AjgFCSvA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AaAOQGGq_cDdwhF8R2haRJgGDORqpOhU3vzK8mzkZRfnJY3U8P6cqhWOWaClR4_4_HPv5T2HrV2Xq1NRdGRzvo9KEzI3fSDIvUjy
date: Mon, 03 Jul 2023 23:22:19 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFB2
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIJHSaxfn39X4IGv4nc048s&google_cver=1&google_push=AaAOQGGtpMdHIJDbp1e7CEBGNOkIWPR2uzY3MQUqpQll78q0C4nhBOVuNzw1nD5TyOupuNBAtm00Qr5sPz-ZFTOd...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AaAOQGGtpMdHIJDbp1e7CEBGNOkIWPR2uzY3MQUqpQll78q0C4nhBOVuNzw1nD5TyOupuNBAtm00Qr5sPz-ZFTOdS5trrddlTOnsVA

170 B
188 B

33ms
32ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AaAOQGGtpMdHIJDbp1e7CEBGNOkIWPR2uzY3MQUqpQll78q0C4nhBOVuNzw1nD5TyOupuNBAtm00Qr5sPz-ZFTOdS5trrddlTOnsVA

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AaAOQGGtpMdHIJDbp1e7CEBGNOkIWPR2uzY3MQUqpQll78q0C4nhBOVuNzw1nD5TyOupuNBAtm00Qr5sPz-ZFTOdS5trrddlTOnsVA
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: 1Moq8Fo1YLsXH02UM9UYqRo2fPKlOhYmygoiDFGMt26hfzbD--xdow==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFB2
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEKjgMMYak...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEKj...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=1c746da5-88ee-4eac-8a85-6a58fa6f46e5&%%GOOGLE_PUSH_PAIR%%

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=1c746da5-88ee-4eac-8a85-6a58fa6f46e5&%%GOOGLE_PUSH_PAIR%%

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=1c746da5-88ee-4eac-8a85-6a58fa6f46e5&%%GOOGLE_PUSH_PAIR%%
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame DFB2 0
59 B 35ms
34ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KNeNcn3OcEX3Rl_QSHZYCbrfmcCe46jzNcWSQhxbE0h6jLfbLEERJ_UBAI67AmOL2V3nT0zg

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 4F5C 172 KB
60 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Origin: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34185
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame 4F5C 11 KB
4 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CpTQWZEECBWngQkxeZCp088yNXtQRHJICAOT_V0kkg3J42geynfFwOWPr4DSzXP07oUepW5dazbliV0ZtkerVEGKVEYe6xHuGpiCYvvFhAfP7csVI&cry=1&dbm_d=AKAmf-Ah11cdAnJZQRYWEFHaVWSOUF8ws9PRa-hVFutmX2dOm2PmdaiT4W6s8sqGVXFmRo7FUr1Yb_dsH9b2f0nz-RMxEwAqwcTvuChD_ezyPYXz1m0Y33C1XgOcF6u5iwMRCYTcvjSIJhCDGf1D3kKSZlgdH9ve7BuyElPqLF3OS8WQwwDMdz_49k19CAANRhWk2B2RzibwEo8YOxvAYpjMdvmKRXuu07tIy2NKhtD2lvEpMBu2DTwGtt88Nypjr9OdEqScLCNDQFb-OsY0hUh97o1RXOcNJXpkvYjZKsuv09B9M-cG-K8OqMY8gf7PiEMfGmX0nwgV4ZFGPVUizPDsM3kHbYKOgymyNEWko8rQSak2yrsTV-4axn0zyWGebNJkNM4sIY3l_nonYU2abxN6KnxZg8l63H-QBNM2WCyWn_zeVmgIEJ46tUD4xBmyUbpzwtZQaHAyf41_02gZ8K6hlfWxb-zGMuAUN0o3M2kU4nKgRogSH-eNhofZlylNawuCvfhD266AHzquUjEaoBG7qSXa2S41hZKqQsuHC_0LjadKXj_veZKFkGfkUWkS79qZQmUjAiq44Pg0qcQ3kFWvKJ3DBjQsEVP8dGHmaZxfxDX9D8AOfYbqa8hxVwN6LhpvSn_CZmc_eSqaKl_C--szfcff40A1YIT5H5VsszfIVTSn8QaZYS_4jMx73cLZUdHaYF4mzke5kLQP05hXSF62H-RMuu0J05UJnLrg4Grji2JXZcKaP_d-kwnvtYDnUFAcrJ4jtzFZCIYovfYzYUf2gjE3UV-jYK3OvUPHRxL_C24qI9u2PUNCY6ophuMhi-8uLFfjuYusH-wyFJaKcgfGtyB8GhXhZWvROE1nLmzbloGT1fkTYpVJy8Xdl8rVNMIXnj0sWWa-ALzwETalY6TH9p2IXxGKpxMEx9ua6ykoXRSdr97l95YNhM1qucUJyHHOwr5DhVkfwwBK1I7xvdSeZeVY157AnXMcBJ51po7xikT06ak_hlTKujjgZ7xdF3DkMIWPNHBeKUsUdy--bKO0MgiHJ69b6uoYRdoBjhzO1FsR08AGbPfpu0hlzvbD0VEsJ_wvy8pD4U8KvWrYQqkREh9jcYZxPSd5BmnhvzkueL0x_KoW8ora0IayuVhGGVYB-AtdEmgvsQZe5icThTU9f0u207c8MVhOI4lzvz-_-xRBnn5nE2RVe_neyFm09hzOIhKwgbchm9sX_ooatT3J0gXdsNWFkLzN79n-4NHzsmIAjuoTttl4gZL2BiYPzorX7Vao5OCLrlKjFCweAXAsYPXvTgBlTWEIvbZ3IaYmdpBDfVvUoXD0_PvItyUpmkKd6ErZgC5io4I3aDf44NEWbcKqFLACTc8dQKkjoEMHt0moCYYMNUj1LZFscXjiTqToOrZH96MbgoZQlFkkkSjHQGQFiSsTsOO97EVUxpteRvTV2RKE67SLjI2khvfMGoVXjWkwIPXR14OsIkow5CA1CzwyCB0Hhw6CrYazvLMJR-0RS2ruk92j0eZ4903YRh07nu9RRfYiaBJ8sYd-W89XJR1j4A8ePzZ4ErdktRYP9OgpwjnAFhDNB22cFoLWKhIgBDYZAgXVfbP-2JjRIT4lF2s2FOpG9ghglGNngVvCghnAdlyb_uaNC8WQlH3lPXZLgcm5QkwzuD5T1g-HxYTWrnGTZ384Y3HkDkfJ4HC0NQUkUhRh7yUZdKP4sYiMDiykxdScIARSUNTuysGbDdEqA9CybtcqV9pwX8z_fMRglvrAe6RtKPUA9VlkguVajPO32rNkFQYLf8MPjfpwJVJmBgdY30UvzYyAYC7fCiE9Po2qTCCX5Jjgh0SVJuiiOxeW8zOLzdvHGmU-sHysQyzLWwZVVvQGDataII4_2UiJYTawOvfwEYZDtrC1hZ_UAazARWuzPamztA33xWK90jt7Cwhd5PV3wBVf5D1eesCxgXnVdKJChcdoPxB8hCkIhrcSEEa2tr-L3JdI_4ToTBE5HB7qA76St5XkTwvYT-mc9Kox5MQ3e1zvBjlX2vo-nfYG2dLZpvaYUNcxxQ4TFuu5ud3pfrD-pAIpgPVXftNrGGpv5GzhH6Ahpb0E36vtiNjKzOxSt4raj03Hc0v4ubV70Z9ihdIO1kJ-IlxzpUmKxYob1HZfKfD3WSWBonxbhR4PGenE41UTagUskYRJBjZ48I1Sr9zYfSXPoe9ehkBDOKr4xcw81VUXC-wRDDHO-nUGUnQw-YK-BhaCDNwcb-FJYiTPkw3o37vi_LvpsvgBUeBqjZoFaGHQFqSPRYRreNTE__IKoRN0JyxCFWeVUWP6UF9VfrbUoJ_lLvTAgssqLxGeNgpfwmE80dOkedOu6trk6CIudHN_s9f65l70OEZbxKTaTjfiF5ak1LJAfly-y_Ovl-M8uWeHUdkFcwgdBNNWmLAz4RNagrZl82t4EF77pGAJjfLZWNfWz4C9cV3Spq39PipBAlZ6NAlK2fKZssi77fKAfhdsoV9IlBTOO5QivfWKApQ9PxnTg1SCJTWjEsLd7EPmmUurj4npkSZQsUjiI12HzjdrmA9uI-fC8LikTkuGLUPKM29i11XvtBz6wtQuhOYCmgSreCqoDW1P_A96FBstMQCsDytEK87uCLhFmNaPTWi_O1G0Iu3DhD8GfViPGUZ9y8CqSSmqyuZTh78ETM4Wa9OTQ0JzIshBEaHohCww6_FbYUcbSeS3Kbq4ytwfwePZ1qiWqcbWb89E6siYDSSZDSKA1SfbY4p4b7zwC4gW628HRWpEcLIYsdCluqHPZcssz-HIyWo1A2K1lm5ze71ePR5RZcBM06s9eaRnAuHiXiiKkjzo7SM-sy7-Sy3uprH0juRHUoJhNhZpHYTxD-sb5gVigJcmWtfinAk_-UM0f3buDHksh3SUOVkJj3Crx2mqKcw0hqtFhLfZViRDRKqBJdVHDwS6B5d4gIA8Fa5Hy28Dgubm1LaViDc7Y3WYTaQg7RUfEDPXWLruNIeeS6a-6o_iU2GME7j7-aeITX0bi08VoF59O5j2PhVPvwL1lSGjJ3MZ9Kq-IfbB1WSJzJ1Ogj60Z_aAj4ignMrKOYE6c4f1k98pvoUpKWrjN6_y6HYbmc8RSCrH_dSv4xTlZ4S_w3sEM4qjm4lrdH9aNbOeC0n-X2w4f2fcTJ77zDnh5CYHHtg-_YsqYBPbN3vzHDWBN2UFlzV3duQW4jwLrpKPqYUGkygGIanalNbyM9ovHzb23OyR65W8wt0Dav33JqMweGNeQskUHL4dCKlbiYnkyqHfLVEG3C3Sm-lOz-qDJim9Jyg2PK5QdzBLJMaVNChp99Z3I1gSo6GkdUXZXl2nojsxqP5hq7NXynxLLXWfmG1-sSlWqZYdzdwjawlFHj6ikCfpWKaR-acILOtci-5rSPJOgznCHLxCz_cgSt3xWL9RpS8idtqm4Rh1RGknMpvkAvLDq1HY8j_Id0LINK1fKEBQkvvSkCZX5q0gbA4LPLuzhw87xDfEasSEL9BLX884XT3booZyavnwCFVUW4JDkQArEqJapYsAd3jOBMi2C5h8NWIdwMU_c0HJ9CJYDAg00FMq8WF1rsS5m-L2uscocQzc__nBiDwkI5bBV_imZU5HVykzeyTbGZtSWlwS69X5cTLwIGGE6Zp2AoZ0cD3zJJvDg-0O2c63LmNf31vqBBTliuarm_JqEgidZfbKV48I8rG5HS4V6_VoiewUqVCXGSHJBrHOS5GAQ94mc_m_bK2YvOU&cid=CAQSOwBygQiDMzoSU9lK63anHlxMgylrB_z-PAkXqNXkWahw-H1Ni6lpYvnizRvJ60Po-XMyayKa86JaqQi9GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=10751858688525875000&adk=3587751834&idt=48&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame 4F5C 30 KB
11 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4F5C 41 KB
13 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 490371
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E087 1 KB
643 B 23ms
23ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23384
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 16:52:36 GMT
etag: 48472445140208031
expires: Tue, 04 Jul 2023 16:52:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4E3E 205 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e5520ba075994b3e2332e7fa5c711892423b375175cf94a314d7572fef0d1fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame AACF 1 KB
643 B 25ms
23ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23384
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 16:52:36 GMT
etag: 48472445140208031
expires: Tue, 04 Jul 2023 16:52:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 629F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: afc10e1ac098f95e336e080366c3ab7391534d94a0d33e44574cdf8e14324b43

