simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:43 GMT
an-x-request-uuid: 255a83aa-5bef-4031-8fee-19eb03e6301b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
362 B 107ms
33ms Fetch
application/json 35.157.220.244
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.220.244 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-220-244.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1546a4c7394e13c594ea91a8ccd219148f7ae5208ec39ad331c177426077acea

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 21 Nov 2023 15:00:43 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
544 B 85ms
56ms Fetch
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=949296
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2840bfd7e2bdcce4e21fd826d8bb84f797bfac6ca9b9c36e710df786621c21b

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iQMiBDQsfKyOhI57M662FgKVNBPuQRcj2jW5MAFzhFgACdnuuH6vABg9bHUNQ4Hwt0dC%2BLyYZKyUua%2FIDhOfDLycQH9urqud62vRzlVBpPIQOYFBWGSBX%2ByOYzMFNWS6iAJJ43PP"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8299cdce683b9018-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 204 pb Show response
ad.360yield.com/1914/ 0
165 B 136ms
42ms Fetch 52.215.9.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/1914/pb
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.215.9.120 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-9-120.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:43 GMT
access-control-allow-credentials: true
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
166 B 80ms
15ms Fetch 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

x-nbr: 1
date: Tue, 21 Nov 2023 15:00:43 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
408 B 60ms
17ms Fetch
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://simcast.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
190 B 92ms
43ms Fetch 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.21.0&cb=41178921860&lsavail=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:43 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
377 B 101ms
43ms Fetch
application/json 184.30.21.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-51.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:43 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Tue, 21 Nov 2023 15:00:43 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 2 KB
2 KB 183ms
122ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 40117e4f8a37a9b87036ba4086a6f2a7069d24afd74bae2531d473eb803de3b2

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:43 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 94
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:43 GMT

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 10 KB
1 KB 1089ms
875ms Fetch
application/json 2607:4f00:944:0:3eec:efff:fed0:86a2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2607:4f00:944:0:3eec:efff:fed0:86a2 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 45d3acc5a2402991917602c9d37ef9135116a6b2152d362dc20736e716ebca85

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 21 Nov 2023 15:00:44 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 1087

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
579 B 28ms
22ms Fetch
application/json 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:43 GMT
an-x-request-uuid: 73f4436d-4fb5-46be-bf1f-fa28a1a6bbeb
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
159 B 59ms
26ms Fetch 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 player-event
events.qortex.ai/api/v1/ Frame A04C 0
0 251ms
208ms Fetch 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QH%2B6rswJ8CTAmPQ425%2BjBRtpxXKtTdpkfV8YD8EPPX6OeO7wpxZjCWx0bdCn9Abie63XppbK%2F5qcQVI2fO1JnJitpDVNz8BGqxpbnR7gms7NJydFR8DDr%2BUDNeMqxafHRTexWLsJI0hM6VFHNHk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdceaed89bdd-FRA
content-length: 0

GET
H2 200 cx-bootstrapper-init Show response
tags.qortex.ai/cxo/ Frame A04C 49 KB
9 KB 26ms
25ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/cx-bootstrapper-init
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ba7e0e72735ea304bac8a43e87c2da1b7ee2d6705e8548a2fde134beb08d7b48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 16
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PdKrAIjtnDqiBDd%2BN8TNoC7TshBi6BoV%2Fe%2FqzROGvF88wGk544JJemzVXTo9HQAJ51nsptI%2Bnp3V%2FanMiywUwZHzWfRODIACCNV7CpKCyMhW3uQN4sv%2FIOuOfwdp9l0%2Bf3aST3%2FtVFxgNIY5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdce6e953737-FRA

GET
H2 200 init-3392tkd9ir9ggbv3