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C8EE 1 KB
643 B 25ms
25ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23384
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 16:52:36 GMT
etag: 48472445140208031
expires: Tue, 04 Jul 2023 16:52:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4F5C 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04919d53426e5299acd085555cdb0c6ed43c4c4dc050bf23181f09509d4cc2f4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 48DC 172 KB
60 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34185
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame 48DC 11 KB
4 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVvqG1mgzTPCwt8dayS55aAhaM_Xyfo3Lr3YG0wRLtHFj9uc-9BkakiEnoxUFjwsLQoYY0j26T65nps86TzeUyLG8dkufLHPoQQqhoDN_KtiBlpWI&cry=1&dbm_d=AKAmf-A5fDKpkvTe8Q8Gr2OoZiH5E94AWF-ndzenAsurdmPaFuK9epxZ8N5KvV2EGVtlQsnOStpSo3v6F1wk27rdUn-LIwpN1ALlZ96Ux9quxjHwUfowhu8CuscpFYOKGB4ONdSh6nHxnkOL2g-6FY05lPF_wfHGcL_8XbYZJ9UJOV4JUBDN362SgtZCW7HYeCqTJWsfDuJDyN_mK3204xpEoEYCyxcR1QbZK_DVInummCPH9J70l_2_ANSa2DoujYNJg3eGsQz6DMoCuR14CBzDVo23utJ-zAOZ_vwKWbSLdQMtoiZRPJi_HT4RSS78FtTdlwyXRyKhsEawV3PiVXoOAOZz05vogEsSPqy3NQ5xFctBI7Qbh2Igct8hThtOP-M-YIEWaPiMJAxwy4z5wl3aQV0-lSbSDSG0M2KMoc-EagZgMEDYMNowiaZQJAxopSQqTZDyqcToq0l7sOweOQn33XgX6XtckDqoOufQYlnw01LFRUWobNug-vqvhKwm0cWfeN-tO-sxUsKpnYd1mH4vZbtxYN3cQJKvUlyNpx0_xqlRV_UwLVu1PmegvZDlZPy3LUVKIBkvjoRY_h1vKAkmbjMyK0LcVulLGZrxLVaN1peMM7RjF2pK0_maGFNA-mdmllcyk8n2IVFE5uj5RIvH6ptcov9H0k8I142IB2KY2I9kE3vAan2QO5ACZ1yWsW62h4Ntntb2JC9AqXseg4_Yi3L7ACZWr7FsLloRCITlbDmWyObVCr00VRZ37oeUa2WBsKIn5bAuVfherz9dcD9Jsl0sGnGWolsQn77O2WZ9Mtnvydxxk60VJCzTVzfsajNlZVKF42-DM7BNx4mMhSiupe0tO3lNKjCegBVz2FAl2BhDR_V4yKWIQZ4VngK1CTZji7VQUh6DjmgJgeCobaCUnvl9GEMbFhtUQI7xlBQDA26LQP6a-FCUW2OB3UeEkGOHyJFzCMpKStxhqWf4OodOC2HorvzikweFnUXZOXJzZ0U0KHTB8XwqSpzpeiMQQq7Y3UI5CqtDR6MqE_qsyx3MdOUyMkBel8do-OszbYNLRYHfKOIgXBOYZ8eiqFGhE6Dmzjh1aYNjXBN8Q_rYjv09rMoflBsjfeAKa7VEblef8pCcHmuGpczoOCPabZNmtpMLbymK0O7_lUNTMa-KzEFyMM2ELP6sc_wg6MufSQzGxi97kQwkODEeRUMipVC5CtDrob0SoGGD-mKtg0UOKCxRxuT7B3o7UI1iO622drtsDoPHtFxpJspeyjVDvotYUIYDeeNjgwSXiriz-MpbCI9O5CUMHvtigmcmWfozyQfa-x3upOHX6gHO-786nk0vJl2Eam4lPR7ihEFqT9ZFKbtpjdnVHBnZh3LuW8bDxjcdkd2LuXbC5KrCWU73ZpFb6XRU_-a8qmcyCUtVQ58gUYr6aV6-CFO6qQpQ4XeItOZ_MDYlM4YC5ApI4bN-zcd-w5TPmw36--5cGnb2iGLJa9mUcPdaD2qNuLVo-F9ydTTGzuDGG8CufTwNYPQu9vbQldNfuNrfUBEY5ukbWjJjCSGlamo21KF707n5Alu6ya8fYU5cbdHB_nV7gFrBkj40UdrMNrqsIuPavsfk5vV24hAIk8-W9CHRzMqWk_MBsednfJvWcgX9Bq-Uyp4cIIZiKo7GqogOIKmnp88ZLeKsLp76uR9fwlnRjvn912Pkr-DMdfRUZe7AwK1WZYJ7VXjgMiswDZx9_ONKdCion1qeFdOW-OBYrvQt-9nYgI9QvPDLE3twXtAjMgHtU3yjC40pfSJjpgYU4E8mjYW0Ud4cw-lIfuTotLFfAOXlTrkH961TApZvS-10BHr4MICFP53A3xpRVdPr9iaRP73saJFCMC1sjZZ-zTdW1la93beHHZw9-eWX6HCqC5dnhIHAY48gbnpOwarO9NcVPCQnx0qzdYZRoCP2E7fdqs1gnAuXm0D8z9XCb5Vl7apb5sABiYYNUkVLxPyD3mIMeAuxavUxP7r0jmvNeQ4-JSyiJKd_keoJ0aY5qsBrrfiXFcicfU9VmagZl0mVSPGOvNJLblMZRbxYGVw021ymsWkqfETaHRGhxXgIj9PYnO3qbJnLpaBr7_gtPKIBDBRBJXhx9NxpJwBoaDdvhScLXjgGwIwjsAnWWCP0m4vTE7ZzMY8uhZ3024kMUIu2Ws1xkCSgyeHcZH1QGFQUDd5aE4EPJFARA65LjaHcGSc-6cvhhJSv9NaFjU0mY-h5Zz6fj5XclVnoN2cDzcDC0eGnmKQgX5eaPAPIJj3IejGc03lVUmMpyxN8duOwQRVeIOujtF0Hw5ZdCXFKLE8pFIANmf_aH2joP81GblAE-xqB9kJbxBbWkvIxIJLqFSgOj61MwiQIZvs2l9Bs_64T7doG7Zh3IrIi5Uol7smzFvnjb4RaTdy_k4R8epQ1Ze-qiVXItOfH6ohL6tpFI8ULCeX4lwulP_scrBsoJy63OxICEZtjV3NCYcltsCnkjwPfCoxCUt4tCpvOKO8AanHO-t9HtpUTLfkTa5LvueFIQA1Wmp6VKGAymg8cd0mVhH4nn9Lhbh4MiAXFETig6wcS9ACyF9oU3MwD6dHC5ItYVAamei4DGBFBDbmnVIjziSt1wvPX35pVOOzMfVBCHjTo5U5NIpovrGuZhH4EEUX6zsJuT1aW4KPgrrPVgNCQj-lasPJ80vdOj6G9NECAnniE9Qp73pwmi72PiZ1gt8GHcCt4aFXlvhEdoi9L_MrD8NIm5oPemlto-MdLvxuaGC93Yjf8vKZvfXNqzeVu1agPkLxnyQOh5sXbesJZ1f1j3gPMI7wabh7kQuYc7RIy0wiaraFNO8pnHT9KoJcZ-ZuUVDGQTEUD4Gmx3E2uLzeCrDpWUBiRCI601oLKUIdQgRnuQYV2emqp0or1NO-UoiXDmApFz7YCzD2MNA_uNaveHtWcMdu92XyJdO2Ou19C4zXNhDRMyiezKKNAWV7ResdPOeVEzlv2mp0Om6wfsAzsIq9mEkspkDbCh1TNsL_VuKWkIXke_cQzdz1hy8O7MtLCOWjoi8pEHUXX1OzMr-w1oQVM8e34MfdIgTnawnuo3SqAPpqM8v6oFBWA-fTGAEopfvPoCebdyGTjZIP5UCfwvN-WtZ8ZSIlIB5TUfHUzt5QzLNft0EOVK7eNEH-mSIKNjifm1ljU_eYiZSCOxailNV0R6Vi1F88YXcQorqTyfpafo7MABjRziUOhGT0jt1uKgONvhOI8mLj2yWO2LTI6Q4D6TMt67XBRc6OCXm4lNRf8q4fyABXg68c1ZkOy53v7DMXFHrUj-ITng2qnzQC5_jU5zgsl68Vw2iWg8-DjPeDQewEjv7pKDG-GMlqxdzFm7qfAzVzHvtDBbNCB4c0QRvNHNagjOSqxHDMSbWPtQPd8jJk9ioy-V26pn8wjjAJ3sUREixvcHSeZyxPiW07PIJi8pyvSrOoiv9Y_nwzpubOJHwrKaetyLw5tvmYTjWFOe47v3rO_d2DMw3Au2expJ4_MI2virFIN-Ajbg7VENguNjh7Evb7pL7YluT3_l-lyqJiWNpoBC34xgmX975MQE3vLxBbsv7ydVXrGoWd3GWlEE1RPsAFzisPNzyJRMlzrVcIhTW9H5kwJvnh802946_Ztuy-kA0TlmOt0PS5aAXdUuyN2XvjNe54EZ7rfpHCGR58PBEC7aMfUx9PQ1Npb6tji5VrELVI9RQN771y6TmKT0Zg6LA&cid=CAQSKQBygQiD17CB29X2JQH2g7jr1qPQUrILqROc7n0SgPvutoUlsMqMhmNgGAE&dc_eid=31075530&dv3_ver=m202306200101&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=13506009272160895000&adk=2719198038&idt=88&cac=0&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame 48DC 30 KB
11 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19542
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 48DC 41 KB
13 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 490371
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 5777
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEJ0iiHSqS880bX8-CTG7ct8&google_cver=1&google_push=AaAOQGGipo4Zkh_T8XaK7KXdh8kJfNJjjwx_vJToIRJKwVEuirVJbJt5pkX4ANkOfLBVaWFCr7O3PyGkWtAnOWUbj2XNBYOu0pK3
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzYxMDkwMjk1ODQ0OTY0MTgyOA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEC9F1MYdx8AefsE85k6cWtk&google_cver=1

43 B
398 B

69ms
28ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEC9F1MYdx8AefsE85k6cWtk&google_cver=1
Requested by: Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEC9F1MYdx8AefsE85k6cWtk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5777
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEBkCBhct1CVrcm4IqvqaIp4&google_cver=1&google_push=AaAOQGG8T2QfCD04OCLQ4cpgARsZwP43bJppqwckJFdmTGdyWnJkMQj0r5xUFn5P5PfibGj2IByUu9pKBCjpclYK...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGG8T2QfCD04OCLQ4cpgARsZwP43bJppqwckJFdmTGdyWnJkMQj0r5xUFn5P5PfibGj2IByUu9pKBCjpclYKFp7J8R-Q5jdb

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGG8T2QfCD04OCLQ4cpgARsZwP43bJppqwckJFdmTGdyWnJkMQj0r5xUFn5P5PfibGj2IByUu9pKBCjpclYKFp7J8R-Q5jdb

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: MT3 1031 59fd23a master cdg cdg-pixel-x16 config_version:"1438"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGG8T2QfCD04OCLQ4cpgARsZwP43bJppqwckJFdmTGdyWnJkMQj0r5xUFn5P5PfibGj2IByUu9pKBCjpclYKFp7J8R-Q5jdb
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 03 Jul 2023 23:22:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5777
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAgaMCCNYre0XPGBj36dGkU&google_push=AaAOQGHfRsTxGqMh10UjLpDtOB-XeNmFXlUgfsH6d1jxASBjO08x_gnM6h...

170 B
188 B

33ms
32ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAgaMCCNYre0XPGBj36dGkU&google_push=AaAOQGHfRsTxGqMh10UjLpDtOB-XeNmFXlUgfsH6d1jxASBjO08x_gnM6hwaNxRVM0fS7cfjPlq4Jusd0r4zJGXw9w3-x0_GsNGV

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220023-FRA
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1688426541.676212,VS0,VE94
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAgaMCCNYre0XPGBj36dGkU&google_push=AaAOQGHfRsTxGqMh10UjLpDtOB-XeNmFXlUgfsH6d1jxASBjO08x_gnM6hwaNxRVM0fS7cfjPlq4Jusd0r4zJGXw9w3-x0_GsNGV
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 5777 70 B
264 B 50ms
49ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEPYWAPCRLKI-OXOsT06QtNg&google_cver=1&google_push=AaAOQGHcnLXIO61_htBi2x_eWLudV7AnqsrMQ2nh61e2Y_ADDVUi2F8rt9wQga5ZaMZNKkIJQtdSQWMiOSSRxp9mDxqjoTMzKZo
Requested by: Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5777
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESENIO_rqlBi5gcdALsIb7_wk&google_cver=1&google_push=AaAOQGEa0Cqmksa7RZhFKEzTCI8wIE1Hi8lb7xH0fKYlzv5qdM86tc8D3GXHJHshSbJYEjyFlYVpjM9r3TN773vb...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=5KVAgs5XQ62wcyq0qHRZQw2&google_push=AaAOQGEa0Cqmksa7RZhFKEzTCI8wIE1Hi8lb7xH0fKYlzv5qdM86tc8D3GXHJHshSbJYEjyFlYVpjM9r3TN773vbogc7p65A_uCU

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=5KVAgs5XQ62wcyq0qHRZQw2&google_push=AaAOQGEa0Cqmksa7RZhFKEzTCI8wIE1Hi8lb7xH0fKYlzv5qdM86tc8D3GXHJHshSbJYEjyFlYVpjM9r3TN773vbogc7p65A_uCU

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=5KVAgs5XQ62wcyq0qHRZQw2&google_push=AaAOQGEa0Cqmksa7RZhFKEzTCI8wIE1Hi8lb7xH0fKYlzv5qdM86tc8D3GXHJHshSbJYEjyFlYVpjM9r3TN773vbogc7p65A_uCU
x-host: tde-deliveryengine-production-7c97bc8457-bn8lx
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5777
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENAb4CE_Zl6HV5ecRDTZmRc&google_cver=1&google_push=AaAOQGFMCEVM74I-uwEj7sl398hYnKFY-u8WyuGArilOD_Eqqju_E6GtbGgX4oNHmVgeC2NihCmRGbKN...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESENAb4CE_Zl6HV5ecRDTZmRc&google_cver=1&google_push=AaAOQGFMCEVM74I-uwEj7sl398hYnKFY-u8WyuGArilOD_Eqqju_E6GtbGgX4oNHmVgeC2NihCm...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTQ3MTk3MDk3NjI3MDc4MDc0NA&google_push=AaAOQGFMCEVM74I-uwEj7sl398hYnKFY-u8WyuGArilOD_Eqqju_E6GtbGgX4oNHmVgeC2NihCmRGb...

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTQ3MTk3MDk3NjI3MDc4MDc0NA&google_push=AaAOQGFMCEVM74I-uwEj7sl398hYnKFY-u8WyuGArilOD_Eqqju_E6GtbGgX4oNHmVgeC2NihCmRGbKNmkT5T8WHkJqjVU4OJsGb

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTQ3MTk3MDk3NjI3MDc4MDc0NA&google_push=AaAOQGFMCEVM74I-uwEj7sl398hYnKFY-u8WyuGArilOD_Eqqju_E6GtbGgX4oNHmVgeC2NihCmRGbKNmkT5T8WHkJqjVU4OJsGb
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58281/ Frame 5777 0
15 B 28ms
27ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJMmWTRQC2-9F6kgpmsZPcM&google_cver=1&google_push=AaAOQGHwN2sDmf6oMwq1P6ucSxm2L1pvIq-IDDS8mXT1IC2zn3WHPVgCDGWxGNdEFGLkiiNsxr9Fl1dUGqHZvrKH-EIr9FmsHjtZ0w

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.57 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5777 0
12 B 31ms
30ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LpiD8XyaObWRMI_wYyUyM2a8Qoc3geeM9kjtVv0AyyWJhJxE3LTOb8GbTiyjtPDmJ9_Yv-2Q

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/ Frame 6BA3 12 KB
4 KB 67ms
21ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

879254ae9fd0631033574177bb532d71a1c3fe654135fbf1ccafd7740884f451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 303973
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3998
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 10:56:07 GMT
expires: Sat, 29 Jun 2024 10:56:07 GMT
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 629F 0
0 138ms
73ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstq7kgbEyz6cLqHDDC3yE-prwRzUbxbV0njeZk_a4z5TlZwsmXoTv8jPaX_jN6ebAoEhPv2_aXPCQVuSxklgKefdUhN_allcRaoPhz7LSkiIxAf5zGv6gysG7xyTsUTCU3af7uyIwRb8t3EmUyKlKI_16uY4VAsU4ol1l9UITqBx0PELJaGTcls310j3SC9igTsu1N3BDe7FOfR7xuWhKUR7yKysrzEe-NAKrEfq86DKA3CCNmEEgiG-MEcuj2Ub7pRJfTR0eI6vlrdc4Fe3kV4BBI5BfHk9mf_jGA_6giLqUyXpOI0pvPj6DtgRoMR5sf86O5FtAXbqZqJQ5T4ZjlZQqz0Pi282QTx6e3d3WgI5c6JfnIfqfilm8daLfaUxggYwJ3NkiOT_DX1RECw36Fy7C-wfuczZcYMjGOoMAGMwds5d_dmE2nTptjODpQ2BsCg_nEF5SGyfKjBU8pke_XNbo8tG-MrGS5PkiMTKJF5JzwBnT_7y0gYVAkNmK6579LSeQUH-PhZuZ29EVkuqDonMeW2q8tAWWLkIFnQVHIKWl4idB_am_S57d8InIcNi9oqpKN_IeuyYl9s69S3K587KkTTEI2R4Cy4Vqgimn_f_X-eHSMYOXQ588oVUVcm2FGlSx8Q9A1TXwBwEPDaPFKpaouf15YJl6yhz2KzrFSIEVK8mDSvwcGDI1gEo29GzBOBob5TS5xd0LQ1xcGkjKQVsdlC-VV-6ht7L3IVFDEjXN-ACCMxIyeJMxV8HaCx1dXq3_zajhNKkdndJEHTsFsxXyO3iXw_7fyHpruTIwG6HAfx5W3uBWV6zxMEDD3KXEPZfcFPQMd5JXAFLBraUYeqkC5ngtZS9iKWBLgJVekpVl-3in8Ldm45EBr77EQ286xPvBRuqK68LxCNfWMQfuc-w9Joxtc9VqwKhZzJCaVNgkkcDVq0LPZdNaYy8nUPx5oOLNwweSNEXnq2KmAwlxJ0vOlT2waWcG3HwPfnXpTKbWtyi_CgYI5UJFpRNILR8n4f5Qd5qLWjP3FtoXXBsO68axYkgVtbv6HN9682deyKM1S_x3mF689DZdmetrVvNnzDdJKfaFLAVDihaZfakYlz0xBEHG9VpTTg8rBc4wZDddq9cPff1WT3j1JWk2D1nff6R9Agw8DnYhsYHCT0IvAu4BW7oiL8BmuxEyJdbBlZiQg1lz-DZBl9cJhZtgsR51r1mOzSYkb_r3O2b9JUf-jqEyxuGemQpwGJRVQpyVSGCszGUo-qz80QabzkNwp0CyFrLyU5PKvw0SKUcfJZF2Z2eSX7KubrRA&sai=AMfl-YT055JMW3-Zwm3efuMvGwUc4rtK8UTxu32Ql1PTc2YrWxUJwvoSFRpaK557tqeN0KDRRprPhHxpfge6KfkhZwlnDfK6GchKrOR4Mm92dJZULq-wN9vSm7_iZxnyi1UY2pKLIZC08OLCmRCC2FWMNIokzZbuEoDthpaDPc29l0j_aZ10fk3SBfY1FT7_CR4nMiGSRh33mfWM49XnKcnuebYVBstIdLbVx59tq36TmEGHdpFZE0iweMSj8RXgxLNzDaHG&sig=Cg0ArKJSzJKtXjcgPDQ8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=242&cbvp=1&cstd=240&cisv=r20230627.05389&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12943809228921786815/ Frame 87E2 1 KB
767 B 63ms
29ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68b34a28617137221b76b93546359bf577aea1d6b3aadbd65b40e8bbdae7dd0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 739
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 23:22:20 GMT
expires: Tue, 02 Jul 2024 23:22:20 GMT
last-modified: Thu, 27 Apr 2023 13:46:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BD0E 0
0 120ms
73ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuW3h1y6KBjf6MVE-ZWKxX2Oqu_OTYPUyJYvBjNtCnuM3KkS7XNQTddJ5AS5cEUO7WIGNhnQXUBIOskSTdzd-u35Kxxcfv4-ITyWPv1xDhP17Rkrg-PV6_quWvCbS-QeuqulVpT9LeywuryE6Fe_o0TVKMSCOpV-Su8zF3nccVjktmE6_a2WfVlqF-jZ9yW1kvghiYYM4uVJNHnhj-pq-oJa2uzy1uv2MRjV43SmcEbWHx7tEi6xpUA1a8U-l-GiGArhPIisyFLdiIOzLrLXEmPLmW0CA4wSzwMPCkNeLKTMow6R7pwuL_fc9Co8jCgPss9dlYi_oxtpDRpvR6w7g0SaLffiqf0ANOen6EF8pkMzlBQ0L6IR_sfW0w43KL0a914VAuDsuEB1JPFJrbeJ_BMEQB5FwDhDgbzGlBY9P9v64v3ObT60Cpn1WS-UoMLBh9v4GH5t--ObKXfIQ7sQToHn4B67BpTA0tyL0JMH6kBPEFG_mfQW4DPtO2g2cyM7Y8W90PVaeUXs0KOaHa61LsEVrJh1aMgVblmLFQBpJtSJl4Fnc7PNYYxItXb3_uu6EdCB0cNsYm3fquo_Dq9HbRM_Zquxot9NDF--rWgqCRlMkFYgfflSF26idYSzOdZjgS9tAXj7ox8H_llv3Ug0sMERICDnjk5oarThXy5JCdWG14fWPnnm6M_MU-VU0PGsghPNgzNrmTnY7vMjyOmxIIqEyb0nESGHCa5wji9pSEhUZJDyV1WdrMcQWrQhssimA7IEjpjwXyJgftys2M7gWhE4ov_BF7ECIFiaXJojJWmGvZw2Zm1jo3ozR1VhjAoYbOBJ9j8xeeVw2uvZJmshtLozFNEojlmSjBLazEEtOUCDSO-1oHMzekOcjUzM-v38Lti5AuvXSxqyBtgz5SLAECq59rEDt3vnwgrrwQf1rQDot4jxmoJcvMeoSGQgMyqoxzqo9GrWKDziaveEi14DKv2sjUaO17_WGAbSdlZyjvwiW6TQ3Gm75W98DmngXnjdabGo4dTbR0lo1jq4CSMse9O4Rfx44o5usePA3R_BmKJMDIPpeczB66_78xh97-Nk-tQchxq3_R9Oq94XK-ku-ZOm_2Gg7oztY6K_ZU_wFtGRgDLNR4lMQPg65N_wTOFsdPBMxPvzTzSj78ObZBBM5Bi5f3gckE9M_Rtg2mhsQEy1T41clA9jEIYXmRPtsIksGvO2u2qeoPdPX2QeZ3UXWvn84mUJSOQtxTtPBfLwasp2Ydx3ljnm9Zb6NLdnBe5Kh_1cw8zucUcsQPk2hH24XjuVpFVD-vwnCkITCV164H9NxFL2YX_ZOB0IQtnMWen6g&sai=AMfl-YSSALDRpa-AgRaawLzED2rS0GWiCu8vqA9W8GTEqjcYNr_CHhxv5rFW58O_dfQwkgk4iYqbk1SXbGWNdKb8lMU8nF0l9pNGeMiZ7XDmh7i2unI71le3419FRceU1SJcWb6MqwUHtzJpqTPo9IPuUAIoWaca2NzkuzSyVSFv2_3J5nR13ltNnzimVctjzXsXgpNgiM8iK-3amfmCr2Uscpo2BSG0nMO6VZhbCOsIoa6TPpbZIpwIgEuGSuMiaCmIJv6w&sig=Cg0ArKJSzKk2S6GSAzW9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=295&cbvp=1&cstd=287&cisv=r20230627.35103&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame BD0E 43 B
1 KB 157ms
32ms Image
image/gif 213.202.235.8
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=63&extPu=lh-mindshare&extProvApi=lh_de&extLi=26915561&extCr=180662177&extPm=361577769&gdpr_consent=&gdpr=

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.8 Grenzach-Wyhlen, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Mon, 03 Jul 2023 23:22:20 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mo, 03 Jul 2023 11:22:20 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1119
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E087
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEGU-geYIOyLd9oPnxUoKKlY&google_cver=1&google_push=AaAOQGGFWvHGKBiAzjcE5b_xDMpmhCF2PX9BrA2ZbTZMJ0MAYG1H7EC-8pYsHmxobOuQevz1p3iGvwpmAyDLnnWG...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGGFWvHGKBiAzjcE5b_xDMpmhCF2PX9BrA2ZbTZMJ0MAYG1H7EC-8pYsHmxobOuQevz1p3iGvwpmAyDLnnWGS40LpZafRIS0

170 B
188 B

30ms
29ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGGFWvHGKBiAzjcE5b_xDMpmhCF2PX9BrA2ZbTZMJ0MAYG1H7EC-8pYsHmxobOuQevz1p3iGvwpmAyDLnnWGS40LpZafRIS0

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: MT3 1031 59fd23a master cdg cdg-pixel-x34 config_version:"1438"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGGFWvHGKBiAzjcE5b_xDMpmhCF2PX9BrA2ZbTZMJ0MAYG1H7EC-8pYsHmxobOuQevz1p3iGvwpmAyDLnnWGS40LpZafRIS0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 03 Jul 2023 23:22:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E087
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAYSf9gWcsJPVs-eTQZ7hSo&google_cver=1&google_push=AaAOQGGe9HZ8788fr5uRyt2imjy0yG6wf9HxAU2fPLHwoXfAsnhw9tEjaBO5D_zFiyHM3EAjZW1...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpOSEtHUzUtMVQtOUU3TQ==&google_push=AaAOQGGe9HZ8788fr5uRyt2imjy0yG6wf9HxAU2fPLHwoXfAsnhw9tEjaBO5D_zFiyHM3EAjZW1yBAxseBgAc6siQq4iRrrTdmU8

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpOSEtHUzUtMVQtOUU3TQ==&google_push=AaAOQGGe9HZ8788fr5uRyt2imjy0yG6wf9HxAU2fPLHwoXfAsnhw9tEjaBO5D_zFiyHM3EAjZW1yBAxseBgAc6siQq4iRrrTdmU8

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpOSEtHUzUtMVQtOUU3TQ==&google_push=AaAOQGGe9HZ8788fr5uRyt2imjy0yG6wf9HxAU2fPLHwoXfAsnhw9tEjaBO5D_zFiyHM3EAjZW1yBAxseBgAc6siQq4iRrrTdmU8
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e06182bf224d96e6550f4595601cdb0b
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E087
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEPVr3JmkJySalrleo8JeWzU&google_cver=1&google_push=AaAOQGGTDHjwJQba3fdRr55l9EqhioVUT5LFVWF5zHcY3VEadTxhUkf1XbRw5UPaq_QNhZX0Cwvx21JIDHhIQMyh...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AaAOQGGTDHjwJQba3fdRr55l9EqhioVUT5LFVWF5zHcY3VEadTxhUkf1XbRw5UPaq_QNhZX0Cwvx21JIDHhIQMyh-Iu8G_KFVsRs

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AaAOQGGTDHjwJQba3fdRr55l9EqhioVUT5LFVWF5zHcY3VEadTxhUkf1XbRw5UPaq_QNhZX0Cwvx21JIDHhIQMyh-Iu8G_KFVsRs

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AaAOQGGTDHjwJQba3fdRr55l9EqhioVUT5LFVWF5zHcY3VEadTxhUkf1XbRw5UPaq_QNhZX0Cwvx21JIDHhIQMyh-Iu8G_KFVsRs
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: T-q7Hu5K_4Q8S_WbwLlKva_y5hJiBLXLHqb9IwxOipUZHzywIkgYRQ==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E087
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEOKv2PwRqXD_He5pxsLu_rI&google_cver=1&google_push=AaAOQGE1G8hKgAfuyyWcuZ5VS14GniUafD3PHh_mUh6PAm-YEOMfPT1SoNy-k66sUwG4Ovp-3vkYAa6CinXunQ2y92R-8_...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEOKv2PwRqXD_He5pxsLu_rI&google_cver=1&google_push=AaAOQGE1G8hKgAfuyyWcuZ5VS14GniUafD3PHh_mUh6PAm-YEOMfPT1SoNy-k66sUwG4Ovp-3vkYAa6CinXunQ2y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=vWBZDYNATn-r8EFIE3JtuA&google_push=AaAOQGE1G8hKgAfuyyWcuZ5VS14GniUafD3PHh_mUh6PAm-YEOMfPT1SoNy-k66sUwG4Ovp-3vkYAa6CinXunQ2...

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=vWBZDYNATn-r8EFIE3JtuA&google_push=AaAOQGE1G8hKgAfuyyWcuZ5VS14GniUafD3PHh_mUh6PAm-YEOMfPT1SoNy-k66sUwG4Ovp-3vkYAa6CinXunQ2y92R-8_oTauu4ag

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=vWBZDYNATn-r8EFIE3JtuA&google_push=AaAOQGE1G8hKgAfuyyWcuZ5VS14GniUafD3PHh_mUh6PAm-YEOMfPT1SoNy-k66sUwG4Ovp-3vkYAa6CinXunQ2y92R-8_oTauu4ag
access-control-allow-origin: *
date: Mon, 03 Jul 2023 23:22:21 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58281/ Frame E087 0
15 B 29ms
28ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEES4VKpgnnKdip7e6Gpyg6U&google_cver=1&google_push=AaAOQGGPWovgl9vQLa4SdXVnbjEsSE_iXTvJTqAeQP_C_RmRnmZPzPOtQWR8mK2YEJKi6AdaL0Y9DhgcFqXtgBiO3q3i7hiqRXLnSGA

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.57 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame E087
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEMsRNpIsHStskKCYN9ftJ-0&google_cver=1&google_push=AaAOQGEW8yRUr3S6wU7cGd_95zTeoG8IoruNDNdpGNGn-MauVJxzqS7jYmCczuYxZM9vDVCl_WNNtLbxdLOFUNLf1v6gte-HJJabmcA
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAaAOQGEW8yRUr3S6wU7cGd_95zTeoG8IoruNDNdpGNGn-Mau...

43 B
1 KB

90ms
28ms

Image
image/gif

162.19.138.118

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAaAOQGEW8yRUr3S6wU7cGd_95zTeoG8IoruNDNdpGNGn-MauVJxzqS7jYmCczuYxZM9vDVCl_WNNtLbxdLOFUNLf1v6gte-HJJabmcA

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

HTTP/1.1

Server

162.19.138.118 -, , ASN (),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Mon, 03 Jul 2023 23:22:21 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Mon, 03 Jul 2023 23:22:21 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAaAOQGEW8yRUr3S6wU7cGd_95zTeoG8IoruNDNdpGNGn-MauVJxzqS7jYmCczuYxZM9vDVCl_WNNtLbxdLOFUNLf1v6gte-HJJabmcA
x-download-options: noopen
vary: Accept
content-length: 274
x-xss-protection: 0

GET
H2

200

/
onetag-sys.com/match/ Frame E087
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEMIdqRGFBIVlafkHJYGLSFQ&google_cver=1&google_push=AaAOQGHYdPEbFozyqvIqr0r9kSu7fTYMvOxcEoTU70cL5NC_oMgSyRUZqEqcbtapE_U_u7v37U9XYNe2_ZV...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AaAOQGHYdPEbFozyqvIqr0r9kSu7fTYMvOxcEoTU70cL5NC_oMgSyRUZqEqcbtapE_U_u7v37U9XYNe2_ZVZfM5az7Uj61-5C4tRU4o
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

21ms
21ms

Image
text/plain

51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E087 0
12 B 31ms
30ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JCYzN8-vkVgIoyydQ_ThPWe-jCtXRJN0EheMs7U6-JpGMZ199C7UMLlta1IzpuHjvOafbEvrVj

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D173 1 KB
643 B 23ms
22ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23384
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 16:52:36 GMT
etag: 48472445140208031
expires: Tue, 04 Jul 2023 16:52:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 48DC 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5f093fa1089ad25478bdddea481ff24f2d967755a2fb86e61ddd8826a1483d9c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 82EC 22 KB
8 KB 22ms
22ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 490307
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 728x090.html Show response
s0.2mdn.net/sadbundle/17952959967271059456/ Frame 1F23 47 KB
12 KB 30ms
30ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

011e3c5d05b1f8220f59241e57ac65c49b382e8ed8eff99149e2eda18e36a660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 23:22:20 GMT
expires: Tue, 02 Jul 2024 23:22:20 GMT
last-modified: Wed, 15 Feb 2023 15:44:22 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4E3E 0
0 73ms
71ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvKeozqlTlw9bUUWHS3JV8L19K-BIWYeUyLHQxuwmtilUkT_ebPwmrtFs9Ed4IviuHzULjwSTih2NXaYYXnmok63HS2u254nyRMbzFimVyHK8iZD78ip_7YQuHxbSVpcvMjpLzgR2RjYaS3ZRSJv_0waULWKDdUI3gqe1rvSl4h1HpHlAgAaB8mSGPbcmKHxUAVxGy9vi5XI2Vi2Rzty38hheVClmwC02disg_rWM428KVVpMP8-ZEGRCjSHInrQlMu5PQT5QDOaA-WCi0vuSoddsS3LovCUqwCb0ooZ3sbsDfuIUlJcY-Z7Bgh73UBrdCswjFtg9tnS9wS_wskWNwEVgqtVuGSjuglq3JhS9LiXN2ipdOGPwGvdYIBiBy4boB8zweafmkvLUCOFLDvKezMgh80cN-uli23OaSLAhBjUoAMR6mc7QqYJvIKdljkvfGsZ3tEmPP2i99Gu_UtMqE4EkLy1MoafFjRsFGE9YTL3zJ4NTm1Sm2_t1culQoidXhK22uBrwNJdZjFE_P_1MBq6HuRrPiTss8HkaWlpfH3ErwWNHImz8S8Qb9b0C99vSCadKNF13gElsY6GDj9ZAIYtzqzDrvsCYPe1rs_uSCyWj1z32aFcT6FBAm0VMSfvC4vABPPkRGKeDxbvbAX2FFX06m6sSON7hIy1kOCFdMbhVFsAJPzVKKuRVCOonmKi987SEw_Lq0yorq_mMktFXNonYGVd1C1WopBLWq_A3k2EaqJ9KHRK6_Bliu2A3SWWA_dDabDJ5q9NRKb6-MBM9P-vSK8GzJbi6baIGSD7Qk2U4SK9Jf99a_1fXJEEE-O2m9uO_2QzNkz85dM8VIKrumGLIqsWLx9B2AMpl2SSNkUldPdX9zfy9ITWL1VjzNHxVpQo8gmdmtPdxBCBhUsL8UQf8zg3LIcxUXdgfhKYjFDutlwdXIHSbnedn9Nq3ztPOYMWe3LqCzgPv2WWFmlaiwscelQ4iyoXRsl9nwFWUlBCAUAzezKhE7OmtFNRr_5JQfKx8mT_CB2_PNkF3_9tP28ZrFwHMb-76H0PadwZbSlM-1GiIkCT9GBDtjM7mgrzJDZPZqXo_YBC-PHBnd4DdI8xjbj8aL7LIRfA4X04oIOiMEJT9MFSG2wHjYmMsh7UjezvzGh8S5_YtlbAR1-YtfX-RCCzVVoxQqZZXrWMoxhlr-iGJ_Ev8XYiiTVIXp8fYIEk6Gxo_mymGycAbnFpaPzvlz77FWvcLp-W9g4thRX_DXA1Vhbs5EbTkhRLkasPPD5n-4LJoq6GEQfRjuRPvrys4pcIak5J9OQOXa_NsXPXIceQaySIU11UoVVS4KkoVUQgBeP&sai=AMfl-YQaLDkIL-VOv2sLuu7slg5Io9MuhP3GzxOJQsNAgosJ2XxPbI0SHfon-oq9Ory9gEdJIsbtOsoHOZGdWs0VBPX6c-wKvRzhqwZUy17nVD9ZaKjh17YYSnsHmFNZuax6Nzi-MfKOJuDUslz_Ri5rn7ygQDUfyiyg67lJGLVMCX8F4H2WiB_PHHD7qZvH9A9BXzGjA4cU2Yk6y3zQYQWa860RvGyqwRi2Bb7iXgmPb6OWu8cC2kbIi0Aq3q7k7bNDGc1zaxHaa5Iv7wYsIivkDQ-n7K-eYw&sig=Cg0ArKJSzFKJdbU0QHJbEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=317&cbvp=1&cstd=310&cisv=r20230627.64935&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame A8CC 0
0 68ms
68ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cyj31K1ijZJ7yLISS9u8P6YS1yAGozYy8ce2p5r6qEdrZHhABIMCygmtglYKggrAHoAGL4PfBKMgBCakCC94UsJJQsj7gAgCoAwHIAwiqBNkBT9AXVG9qCTXNcHLHhZsW1kA13d1RcId6FuEwPJq9pVWGusHnFiRK92vu-D6WLXuKNn5XLq0ZI_TnnOKJqfMqLirNtJSIaaLU0IMOegldEj1QDmRfdOfVGdcvuxF6ziGdtwlcxftpsfmeAQ5yTApi6FFA7FxU9Wtmk9VGWFZUKmA6VtCD-_uuhqhBfF9_j7q2gqceUKiaPbqUNR14SLK3soG_AWfwYA-cCMAhxd4PjnrokqBMn1geAi9FaUlrrY3_f0WhnEKe9mF2VrxRMjL1IksKkuOLnV2DW8AE55ToyrkE4AQBoAYugAeLmMihA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEPrkBNIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTcyNzU1Mjg0NTMxNjIzMDmACgPICwHYEwPQFQGAFwGyFx4KHAgAEhRwdWItNjU5MzUyMzIxMDAxMDE1NBjqwW0&sigh=hoeYhpG0KQ0&uach_m=[]&cid=CAQSOwBygQiDH-n2r6ZuR-FmDX8Ylbn2VjEAsI79p7burFPKh0aR002eMugQqu2DgsSwCAq6z5mfjcjVgVCpGAE&template_id=419&cbvp=2
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AACF
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEE6XLy-lKdzmBfkbfVS3c1U&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QkNYdkRUZDQxUWdzUzg1&google_gid=CAESEE6XLy-lKdzmBfkbfVS3c1U&google_cver=1&google_push=AaAOQGHmdlw43IW47RWMIEB5ikoAjT5c5lCDSHquAai3XYd...

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QkNYdkRUZDQxUWdzUzg1&google_gid=CAESEE6XLy-lKdzmBfkbfVS3c1U&google_cver=1&google_push=AaAOQGHmdlw43IW47RWMIEB5ikoAjT5c5lCDSHquAai3XYddSzENg94d07jD09VhuV20NFJFeUbMhHq2ALkzgLsxweOzafA-YXNO

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Jul 2023 23:22:20 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-782-g97d928b#rel-ec2-master i-036c9e308bb7e39b5@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QkNYdkRUZDQxUWdzUzg1&google_gid=CAESEE6XLy-lKdzmBfkbfVS3c1U&google_cver=1&google_push=AaAOQGHmdlw43IW47RWMIEB5ikoAjT5c5lCDSHquAai3XYddSzENg94d07jD09VhuV20NFJFeUbMhHq2ALkzgLsxweOzafA-YXNO
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AACF
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEPatRxSblVeW2gKxLPThNfs&google_cver=1&google_push=AaAOQGE7UnAoO8cujprwBI5LMMLpagbgPiEuWOVcEXUoy23MB7klE4IIFSMsFE_I4TEmuNGPvh7dbmX_AnpVxPKYD__2LlYp0tg
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=2F819472275C45F09D77A7EC9BC83F1C&google_push=AaAOQGE7UnAoO8cujprwBI5LMMLpagbgPiEuWOVcEXUoy23MB7klE4IIFSMsFE_I4TEmuNGPvh7dbmX_AnpVxPK...

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=2F819472275C45F09D77A7EC9BC83F1C&google_push=AaAOQGE7UnAoO8cujprwBI5LMMLpagbgPiEuWOVcEXUoy23MB7klE4IIFSMsFE_I4TEmuNGPvh7dbmX_AnpVxPKYD__2LlYp0tg

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=2F819472275C45F09D77A7EC9BC83F1C&google_push=AaAOQGE7UnAoO8cujprwBI5LMMLpagbgPiEuWOVcEXUoy23MB7klE4IIFSMsFE_I4TEmuNGPvh7dbmX_AnpVxPKYD__2LlYp0tg
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 02 Jul 2023 23:22:20 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame AACF 70 B
264 B 47ms
45ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEETcpuRSla4qfQlbDLydQKI&google_cver=1&google_push=AaAOQGEMGGzof_AMVvvbreb6VGH3tVawAFW2Oe9QUMlwt0AT5X2i4YW1bo3pvu-0MPncK9QqrPc3VmCPMvhJcegOTZ3xjxx4-fE
Requested by: Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AACF
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEM7QMNjqXDdS_AxZJfZVUYE&google_cver=1&google_push=AaAOQGH_5MYYdjGYyUC6Fmd4xtzR8o4OGWY7g0x93LCh-MAI914U7Y7FCJMY8yAT99qAb2J5ACiBlBRNU7f...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGH_5MYYdjGYyUC6Fmd4xtzR8o4OGWY7g0x93LCh-MAI914U7Y7FCJMY8yAT99qAb2J5ACiBlBRNU7fFm3U76yo9cvVYHqAR&google_hm=XtO9OExkTW-imgt69WrKRoU

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGH_5MYYdjGYyUC6Fmd4xtzR8o4OGWY7g0x93LCh-MAI914U7Y7FCJMY8yAT99qAb2J5ACiBlBRNU7fFm3U76yo9cvVYHqAR&google_hm=XtO9OExkTW-imgt69WrKRoU

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGH_5MYYdjGYyUC6Fmd4xtzR8o4OGWY7g0x93LCh-MAI914U7Y7FCJMY8yAT99qAb2J5ACiBlBRNU7fFm3U76yo9cvVYHqAR&google_hm=XtO9OExkTW-imgt69WrKRoU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AACF
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEA60vMJxgo3wR7U_1AvQ71I&google_cver=1&google_push=AaAOQGHo5ZcuSlKn3uyCa3N7_bwUdP1ASPccjru1OhR0vZYTM8tVlQU4UjN5YjQWJjS4I6py9323J5DQTkd-x8tt...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=MJb-k1vhQwWPbFYJFBw0-Q2&google_push=AaAOQGHo5ZcuSlKn3uyCa3N7_bwUdP1ASPccjru1OhR0vZYTM8tVlQU4UjN5YjQWJjS4I6py9323J5DQTkd-x8ttNde0RwO1bh2a

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=MJb-k1vhQwWPbFYJFBw0-Q2&google_push=AaAOQGHo5ZcuSlKn3uyCa3N7_bwUdP1ASPccjru1OhR0vZYTM8tVlQU4UjN5YjQWJjS4I6py9323J5DQTkd-x8ttNde0RwO1bh2a

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=MJb-k1vhQwWPbFYJFBw0-Q2&google_push=AaAOQGHo5ZcuSlKn3uyCa3N7_bwUdP1ASPccjru1OhR0vZYTM8tVlQU4UjN5YjQWJjS4I6py9323J5DQTkd-x8ttNde0RwO1bh2a
x-host: tde-deliveryengine-production-7c97bc8457-bn8lx
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AACF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEGpkmVtExCMWJVzrW23rCb0&google_cver=1&google_push=AaAOQGFv3ouUI_c8DRHQlv8f2BzRyxJwu2sW-xA600l9lqYYsnH_kRqdRCm3dXeInZ8Q9jZ3UtPoxF8L3XRfByB4A_o7IdT...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGFv3ouUI_c8DRHQlv8f2BzRyxJwu2sW-xA600l9lqYYsnH_kRqdRCm3dXeInZ8Q9jZ3UtPoxF8L3XRfByB4A_o7IdT3CNIG&google_hm=eS1MX1U3QXBwRTJwR1Mxak...

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGFv3ouUI_c8DRHQlv8f2BzRyxJwu2sW-xA600l9lqYYsnH_kRqdRCm3dXeInZ8Q9jZ3UtPoxF8L3XRfByB4A_o7IdT3CNIG&google_hm=eS1MX1U3QXBwRTJwR1Mxakx4QzAudE9MSy5aLkVLRGlQTH5B

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGFv3ouUI_c8DRHQlv8f2BzRyxJwu2sW-xA600l9lqYYsnH_kRqdRCm3dXeInZ8Q9jZ3UtPoxF8L3XRfByB4A_o7IdT3CNIG&google_hm=eS1MX1U3QXBwRTJwR1Mxakx4QzAudE9MSy5aLkVLRGlQTH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AACF
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEE2rhLYmTFJ1KpPAx-AmcPM&google_cver=1&google_push=AaAOQGHTC1A5yfPeVpYVqJOohrBZXGsr2-nUGB8UvoP3MmL-eYNrQQH0_XqA1_txXsHAywD2nDmSXBFs31zBXafrUqhD6th...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEE2rhLYmTFJ1KpPAx-AmcPM&google_cver=1&google_push=AaAOQGHTC1A5yfPeVpYVqJOohrBZXGsr2-nUGB8UvoP3MmL-eYNrQQH0_XqA1_txXsHAywD2nDmSXBFs31zBXafrUqhD6...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AaAOQGHTC1A5yfPeVpYVqJOohrBZXGsr2-nUGB8UvoP3MmL-eYNrQQH0_XqA1_txXsHAywD2nDmSXBFs31zBXafrUqhD6thzl7M

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AaAOQGHTC1A5yfPeVpYVqJOohrBZXGsr2-nUGB8UvoP3MmL-eYNrQQH0_XqA1_txXsHAywD2nDmSXBFs31zBXafrUqhD6thzl7M

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AaAOQGHTC1A5yfPeVpYVqJOohrBZXGsr2-nUGB8UvoP3MmL-eYNrQQH0_XqA1_txXsHAywD2nDmSXBFs31zBXafrUqhD6thzl7M
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame AACF 0
12 B 29ms
28ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KeZ-gZtXPLj47-yGuJ9wHBrHWPsigtb1O79ijJr6OZIcrWsQSFGf2PHsIjVCxsHaSEOqZ-

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B9BE 22 KB
8 KB 22ms
21ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 490307
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8EE
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKiGjxYXmSDJ49YtuHNKb5Q&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QkNYdkRUZDQxUWdzUzg1&google_gid=CAESEKiGjxYXmSDJ49YtuHNKb5Q&google_cver=1&google_push=AaAOQGE38-xPa0r-SgbD8TvDin4aiME0_dMy5N6vP9AkOoq...

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QkNYdkRUZDQxUWdzUzg1&google_gid=CAESEKiGjxYXmSDJ49YtuHNKb5Q&google_cver=1&google_push=AaAOQGE38-xPa0r-SgbD8TvDin4aiME0_dMy5N6vP9AkOoqOp36QDiPLgAlwxTge37P3HBxh644DC2PtljnGMt1fhwX-2V98Xp3W

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Jul 2023 23:22:20 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-782-g97d928b#rel-ec2-master i-008a7b4f528d14c6d@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QkNYdkRUZDQxUWdzUzg1&google_gid=CAESEKiGjxYXmSDJ49YtuHNKb5Q&google_cver=1&google_push=AaAOQGE38-xPa0r-SgbD8TvDin4aiME0_dMy5N6vP9AkOoqOp36QDiPLgAlwxTge37P3HBxh644DC2PtljnGMt1fhwX-2V98Xp3W
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8EE
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEH4GWFM-ayDFsGkJ6mSfJbA&google_cver=1&google_push=AaAOQGFDE_BPvrRNxO_bLiJzxCvVrZ2VhLs-y4DzwtdmSrUCuHLobr8kcTsnwkBZkDVwgMjFN5VNg_vBftAdST...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI1MTczNjc3MTAxNDE2MjU3MQ%3D%3D&google_push=AaAOQGFDE_BPvrRNxO_bLiJzxCvVrZ2VhLs-y4DzwtdmSrUCuHLobr8kcTsnwkBZkDVwgMjFN5VNg_vBftAdSTvhwi...

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI1MTczNjc3MTAxNDE2MjU3MQ%3D%3D&google_push=AaAOQGFDE_BPvrRNxO_bLiJzxCvVrZ2VhLs-y4DzwtdmSrUCuHLobr8kcTsnwkBZkDVwgMjFN5VNg_vBftAdSTvhwiMWl4jdk-fN

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI1MTczNjc3MTAxNDE2MjU3MQ%3D%3D&google_push=AaAOQGFDE_BPvrRNxO_bLiJzxCvVrZ2VhLs-y4DzwtdmSrUCuHLobr8kcTsnwkBZkDVwgMjFN5VNg_vBftAdSTvhwiMWl4jdk-fN
Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8EE
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEFeV7XIysT2R9QIyQGctJLc&google_cver=1&google_push=AaAOQGEpebk8HY4Z8bads9LCrFLw62l-xQLDXxUrNJvqOwMEODgDX8seJ31tG6iMjnnDxzq-81YzloclfBqNCkUd...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QAoNdRiVTM22NahFO7UP5w2&google_push=AaAOQGEpebk8HY4Z8bads9LCrFLw62l-xQLDXxUrNJvqOwMEODgDX8seJ31tG6iMjnnDxzq-81YzloclfBqNCkUdz2raQvqtuqlZ

170 B
188 B

32ms
32ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QAoNdRiVTM22NahFO7UP5w2&google_push=AaAOQGEpebk8HY4Z8bads9LCrFLw62l-xQLDXxUrNJvqOwMEODgDX8seJ31tG6iMjnnDxzq-81YzloclfBqNCkUdz2raQvqtuqlZ

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QAoNdRiVTM22NahFO7UP5w2&google_push=AaAOQGEpebk8HY4Z8bads9LCrFLw62l-xQLDXxUrNJvqOwMEODgDX8seJ31tG6iMjnnDxzq-81YzloclfBqNCkUdz2raQvqtuqlZ
x-host: tde-deliveryengine-production-7c97bc8457-bn8lx
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8EE
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEHzsS3q7gHxeNcNo8Q0yEcA&google_cver=1&google_push=AaAOQGGvWcBytqUqZhhWuXz6utZph16ycBguz63y21fG2-yP89C8EYz-N8ZfLnkLhYF-5qfXQemlMfb4HNFTf_VxPkIoG83...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEHzsS3q7gHxeNcNo8Q0yEcA&google_cver=1&google_push=AaAOQGGvWcBytqUqZhhWuXz6utZph16ycBguz63y21fG2-yP89C8EYz-N8ZfLnkLhYF-5qfXQemlMfb4HNFTf_VxPkIoG...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AaAOQGGvWcBytqUqZhhWuXz6utZph16ycBguz63y21fG2-yP89C8EYz-N8ZfLnkLhYF-5qfXQemlMfb4HNFTf_VxPkIoG83bD-_y

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AaAOQGGvWcBytqUqZhhWuXz6utZph16ycBguz63y21fG2-yP89C8EYz-N8ZfLnkLhYF-5qfXQemlMfb4HNFTf_VxPkIoG83bD-_y

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AaAOQGGvWcBytqUqZhhWuXz6utZph16ycBguz63y21fG2-yP89C8EYz-N8ZfLnkLhYF-5qfXQemlMfb4HNFTf_VxPkIoG83bD-_y
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8EE
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AaAOQGHAyVHoWJTQ4VrUuo6vy9kXZ7XZggwIKcqG2vrKfUHDqdAd03TVI1FpCMOhZm88SIzyMlNx_E1fJDKlP_7z_P83yPEXOx1Y&redir=https%3A%2F%2Fcm.g.doubl...
https://sync.targeting.unrulymedia.com/csync/RX-d0ab2335-9e20-40ec-ab5a-e62b8d68857f-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAaAOQGHAyVHoWJTQ4VrUuo6vy...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AaAOQGHAyVHoWJTQ4VrUuo6vy9kXZ7XZggwIKcqG2vrKfUHDqdAd03TVI1FpCMOhZm88SIzyMlNx_E1fJDKlP_7z_P83yPEXOx1Y&google_hm=A9CrIzWeIEDsq1rmK41ohX8

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AaAOQGHAyVHoWJTQ4VrUuo6vy9kXZ7XZggwIKcqG2vrKfUHDqdAd03TVI1FpCMOhZm88SIzyMlNx_E1fJDKlP_7z_P83yPEXOx1Y&google_hm=A9CrIzWeIEDsq1rmK41ohX8

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AaAOQGHAyVHoWJTQ4VrUuo6vy9kXZ7XZggwIKcqG2vrKfUHDqdAd03TVI1FpCMOhZm88SIzyMlNx_E1fJDKlP_7z_P83yPEXOx1Y&google_hm=A9CrIzWeIEDsq1rmK41ohX8
date: Mon, 03 Jul 2023 23:22:21 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXd0ab23359e2040ecab5ae62b8d68857f003
content-type: text/html

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58281/ Frame C8EE 0
15 B 26ms
25ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAdWMZFKdXz5FYXkb9UI_gc&google_cver=1&google_push=AaAOQGFzXXYqgMb_7Ux2WGIkx5WQe_o2Wn1cr9noe9NuzT-hDoTOtRxBp7H-VlptB-PFGqcIxRy8AfQ-LxvsGL4SmqC-LnqtQYP5tw

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.57 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8EE
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEPTokyL3NCtTdoIRoJoIXa4&google_cver=1&google_push=AaAOQGG9qx9OYWuEf...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTM2ODc3ODk2NzUxMjI4Mzk5OA%3D%3D&google_gid=CAESEPTokyL3NCtTdoIRoJoIXa4&google_cver=1&google_push=AaAOQGG9qx9OYWuEf-HNE_XoJ09jPv3Nyj...

170 B
188 B

30ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTM2ODc3ODk2NzUxMjI4Mzk5OA%3D%3D&google_gid=CAESEPTokyL3NCtTdoIRoJoIXa4&google_cver=1&google_push=AaAOQGG9qx9OYWuEf-HNE_XoJ09jPv3NyjNYj5jX8JthH0yytf3uAoCLMHXd27rkQDlGW9sumCEY0LyPvkctTCZbB8CAItvx9Gx8gA

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: fa074ab5-c9f4-44c2-b780-b6974af0e26e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTM2ODc3ODk2NzUxMjI4Mzk5OA%3D%3D&google_gid=CAESEPTokyL3NCtTdoIRoJoIXa4&google_cver=1&google_push=AaAOQGG9qx9OYWuEf-HNE_XoJ09jPv3NyjNYj5jX8JthH0yytf3uAoCLMHXd27rkQDlGW9sumCEY0LyPvkctTCZbB8CAItvx9Gx8gA
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C8EE 0
12 B 28ms
27ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IXOMiAARtNE1QeLHdluDI8-JTohxI1MM3npCL982KZe_NmmGUIpky_A-IZaB9v9ZiI5kqwrxc

Requested by

Host: 2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com
URL: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 728x090.html Show response
s0.2mdn.net/sadbundle/17952959967271059456/ Frame 545D 47 KB
12 KB 30ms
29ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

011e3c5d05b1f8220f59241e57ac65c49b382e8ed8eff99149e2eda18e36a660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 23:22:20 GMT
expires: Tue, 02 Jul 2024 23:22:20 GMT
last-modified: Wed, 15 Feb 2023 15:44:22 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4F5C 0
0 66ms
66ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss5Xg7GrbQdTDc2i5CD8xv_eu6mr95Kyy2aIXjtxHpT7DeXfFdfPd-tHgMBVhHUIUMrEXwpXukEFE7r5qVWZXbQ3VOWoQes9rEsWSKk7kfRXhLurcLArK6dw-XPogDXPcdQ-2RRXB3Gv46kn_GUwZpoc0c6kv10DuU3w824JdkHWVYYThWVeQtm-vU3ugabGOOf-d9pBOmgrBgC6Mw3P3USOwMFqu4Bv1V1UKpmlKE7toUIa_pb3ggdqETiMmy2Q7zv1xPL4-Ul_ekg-IyvQyPZIJHa2hOaBmQ6gUgBAKjiQ5sHFkpm5_ThvP9hCHL83k9u4_ZbV1KADHdpA_9qzxJnd0w5NbjjfKqU1UVABwsFAACY8n5m-N5qcQTkBbd5TfBp6c2o2wkGEbrfuI6DItCTNvsWH-r73nmISMSuTd-arpLWBd5Je4K7V2PEgF8xaYmCj6l_5m2RleSYm9nKJhG6y6S6nA-HRTYi4H0Qx4vq9hzaLhocRW1KWp-YB0dPHaKkw7m7gG6gvvglpp6B1-2ijjw8HVnEyC6otiVLnM56hn1Pj8fzCWAjhQoG3gzZ_EssX7xmo9_xbaAvkY2Klsc1MoPmC0T2S1I0-jK8_ewVvP2_9O4pVUuTNuSoomeQowTQlR55KYiFdtfyOSPgc0EH4S-LQulGZC1BUEJ4OdhPT8S4hWlzeaE_iB7Jmf3UZiaACkWWlMZdnBOjn1-aA1i7AnRsO7MeLz9dRvdIpj3svt6BTVSXeWtnOMEla2FkaZy9gyrIfU4_5qkWsGt9wQb1u5is371Xyq7oBbeICNCYZ-meeMC_HoZ_WNsplxyRrHEUpWxh8QB3HgboCznS-dpnVrB-3cBDQie7Z2qNoYvrMqbpP6IECrbF-HMcLfaBHm8UO7ZyNIZySWzIM0gnkV-kq2W6zunu2hpSPB9uUni7F9yHvKeUYEhuUyImD64_az5geS1KE4CHpiNF-tPTcl4cNOl2Kyt6XxffE_8ulv5gyO8JTYuolG6o22C3qULsD6l8NcuiMgjH6BM-4C4kJNNhtgXc3DRZ-_F4hKnhHBSltzliWO59WNqU0QslMBIGFVFPUbsJ9DzCO5i009-Kvy7xdAzs9zaq7btrw3E1AJjC4YN4Cg1HeIrnOGss6VeguzAj32qcI40gf1Jo8CDbKk5hAv0gt-XJKrYg9O3rrVxb6bRpxKrps-j9oRxX-UBNYwCVaIki-ISASzg0k7OzZ18ZXKMOgufppJXEu16uDkGpsMXxeMj4e871-FxyTJ-60LDrGcub4sMDYOuj-fRcddPXvk3T5dWGaG8E4slpg9zcR4XC41B-D8NQuxQVOlF8qDE&sai=AMfl-YQLDMOvULDelpV9Zzqre-a9sAlx6-ZmOXbxkBPdmgEqry37fCCaKJ_VbPd2gyWDAhUPkZxAfuEax0AC2R3bemP6bb8asvCOaDNQfqC1MuNY0ZnZzmBoHBXbQwpmsEJ21L7rIBOGPwJBWJLgXE_0QfGKE_aHx1CeKtNCSF6GhqMMTawFd3dAT3qYS5DrtEPlKsEd9ZUW6dmmWZ1LjNK28tI0wifVkCV-IvTDEjdlM9AHX2j2MpRQWaJBuYGGFVvP2NVirhUxqaGm80F-24MZmDhBCB-5&sig=Cg0ArKJSzC-hS2PTqPOeEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=276&cbvp=1&cstd=270&cisv=r20230627.29863&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A139 22 KB
8 KB 23ms
23ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 490307
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.3/ Frame 6BA3 64 KB
23 KB 215ms
26ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.3/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b4e40ffeea4f88fa78707ac8a7aa1beefb4f707d7bba71eb8b0e40ce20fbc94

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1824894
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 23286
last-modified: Tue, 12 Apr 2022 12:35:57 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6255722d-5af6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bd5MWbapMVVh5pAgx3pZREdcBMFqo2%2BhC6eearNBD6z9CBxNY%2BTBtoRPg8LqfLy%2BH%2FTzs3t%2F3DWTTIv%2FPcBS6GJ17qMK84h%2Bl32A6RI%2Bv4zedv4gP7vMczPpRq9ldUJcniQ7RKTEULQ860izWSWG%2Bch1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7e12deb91d813678-FRA
expires: Sat, 22 Jun 2024 23:22:20 GMT

GET
H3 200 creative-1.0.9-alpha.js Show response
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/scripts/ Frame 6BA3 3 KB
1 KB 22ms
21ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/scripts/creative-1.0.9-alpha.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de22b749dfb9461f4308fddfbc79f0b636f78f4add1e26a481fdd23be02cb3c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 01 Jul 2023 01:33:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 251338
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1012
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 30 Jun 2024 01:33:22 GMT

GET
H3 200 keyvisual-x2.jpg
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 137 KB
137 KB 21ms
21ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/keyvisual-x2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3afa48222c517ff2a5fff0923c48df3e779f50ad58dc6ffee371ffed491cc002

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 23:45:24 GMT
x-content-type-options: nosniff
age: 517016
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140052
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 26 Jun 2024 23:45:24 GMT

GET
H3 200 donut-1-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 7 KB
7 KB 21ms
20ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/donut-1-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01060adb62f52587a5420ec9ec23589c8b1618cf9ae5e56a40bf909c5066ec18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 02:39:30 GMT
x-content-type-options: nosniff
age: 506570
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6823
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 27 Jun 2024 02:39:30 GMT

GET
H3 200 donut-2-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 5 KB
5 KB 21ms
21ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/donut-2-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a50a9f6026761814dfa96cae32807b687f1b116d4d6e3ae4a1334d9673a24c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:56:49 GMT
x-content-type-options: nosniff
age: 534331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5062
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 26 Jun 2024 18:56:49 GMT

GET
H3 200 partner.svg
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 414 B
314 B 29ms
29ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/partner.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23f1437cd33df500ccadb5cacf49ba212539c95a7a25567c45b99caa9f26ed5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 06:07:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 580504
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 276
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 26 Jun 2024 06:07:17 GMT

GET
H3 200 text-1-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 2 KB
2 KB 20ms
20ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/text-1-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba4abb531a6e87e459906df9fc6e20fbffb73371536d971a82fd27356d09d7a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 21:31:44 GMT
x-content-type-options: nosniff
age: 265837
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1896
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 29 Jun 2024 21:31:44 GMT

GET
H3 200 text-2-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 2 KB
2 KB 21ms
20ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/text-2-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88318ac0b00e13dfbd59368fe4f3d07444b7e24c1ddae686fa953d3617c2e861

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 05:44:38 GMT
x-content-type-options: nosniff
age: 322663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1738
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 29 Jun 2024 05:44:38 GMT

GET
H3 200 text-3-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 6 KB
6 KB 23ms
22ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/text-3-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

682293682ff2a9a2335e59db4a0fe50a10eebb8778466cf9f78c9f287374ee8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 18:15:00 GMT
x-content-type-options: nosniff
age: 450441
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6454
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 27 Jun 2024 18:15:00 GMT

GET
H3 200 cta-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 13 KB
13 KB 27ms
27ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/cta-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4d7e96e04dde24cda2e961f63b7b9a7cc92133c393a232d474d4dbca3af4264

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 01 Jul 2023 00:58:03 GMT
x-content-type-options: nosniff
age: 253458
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13337
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 30 Jun 2024 00:58:03 GMT

GET
H3 200 overlay-donut-1-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 8 KB
8 KB 30ms
29ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/overlay-donut-1-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c87098c66c253d0835932e906b8bffe99a09391774326c23f59c8180d40e9075

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 16:37:54 GMT
x-content-type-options: nosniff
age: 369867
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7993
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jun 2024 16:37:54 GMT

GET
H3 200 overlay-donut-2-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 5 KB
5 KB 28ms
28ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/overlay-donut-2-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d0f0fcf213790f7121de3bd631fad0c41ad2a63f9f0d6296ce1e39c92ad549d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 01 Jul 2023 18:38:02 GMT
x-content-type-options: nosniff
age: 189859
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5513
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 30 Jun 2024 18:38:02 GMT

GET
H3 200 overlay-cta-hover-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 12 KB
12 KB 28ms
27ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/overlay-cta-hover-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eec437738062b03997a9f91aa8cb2587d0ca369db6e48ae2008c6b84ab651300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 01 Jul 2023 01:01:44 GMT
x-content-type-options: nosniff
age: 253237
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12637
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 30 Jun 2024 01:01:44 GMT

GET
H3 200 overlay-cta-x2.png
s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/ Frame 6BA3 12 KB
12 KB 28ms
28ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/images/overlay-cta-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e694a05618db8a6ab4b632dbcc2ca7f8d53d0caa0592b8d0f8af79e317106b95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3421253869763221650/SIGGI-KANN_160x600/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 07:14:46 GMT
x-content-type-options: nosniff
age: 317255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12754
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:03:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 29 Jun 2024 07:14:46 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D8E2 22 KB
8 KB 22ms
22ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 490307
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 87E2 113 KB
38 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 87E2 118 KB
40 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:36 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 1F23 118 KB
40 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:36 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 1F23 63 KB
25 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 728x090.html Show response
s0.2mdn.net/sadbundle/17952959967271059456/ Frame 3D99 47 KB
12 KB 32ms
31ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pkb3bN1ecC&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

011e3c5d05b1f8220f59241e57ac65c49b382e8ed8eff99149e2eda18e36a660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Jul 2023 23:22:20 GMT
expires: Tue, 02 Jul 2024 23:22:20 GMT
last-modified: Wed, 15 Feb 2023 15:44:22 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 48DC 0
0 67ms
67ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssE9expMB_hxO55hAkFXfacYv7lL38CkwqibmcJ0WTkiRo9rEKeZ6ggO5XTzvTa2fAd98AWze0dJQ0t6jWizA8aajfCF4wxF7FpwsL0wT4l_yvKRH9IOPW-26F1q-TuduOrFvnfd0GCs6v93T_WMkp0L7H8jlrQFcmbCqT-ohHNqT_QLYi-nJwGqHiboz6JgabfHq5WEYtZi-_e2SvereboGememsq4VgPo8n5MyDCnq9Fg4wp-49F0WL1SNe9EOGNAPGPycs4rBpAW4w6JlGMWaqSUuMp2OjFfxKSDCTTlCDnSVUapBp-v0BdD7MEkq1_hs02qpTd8RvIoEkYHNIFQk-FqH3VEXzZc9sl__nLEzp5gzGE29HswKbd5gSr7Mh0Kx0wC5o1dineDttYUON4IOgfbA9v7qiyb3ywyNdI6_MT_h5-kQkEtwTZ2k5o014wT0btVHTRjxuwkzk-Q__xa3KccMwEDLnpCN17HkavaC3DzjA-yR4PxVKHicR6rY4xLkMoL7pMWaaIo2rmYCXdPFFMCLPC9nJ8NX8PPVau7Zljmbd2hZTFZ4JL1cT3yUsYCLZNZuCMGSWdtq7Rqyv3x4mQFWX4925YdOdPDHusx7SHatLG5UWq_tEpNZqYLHq_63arQGFET_rwl4UfMZokf9piJQp8g1y5QxbY5xRVMuMfRBWjrRNEDr5I5Pau1QLpqgTsBloVKQpMSWMcrvG4sVfHdlfw4i8POPBL3_0T_LxfBLFd7KREE357Vcx6eZIMvLxYHkB794_LHWAZwZ6LbR9PMkWRNG-sOFgKBk89GtkIU6wbc2NAzFmFvTm-EUBF75NDWdBnLp1Ybi2iU8dXf_Tc4QsCKZ0C_YVhMo5PPMDtGoq1Av6YXg7tTWnV6f2Ui1XsVOUKgQvn7ayFGR19bd5zyCO1Ak1z2Pob2Lo4xD4-zLTpayw3PmBwI9kRm2-KfWBtpn178GJK0Z8Hi1WLABKtDoqY3Be-7_sTqleiTojZhD8P6TFeB6_BL49FevyvKMFrzhhWobKwxtXCHgYpDdGj9vy1a1wWo3H0A5uKghcEyEu5EceHXQyGMgkHPh8czdc8xEnivoyQohx3gRcrqZxkavQiWkryE_oF3xmsH3wjBm7EJPvcGNGYflNFtYg3Ll3CrsRWAlMGmItE7agB2kBi6Q76oDI6NeiSqc6vmHJYg4DwHICVKwgb9E23tWfsO-HgxzfQa5PlN6B0iPj1qWcvq6VfUtfbplvISndKq6iuNBFRohzRoCzBXFxIo7PJ0xNQi_gcRq88ViuWyz0UfvRYyEnX44D48jXwvrt9mLcCff16hei1cL52SYpUfynNIZ352zQ&sai=AMfl-YRdBWZC_n1iD8oOlWTnOsnGF6kYtz2QJzbZSo8z060Dl5ZRh0-mdOIDXUE9prUUY4TPNrkQDMaRUc0Xs6TlQikksu1A3lmvzhWfvmarks5nMT5hhh-YVr6T7edIRTZjCmjsQ7wmfixKidYQf2OD327qUm1XpVsQMgO9A_0XXuiHgp-2J2DD3KmxoVvAHvpXFskGxWQEH_9gPVuJ6gI_QWw-T0s9FhWW3fPt&sig=Cg0ArKJSzEjPuNI1g3TYEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=197&cbvp=1&cstd=190&cisv=r20230627.77239&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 545D 118 KB
40 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:36 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 545D 63 KB
25 KB 35ms
34ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D173
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEI_ANnJBHy3gkyq4UnwhYqQ&google_cver=1&google_push=AaAOQGFAvcp2MPfdRrw_2ntiu5nqioPl9H-mH79hes9fs1HJQbZpeHIrZ5YfTBBRnHaDTJ1idO7EEvQ_aPpPa13h...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGFAvcp2MPfdRrw_2ntiu5nqioPl9H-mH79hes9fs1HJQbZpeHIrZ5YfTBBRnHaDTJ1idO7EEvQ_aPpPa13hoJ3OIAUOlPfmfA

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGFAvcp2MPfdRrw_2ntiu5nqioPl9H-mH79hes9fs1HJQbZpeHIrZ5YfTBBRnHaDTJ1idO7EEvQ_aPpPa13hoJ3OIAUOlPfmfA

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: MT3 1031 59fd23a master cdg cdg-pixel-x25 config_version:"1438"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGFAvcp2MPfdRrw_2ntiu5nqioPl9H-mH79hes9fs1HJQbZpeHIrZ5YfTBBRnHaDTJ1idO7EEvQ_aPpPa13hoJ3OIAUOlPfmfA
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 03 Jul 2023 23:22:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D173
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEMde4oRknNRD-86G6CeTmJU&google_cver=1&google_push=AaAOQGFFZgAqml6A22Yx5Xb5A9XrZblRo5Z1C1eAhNTOGoMbn-71ocH3QvXgkWJkaCoCbp-cqsUFZjqYapaPuxmtshEoXpA4zIIemw
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=2F819472275C45F09D77A7EC9BC83F1C&google_push=AaAOQGFFZgAqml6A22Yx5Xb5A9XrZblRo5Z1C1eAhNTOGoMbn-71ocH3QvXgkWJkaCoCbp-cqsUFZjqYapaPuxm...

170 B
188 B

31ms
30ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=2F819472275C45F09D77A7EC9BC83F1C&google_push=AaAOQGFFZgAqml6A22Yx5Xb5A9XrZblRo5Z1C1eAhNTOGoMbn-71ocH3QvXgkWJkaCoCbp-cqsUFZjqYapaPuxmtshEoXpA4zIIemw

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=2F819472275C45F09D77A7EC9BC83F1C&google_push=AaAOQGFFZgAqml6A22Yx5Xb5A9XrZblRo5Z1C1eAhNTOGoMbn-71ocH3QvXgkWJkaCoCbp-cqsUFZjqYapaPuxmtshEoXpA4zIIemw
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 02 Jul 2023 23:22:20 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D173
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESELSmOeLln7EUAqCiVAlPsb8&google_cver=1&google_push=AaAOQGEt9vzA3djQf-3CyzsewLGm_cUUBju5pFSOoopvMHyRceFNQfoAYa0UXcnC5e4c4DeNdj47i6d4sUd...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGEt9vzA3djQf-3CyzsewLGm_cUUBju5pFSOoopvMHyRceFNQfoAYa0UXcnC5e4c4DeNdj47i6d4sUdUAM7BuvmNUrmoWWvAqw&google_hm=XtO9OExkTW-imgt69W...

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGEt9vzA3djQf-3CyzsewLGm_cUUBju5pFSOoopvMHyRceFNQfoAYa0UXcnC5e4c4DeNdj47i6d4sUdUAM7BuvmNUrmoWWvAqw&google_hm=XtO9OExkTW-imgt69WrKRoU

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AaAOQGEt9vzA3djQf-3CyzsewLGm_cUUBju5pFSOoopvMHyRceFNQfoAYa0UXcnC5e4c4DeNdj47i6d4sUdUAM7BuvmNUrmoWWvAqw&google_hm=XtO9OExkTW-imgt69WrKRoU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D173
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEEVBGehm5gIhD62d_b7HPCE&google_cver=1&google_push=AaAOQGGUYVZ4L8wEgDtacta5O0dMnQIKyN9mbgNTXSJHWyMxYIbbt5aIWV2Zq5yUBZ4W3d_cH8RGnBUEhuEdbY...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI1MTczNjc3MTAxNDE2MjU3MQ%3D%3D&google_push=AaAOQGGUYVZ4L8wEgDtacta5O0dMnQIKyN9mbgNTXSJHWyMxYIbbt5aIWV2Zq5yUBZ4W3d_cH8RGnBUEhuEdbYehan...

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI1MTczNjc3MTAxNDE2MjU3MQ%3D%3D&google_push=AaAOQGGUYVZ4L8wEgDtacta5O0dMnQIKyN9mbgNTXSJHWyMxYIbbt5aIWV2Zq5yUBZ4W3d_cH8RGnBUEhuEdbYehanyMU3qGndS6fA

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI1MTczNjc3MTAxNDE2MjU3MQ%3D%3D&google_push=AaAOQGGUYVZ4L8wEgDtacta5O0dMnQIKyN9mbgNTXSJHWyMxYIbbt5aIWV2Zq5yUBZ4W3d_cH8RGnBUEhuEdbYehanyMU3qGndS6fA
Date: Mon, 03 Jul 2023 23:22:20 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D173
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEELN7OJMO9iiOdCFs1kD9RY&google_cver=1&google_push=AaAOQGF143a5fo004cbBzlMEQFd_NH4mJZz9y5RZMfq_YmBtihaAaF8FRwqt3q-s_Jfb4Hh2nfqRfdjJ4ec8pIeA...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QAoNdRiVTM22NahFO7UP5w2&google_push=AaAOQGF143a5fo004cbBzlMEQFd_NH4mJZz9y5RZMfq_YmBtihaAaF8FRwqt3q-s_Jfb4Hh2nfqRfdjJ4ec8pIeAcZr-qeEgwEOTXA

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QAoNdRiVTM22NahFO7UP5w2&google_push=AaAOQGF143a5fo004cbBzlMEQFd_NH4mJZz9y5RZMfq_YmBtihaAaF8FRwqt3q-s_Jfb4Hh2nfqRfdjJ4ec8pIeAcZr-qeEgwEOTXA

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 03 Jul 2023 23:22:20 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QAoNdRiVTM22NahFO7UP5w2&google_push=AaAOQGF143a5fo004cbBzlMEQFd_NH4mJZz9y5RZMfq_YmBtihaAaF8FRwqt3q-s_Jfb4Hh2nfqRfdjJ4ec8pIeAcZr-qeEgwEOTXA
x-host: tde-deliveryengine-production-7c97bc8457-bn8lx
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D173
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPBHdek5TOt-v4ymaoektCA&google_cver=1&google_push=AaAOQGEJ1oxFaG-BbVxyP4AcT9EihqKQhmUAKGyx6GhIF3sKGNMExKu43i6JqeV6wr6EEH-W13CPmajb...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njc3MDA5ODE4NjM3MTAyODM2MA&google_push=AaAOQGEJ1oxFaG-BbVxyP4AcT9EihqKQhmUAKGyx6GhIF3sKGNMExKu43i6JqeV6wr6EEH-W13CPma...

170 B
188 B

29ms
29ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njc3MDA5ODE4NjM3MTAyODM2MA&google_push=AaAOQGEJ1oxFaG-BbVxyP4AcT9EihqKQhmUAKGyx6GhIF3sKGNMExKu43i6JqeV6wr6EEH-W13CPmajb1UjXgNhXC34PtKKWomIXFQ

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njc3MDA5ODE4NjM3MTAyODM2MA&google_push=AaAOQGEJ1oxFaG-BbVxyP4AcT9EihqKQhmUAKGyx6GhIF3sKGNMExKu43i6JqeV6wr6EEH-W13CPmajb1UjXgNhXC34PtKKWomIXFQ
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D173
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJG8jtecGmKS7T9lT9mFqY4&google_cver=1&google_push=AaAOQGEoL2-0u78mypMxDnmxvKFjFH5BAZldXPaeLKLrdAi5Qc_sTetFbAUQbXpoY_lzscVLoNtFvX3uxTB5...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AaAOQGEoL2-0u78mypMxDnmxvKFjFH5BAZldXPaeLKLrdAi5Qc_sTetFbAUQbXpoY_lzscVLoNtFvX3uxTB5IX6P4hRXa5ZIKrOjhA

170 B
188 B

33ms
33ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AaAOQGEoL2-0u78mypMxDnmxvKFjFH5BAZldXPaeLKLrdAi5Qc_sTetFbAUQbXpoY_lzscVLoNtFvX3uxTB5IX6P4hRXa5ZIKrOjhA

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AaAOQGEoL2-0u78mypMxDnmxvKFjFH5BAZldXPaeLKLrdAi5Qc_sTetFbAUQbXpoY_lzscVLoNtFvX3uxTB5IX6P4hRXa5ZIKrOjhA
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D173 0
12 B 30ms
28ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IENeiE4QmfWfB4fbznA2dWPYHD6AFW0kAjkGfuy7mz0H5lRYQMn1z_Ooy4LpYgBxd0QIac

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 89D3 22 KB
8 KB 31ms
21ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 490307
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame 82EC 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35975
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 02 Jul 2024 13:22:45 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame B9BE 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35975
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 02 Jul 2024 13:22:45 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame A139 37 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35975
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 02 Jul 2024 13:22:45 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame D8E2 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35975
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 02 Jul 2024 13:22:45 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame BD0E 0
0 63ms
63ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuW3h1y6KBjf6MVE-ZWKxX2Oqu_OTYPUyJYvBjNtCnuM3KkS7XNQTddJ5AS5cEUO7WIGNhnQXUBIOskSTdzd-u35Kxxcfv4-ITyWPv1xDhP17Rkrg-PV6_quWvCbS-QeuqulVpT9LeywuryE6Fe_o0TVKMSCOpV-Su8zF3nccVjktmE6_a2WfVlqF-jZ9yW1kvghiYYM4uVJNHnhj-pq-oJa2uzy1uv2MRjV43SmcEbWHx7tEi6xpUA1a8U-l-GiGArhPIisyFLdiIOzLrLXEmPLmW0CA4wSzwMPCkNeLKTMow6R7pwuL_fc9Co8jCgPss9dlYi_oxtpDRpvR6w7g0SaLffiqf0ANOen6EF8pkMzlBQ0L6IR_sfW0w43KL0a914VAuDsuEB1JPFJrbeJ_BMEQB5FwDhDgbzGlBY9P9v64v3ObT60Cpn1WS-UoMLBh9v4GH5t--ObKXfIQ7sQToHn4B67BpTA0tyL0JMH6kBPEFG_mfQW4DPtO2g2cyM7Y8W90PVaeUXs0KOaHa61LsEVrJh1aMgVblmLFQBpJtSJl4Fnc7PNYYxItXb3_uu6EdCB0cNsYm3fquo_Dq9HbRM_Zquxot9NDF--rWgqCRlMkFYgfflSF26idYSzOdZjgS9tAXj7ox8H_llv3Ug0sMERICDnjk5oarThXy5JCdWG14fWPnnm6M_MU-VU0PGsghPNgzNrmTnY7vMjyOmxIIqEyb0nESGHCa5wji9pSEhUZJDyV1WdrMcQWrQhssimA7IEjpjwXyJgftys2M7gWhE4ov_BF7ECIFiaXJojJWmGvZw2Zm1jo3ozR1VhjAoYbOBJ9j8xeeVw2uvZJmshtLozFNEojlmSjBLazEEtOUCDSO-1oHMzekOcjUzM-v38Lti5AuvXSxqyBtgz5SLAECq59rEDt3vnwgrrwQf1rQDot4jxmoJcvMeoSGQgMyqoxzqo9GrWKDziaveEi14DKv2sjUaO17_WGAbSdlZyjvwiW6TQ3Gm75W98DmngXnjdabGo4dTbR0lo1jq4CSMse9O4Rfx44o5usePA3R_BmKJMDIPpeczB66_78xh97-Nk-tQchxq3_R9Oq94XK-ku-ZOm_2Gg7oztY6K_ZU_wFtGRgDLNR4lMQPg65N_wTOFsdPBMxPvzTzSj78ObZBBM5Bi5f3gckE9M_Rtg2mhsQEy1T41clA9jEIYXmRPtsIksGvO2u2qeoPdPX2QeZ3UXWvn84mUJSOQtxTtPBfLwasp2Ydx3ljnm9Zb6NLdnBe5Kh_1cw8zucUcsQPk2hH24XjuVpFVD-vwnCkITCV164H9NxFL2YX_ZOB0IQtnMWen6g&sai=AMfl-YSSALDRpa-AgRaawLzED2rS0GWiCu8vqA9W8GTEqjcYNr_CHhxv5rFW58O_dfQwkgk4iYqbk1SXbGWNdKb8lMU8nF0l9pNGeMiZ7XDmh7i2unI71le3419FRceU1SJcWb6MqwUHtzJpqTPo9IPuUAIoWaca2NzkuzSyVSFv2_3J5nR13ltNnzimVctjzXsXgpNgiM8iK-3amfmCr2Uscpo2BSG0nMO6VZhbCOsIoa6TPpbZIpwIgEuGSuMiaCmIJv6w&sig=Cg0ArKJSzKk2S6GSAzW9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=517&vt=11&dtpt=222&dett=3&cstd=287&cisv=r20230627.35103&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4E3E 0
0 59ms
59ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvKeozqlTlw9bUUWHS3JV8L19K-BIWYeUyLHQxuwmtilUkT_ebPwmrtFs9Ed4IviuHzULjwSTih2NXaYYXnmok63HS2u254nyRMbzFimVyHK8iZD78ip_7YQuHxbSVpcvMjpLzgR2RjYaS3ZRSJv_0waULWKDdUI3gqe1rvSl4h1HpHlAgAaB8mSGPbcmKHxUAVxGy9vi5XI2Vi2Rzty38hheVClmwC02disg_rWM428KVVpMP8-ZEGRCjSHInrQlMu5PQT5QDOaA-WCi0vuSoddsS3LovCUqwCb0ooZ3sbsDfuIUlJcY-Z7Bgh73UBrdCswjFtg9tnS9wS_wskWNwEVgqtVuGSjuglq3JhS9LiXN2ipdOGPwGvdYIBiBy4boB8zweafmkvLUCOFLDvKezMgh80cN-uli23OaSLAhBjUoAMR6mc7QqYJvIKdljkvfGsZ3tEmPP2i99Gu_UtMqE4EkLy1MoafFjRsFGE9YTL3zJ4NTm1Sm2_t1culQoidXhK22uBrwNJdZjFE_P_1MBq6HuRrPiTss8HkaWlpfH3ErwWNHImz8S8Qb9b0C99vSCadKNF13gElsY6GDj9ZAIYtzqzDrvsCYPe1rs_uSCyWj1z32aFcT6FBAm0VMSfvC4vABPPkRGKeDxbvbAX2FFX06m6sSON7hIy1kOCFdMbhVFsAJPzVKKuRVCOonmKi987SEw_Lq0yorq_mMktFXNonYGVd1C1WopBLWq_A3k2EaqJ9KHRK6_Bliu2A3SWWA_dDabDJ5q9NRKb6-MBM9P-vSK8GzJbi6baIGSD7Qk2U4SK9Jf99a_1fXJEEE-O2m9uO_2QzNkz85dM8VIKrumGLIqsWLx9B2AMpl2SSNkUldPdX9zfy9ITWL1VjzNHxVpQo8gmdmtPdxBCBhUsL8UQf8zg3LIcxUXdgfhKYjFDutlwdXIHSbnedn9Nq3ztPOYMWe3LqCzgPv2WWFmlaiwscelQ4iyoXRsl9nwFWUlBCAUAzezKhE7OmtFNRr_5JQfKx8mT_CB2_PNkF3_9tP28ZrFwHMb-76H0PadwZbSlM-1GiIkCT9GBDtjM7mgrzJDZPZqXo_YBC-PHBnd4DdI8xjbj8aL7LIRfA4X04oIOiMEJT9MFSG2wHjYmMsh7UjezvzGh8S5_YtlbAR1-YtfX-RCCzVVoxQqZZXrWMoxhlr-iGJ_Ev8XYiiTVIXp8fYIEk6Gxo_mymGycAbnFpaPzvlz77FWvcLp-W9g4thRX_DXA1Vhbs5EbTkhRLkasPPD5n-4LJoq6GEQfRjuRPvrys4pcIak5J9OQOXa_NsXPXIceQaySIU11UoVVS4KkoVUQgBeP&sai=AMfl-YQaLDkIL-VOv2sLuu7slg5Io9MuhP3GzxOJQsNAgosJ2XxPbI0SHfon-oq9Ory9gEdJIsbtOsoHOZGdWs0VBPX6c-wKvRzhqwZUy17nVD9ZaKjh17YYSnsHmFNZuax6Nzi-MfKOJuDUslz_Ri5rn7ygQDUfyiyg67lJGLVMCX8F4H2WiB_PHHD7qZvH9A9BXzGjA4cU2Yk6y3zQYQWa860RvGyqwRi2Bb7iXgmPb6OWu8cC2kbIi0Aq3q7k7bNDGc1zaxHaa5Iv7wYsIivkDQ-n7K-eYw&sig=Cg0ArKJSzFKJdbU0QHJbEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=491&vt=11&dtpt=174&dett=3&cstd=310&cisv=r20230627.64935&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame 87E2 3 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1b2da575466eb30982e08c1020f55bcf2d9565f53bd64c3da87a1d774d75588

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:14:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1100
x-xss-protection: 0
last-modified: Fri, 05 May 2023 10:07:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:29:04 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 87E2 7 KB
6 KB 33ms
33ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b8d5c77579e596fe9e7d9870d0ab37622156e398013a4c5bbc2c8e0fe5065ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5647
x-xss-protection: 0

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 3D99 118 KB
40 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pkb3bN1ecC&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pkb3bN1ecC&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 13:52:36 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 3D99 63 KB
25 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pkb3bN1ecC&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pkb3bN1ecC&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:22:20 GMT

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 1F23 47 KB
47 KB 24ms
24ms Font
font/woff2 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:21:00 GMT
x-content-type-options: nosniff
age: 81
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:36:00 GMT

GET
H3 200 OnAir-Light.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 1F23 46 KB
46 KB 22ms
22ms Font
font/woff2 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Light.woff2

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:15:54 GMT
x-content-type-options: nosniff
age: 387
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46936
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:30:54 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 1F23 7 KB
6 KB 34ms
34ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1bea3c06c005c05171e18488ecd431e85ea27fbdb590af84e2e204be03e8912f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5765
x-xss-protection: 0

GET
H3 200 60005582_20230517070143234_APP_iPhone_14_Pro_Max_iPad.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 1F23 21 KB
21 KB 27ms
26ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20230517070143234_APP_iPhone_14_Pro_Max_iPad.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be0b42eaf9393a841a0a6721b822b92d4b8406b2272e37f9cabe9d7108de1b27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 08:09:21 GMT
x-content-type-options: nosniff
age: 54780
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21865
x-xss-protection: 0
last-modified: Wed, 17 May 2023 14:01:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 08:09:21 GMT

GET
H3 200 60005582_20220825085202338_728x090_BG.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 1F23 30 KB
30 KB 28ms
27ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220825085202338_728x090_BG.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5bfdb5e4886a5d739b60e2a8938706714242d4e9a68cb77281630a3e518faad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 19:13:01 GMT
x-content-type-options: nosniff
age: 14960
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30980
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 15:52:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 19:13:01 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 1F23 43 B
608 B 110ms
32ms Image
image/gif 141.101.90.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14114_PV&mediacode=29118705_4307561_355027444_145341330_PO1603A20230606&ref=29118705_4307561_355027444_145341330_PO1603A20230606
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.101.90.98 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 23:22:21 GMT
via: 1.1 varnish-live-2-0
CF-Cache-Status: HIT
age: 6417650
x-cache: MISS
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: keep-alive
Content-Length: 43
last-modified: Wed, 22 Mar 2023 08:05:14 GMT
Server: cloudflare
etag: "2b-5f7789eafa280"
Vary: Accept-Encoding
Content-Type: image/gif
x-varnish: 40418697
cache-control: public, max-age=31536000
Accept-Ranges: bytes
CF-RAY: 7e12deba1df69944-FRA
Expires: Tue, 02 Jul 2024 23:22:21 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 87E2 17 KB
6 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Jul 2023 23:22:21 GMT

GET
H3 200 160x600_de-de_performance.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame 87E2 62 KB
17 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf035fa0bfc989035b3a60bd3384033c03a80a1ba4103a81d20e0bd053301e9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=3xgDCnQV4x&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:17:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17856
x-xss-protection: 0
last-modified: Tue, 28 Mar 2023 08:23:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:32:56 GMT

GET
H3 200 bubblespritesheettiny.png
s0.2mdn.net/creatives/assets/4085730/ Frame 1F23 26 KB
26 KB 20ms
20ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4085730/bubblespritesheettiny.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=FsfqMD376i&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:08:09 GMT
x-content-type-options: nosniff
age: 852
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27068
x-xss-protection: 0
last-modified: Fri, 12 Mar 2021 15:44:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:23:09 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 1F23 17 KB
6 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Jul 2023 23:22:21 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4F5C 0
0 63ms
63ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss5Xg7GrbQdTDc2i5CD8xv_eu6mr95Kyy2aIXjtxHpT7DeXfFdfPd-tHgMBVhHUIUMrEXwpXukEFE7r5qVWZXbQ3VOWoQes9rEsWSKk7kfRXhLurcLArK6dw-XPogDXPcdQ-2RRXB3Gv46kn_GUwZpoc0c6kv10DuU3w824JdkHWVYYThWVeQtm-vU3ugabGOOf-d9pBOmgrBgC6Mw3P3USOwMFqu4Bv1V1UKpmlKE7toUIa_pb3ggdqETiMmy2Q7zv1xPL4-Ul_ekg-IyvQyPZIJHa2hOaBmQ6gUgBAKjiQ5sHFkpm5_ThvP9hCHL83k9u4_ZbV1KADHdpA_9qzxJnd0w5NbjjfKqU1UVABwsFAACY8n5m-N5qcQTkBbd5TfBp6c2o2wkGEbrfuI6DItCTNvsWH-r73nmISMSuTd-arpLWBd5Je4K7V2PEgF8xaYmCj6l_5m2RleSYm9nKJhG6y6S6nA-HRTYi4H0Qx4vq9hzaLhocRW1KWp-YB0dPHaKkw7m7gG6gvvglpp6B1-2ijjw8HVnEyC6otiVLnM56hn1Pj8fzCWAjhQoG3gzZ_EssX7xmo9_xbaAvkY2Klsc1MoPmC0T2S1I0-jK8_ewVvP2_9O4pVUuTNuSoomeQowTQlR55KYiFdtfyOSPgc0EH4S-LQulGZC1BUEJ4OdhPT8S4hWlzeaE_iB7Jmf3UZiaACkWWlMZdnBOjn1-aA1i7AnRsO7MeLz9dRvdIpj3svt6BTVSXeWtnOMEla2FkaZy9gyrIfU4_5qkWsGt9wQb1u5is371Xyq7oBbeICNCYZ-meeMC_HoZ_WNsplxyRrHEUpWxh8QB3HgboCznS-dpnVrB-3cBDQie7Z2qNoYvrMqbpP6IECrbF-HMcLfaBHm8UO7ZyNIZySWzIM0gnkV-kq2W6zunu2hpSPB9uUni7F9yHvKeUYEhuUyImD64_az5geS1KE4CHpiNF-tPTcl4cNOl2Kyt6XxffE_8ulv5gyO8JTYuolG6o22C3qULsD6l8NcuiMgjH6BM-4C4kJNNhtgXc3DRZ-_F4hKnhHBSltzliWO59WNqU0QslMBIGFVFPUbsJ9DzCO5i009-Kvy7xdAzs9zaq7btrw3E1AJjC4YN4Cg1HeIrnOGss6VeguzAj32qcI40gf1Jo8CDbKk5hAv0gt-XJKrYg9O3rrVxb6bRpxKrps-j9oRxX-UBNYwCVaIki-ISASzg0k7OzZ18ZXKMOgufppJXEu16uDkGpsMXxeMj4e871-FxyTJ-60LDrGcub4sMDYOuj-fRcddPXvk3T5dWGaG8E4slpg9zcR4XC41B-D8NQuxQVOlF8qDE&sai=AMfl-YQLDMOvULDelpV9Zzqre-a9sAlx6-ZmOXbxkBPdmgEqry37fCCaKJ_VbPd2gyWDAhUPkZxAfuEax0AC2R3bemP6bb8asvCOaDNQfqC1MuNY0ZnZzmBoHBXbQwpmsEJ21L7rIBOGPwJBWJLgXE_0QfGKE_aHx1CeKtNCSF6GhqMMTawFd3dAT3qYS5DrtEPlKsEd9ZUW6dmmWZ1LjNK28tI0wifVkCV-IvTDEjdlM9AHX2j2MpRQWaJBuYGGFVvP2NVirhUxqaGm80F-24MZmDhBCB-5&sig=Cg0ArKJSzC-hS2PTqPOeEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=660&vt=11&dtpt=384&dett=3&cstd=270&cisv=r20230627.29863&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 03 Jul 2023 23:22:21 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame 89D3 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35976
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 02 Jul 2024 13:22:45 GMT

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 545D 47 KB
47 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:21:00 GMT
x-content-type-options: nosniff
age: 81
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:36:00 GMT

GET
H3 200 OnAir-Light.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 545D 46 KB
46 KB 22ms
22ms Font
font/woff2 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Light.woff2

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:15:54 GMT
x-content-type-options: nosniff
age: 387
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46936
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:30:54 GMT

GET
H3 200 60005582_20220825085202338_728x090_BG.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 545D 30 KB
30 KB 25ms
25ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220825085202338_728x090_BG.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5bfdb5e4886a5d739b60e2a8938706714242d4e9a68cb77281630a3e518faad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 19:13:01 GMT
x-content-type-options: nosniff
age: 14960
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30980
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 15:52:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 19:13:01 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 545D 7 KB
6 KB 32ms
32ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

976f694b0092a5da0d96b868161ac04362c5bb895066629173bee8b56deb18ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5701
x-xss-protection: 0

GET
H3 200 60005582_20210507060843268_Asset_Transparent.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 545D 2 KB
2 KB 26ms
26ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210507060843268_Asset_Transparent.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f741883eafc84067b80014e53fbfab2505aca4f7cf767b17404a291fffb79d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 18:42:46 GMT
x-content-type-options: nosniff
age: 16775
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2040
x-xss-protection: 0
last-modified: Fri, 07 May 2021 13:08:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 18:42:46 GMT

GET
H3 200 60005582_20230412024536330_o2_homespot_5G_ASSET.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 545D 33 KB
33 KB 28ms
28ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20230412024536330_o2_homespot_5G_ASSET.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

549667bd2dc0f6f1bb069fbe4151ebf664f6167be869d8b83032c0019a6e00e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 22:43:11 GMT
x-content-type-options: nosniff
age: 2350
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33586
x-xss-protection: 0
last-modified: Wed, 12 Apr 2023 09:45:36 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 22:43:11 GMT

GET
H3 200 60005582_20230413245535820_728x090_LOOK-01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 545D 41 KB
41 KB 29ms
29ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20230413245535820_728x090_LOOK-01.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6340ab066c8cd3fc0ff1e47b254690638b7481954f793601c5602be5c7692f8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17952959967271059456/728x090.html?e=69&leftOffset=0&topOffset=0&c=pFym5rkm9m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sun, 02 Jul 2023 23:57:42 GMT
x-content-type-options: nosniff
age: 84279
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42135
x-xss-protection: 0
last-modified: Thu, 13 Apr 2023 07:55:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 23:57:42 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 545D 43 B
608 B 31ms
31ms Image
image/gif 141.101.90.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14114_PV&mediacode=29115794_4307561_354697130_145341330_HSP0203A20230413&ref=29115794_4307561_354697130_145341330_HSP0203A20230413
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.101.90.98 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 23:22:21 GMT
via: 1.1 varnish-live-2-0
CF-Cache-Status: HIT
age: 6417650
x-cache: MISS
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: keep-alive
Content-Length: 43
last-modified: Wed, 22 Mar 2023 08:05:14 GMT
Server: cloudflare
etag: "2b-5f7789eafa280"
Vary: Accept-Encoding
Content-Type: image/gif
x-varnish: 40418697
cache-control: public, max-age=31536000
Accept-Ranges: bytes
CF-RAY: 7e12debabeb79944-FRA
Expires: Tue, 02 Jul 2024 23:22:21 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 48DC 0
0 57ms
57ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssE9expMB_hxO55hAkFXfacYv7lL38CkwqibmcJ0WTkiRo9rEKeZ6ggO5XTzvTa2fAd98AWze0dJQ0t6jWizA8aajfCF4wxF7FpwsL0wT4l_yvKRH9IOPW-26F1q-TuduOrFvnfd0GCs6v93T_WMkp0L7H8jlrQFcmbCqT-ohHNqT_QLYi-nJwGqHiboz6JgabfHq5WEYtZi-_e2SvereboGememsq4VgPo8n5MyDCnq9Fg4wp-49F0WL1SNe9EOGNAPGPycs4rBpAW4w6JlGMWaqSUuMp2OjFfxKSDCTTlCDnSVUapBp-v0BdD7MEkq1_hs02qpTd8RvIoEkYHNIFQk-FqH3VEXzZc9sl__nLEzp5gzGE29HswKbd5gSr7Mh0Kx0wC5o1dineDttYUON4IOgfbA9v7qiyb3ywyNdI6_MT_h5-kQkEtwTZ2k5o014wT0btVHTRjxuwkzk-Q__xa3KccMwEDLnpCN17HkavaC3DzjA-yR4PxVKHicR6rY4xLkMoL7pMWaaIo2rmYCXdPFFMCLPC9nJ8NX8PPVau7Zljmbd2hZTFZ4JL1cT3yUsYCLZNZuCMGSWdtq7Rqyv3x4mQFWX4925YdOdPDHusx7SHatLG5UWq_tEpNZqYLHq_63arQGFET_rwl4UfMZokf9piJQp8g1y5QxbY5xRVMuMfRBWjrRNEDr5I5Pau1QLpqgTsBloVKQpMSWMcrvG4sVfHdlfw4i8POPBL3_0T_LxfBLFd7KREE357Vcx6eZIMvLxYHkB794_LHWAZwZ6LbR9PMkWRNG-sOFgKBk89GtkIU6wbc2NAzFmFvTm-EUBF75NDWdBnLp1Ybi2iU8dXf_Tc4QsCKZ0C_YVhMo5PPMDtGoq1Av6YXg7tTWnV6f2Ui1XsVOUKgQvn7ayFGR19bd5zyCO1Ak1z2Pob2Lo4xD4-zLTpayw3PmBwI9kRm2-KfWBtpn178GJK0Z8Hi1WLABKtDoqY3Be-7_sTqleiTojZhD8P6TFeB6_BL49FevyvKMFrzhhWobKwxtXCHgYpDdGj9vy1a1wWo3H0A5uKghcEyEu5EceHXQyGMgkHPh8czdc8xEnivoyQohx3gRcrqZxkavQiWkryE_oF3xmsH3wjBm7EJPvcGNGYflNFtYg3Ll3CrsRWAlMGmItE7agB2kBi6Q76oDI6NeiSqc6vmHJYg4DwHICVKwgb9E23tWfsO-HgxzfQa5PlN6B0iPj1qWcvq6VfUtfbplvISndKq6iuNBFRohzRoCzBXFxIo7PJ0xNQi_gcRq88ViuWyz0UfvRYyEnX44D48jXwvrt9mLcCff16hei1cL52SYpUfynNIZ352zQ&sai=AMfl-YRdBWZC_n1iD8oOlWTnOsnGF6kYtz2QJzbZSo8z060Dl5ZRh0-mdOIDXUE9prUUY4TPNrkQDMaRUc0Xs6TlQikksu1A3lmvzhWfvmarks5nMT5hhh-YVr6T7edIRTZjCmjsQ7wmfixKidYQf2OD327qUm1XpVsQMgO9A_0XXuiHgp-2J2DD3KmxoVvAHvpXFskGxWQEH_9gPVuJ6gI_QWw-T0s9FhWW3fPt&sig=Cg0ArKJSzEjPuNI1g3TYEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=613&vt=11&dtpt=416&dett=3&cstd=190&cisv=r20230627.77239&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 03 Jul 2023 23:22:21 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C62D 0
0 105ms
61ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPo9AXJ6VEkPoqEspyn4LNkBnHJKN9alKqfx5gkplxjyznXQ_6tAdFnNjsLkH0iEYRV64h0gLs4WFA7-JX-p274gARI5Dn7ovdSDxfHgt3WyMnPGdQMZTYYvjCK7MqzVwIgwHV7UVGRE5QJhU7m1NsGJDW3oFBCy8MwRMWaJXGEFlIa_IaJp285ikVXtOSjJzZJEm5D9UUwAzuRgW1xPQtynbC1HrHkJ_fKJI7TXEJtS6N5bwh7gK7bgFQ3JWcQBJPxfZYP7vgjoRBM5l8qiYS5GrFZWbzo1cgU-1amXjXz6EVS3bGzNsgsxIInFcN0B7_sNRDIuuWmL6Gl6As9HokMEdeQC3LuumUGqNd4IUwxM6H108b9U05Y0M2&sai=AMfl-YSPaKfDBw1l3CMP1X_5U9zxIraCDUg9Bze7oL2qsUpSU1NLheZbaHynrfAGHn6q548Xg8mQfKb1naYTg_6brPXYRugbAzmskmYD52e8pXE&sig=Cg0ArKJSzKkzcjB-Vu2YEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 03 Jul 2023 23:22:21 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C62D 15 KB
11 KB 37ms
36ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230627&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5926dc86153ba45fbda848e74a4e24a64b5e605efc2701e27c13a2efe32f1d9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2a0c1ca77848f15e04df038fbfe17bc2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 23:22:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11413
x-xss-protection: 0

GET
H2 200 5ed76f76e4b07a92411bc03a
ng2.virgul.com/tck/imp/ Frame CD6E 0
209 B 61ms
61ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed76f76e4b07a92411bc03a?g=1&t=gb&r=153377@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1688426539085&userId=vnet6c8dc43f-05f2-4af8-b887-1ac62d79bed6
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 03 Jul 2023 23:22:21 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame 9E04 37 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 03 Jul 2023 13:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35976
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 02 Jul 2024 13:22:45 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 629F 0
0 62ms
62ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstq7kgbEyz6cLqHDDC3yE-prwRzUbxbV0njeZk_a4z5TlZwsmXoTv8jPaX_jN6ebAoEhPv2_aXPCQVuSxklgKefdUhN_allcRaoPhz7LSkiIxAf5zGv6gysG7xyTsUTCU3af7uyIwRb8t3EmUyKlKI_16uY4VAsU4ol1l9UITqBx0PELJaGTcls310j3SC9igTsu1N3BDe7FOfR7xuWhKUR7yKysrzEe-NAKrEfq86DKA3CCNmEEgiG-MEcuj2Ub7pRJfTR0eI6vlrdc4Fe3kV4BBI5BfHk9mf_jGA_6giLqUyXpOI0pvPj6DtgRoMR5sf86O5FtAXbqZqJQ5T4ZjlZQqz0Pi282QTx6e3d3WgI5c6JfnIfqfilm8daLfaUxggYwJ3NkiOT_DX1RECw36Fy7C-wfuczZcYMjGOoMAGMwds5d_dmE2nTptjODpQ2BsCg_nEF5SGyfKjBU8pke_XNbo8tG-MrGS5PkiMTKJF5JzwBnT_7y0gYVAkNmK6579LSeQUH-PhZuZ29EVkuqDonMeW2q8tAWWLkIFnQVHIKWl4idB_am_S57d8InIcNi9oqpKN_IeuyYl9s69S3K587KkTTEI2R4Cy4Vqgimn_f_X-eHSMYOXQ588oVUVcm2FGlSx8Q9A1TXwBwEPDaPFKpaouf15YJl6yhz2KzrFSIEVK8mDSvwcGDI1gEo29GzBOBob5TS5xd0LQ1xcGkjKQVsdlC-VV-6ht7L3IVFDEjXN-ACCMxIyeJMxV8HaCx1dXq3_zajhNKkdndJEHTsFsxXyO3iXw_7fyHpruTIwG6HAfx5W3uBWV6zxMEDD3KXEPZfcFPQMd5JXAFLBraUYeqkC5ngtZS9iKWBLgJVekpVl-3in8Ldm45EBr77EQ286xPvBRuqK68LxCNfWMQfuc-w9Joxtc9VqwKhZzJCaVNgkkcDVq0LPZdNaYy8nUPx5oOLNwweSNEXnq2KmAwlxJ0vOlT2waWcG3HwPfnXpTKbWtyi_CgYI5UJFpRNILR8n4f5Qd5qLWjP3FtoXXBsO68axYkgVtbv6HN9682deyKM1S_x3mF689DZdmetrVvNnzDdJKfaFLAVDihaZfakYlz0xBEHG9VpTTg8rBc4wZDddq9cPff1WT3j1JWk2D1nff6R9Agw8DnYhsYHCT0IvAu4BW7oiL8BmuxEyJdbBlZiQg1lz-DZBl9cJhZtgsR51r1mOzSYkb_r3O2b9JUf-jqEyxuGemQpwGJRVQpyVSGCszGUo-qz80QabzkNwp0CyFrLyU5PKvw0SKUcfJZF2Z2eSX7KubrRA&sai=AMfl-YT055JMW3-Zwm3efuMvGwUc4rtK8UTxu32Ql1PTc2YrWxUJwvoSFRpaK557tqeN0KDRRprPhHxpfge6KfkhZwlnDfK6GchKrOR4Mm92dJZULq-wN9vSm7_iZxnyi1UY2pKLIZC08OLCmRCC2FWMNIokzZbuEoDthpaDPc29l0j_aZ10fk3SBfY1FT7_CR4nMiGSRh33mfWM49XnKcnuebYVBstIdLbVx59tq36TmEGHdpFZE0iweMSj8RXgxLNzDaHG&sig=Cg0ArKJSzJKtXjcgPDQ8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=864&vt=11&dtpt=622&dett=3&cstd=240&cisv=r20230627.05389&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS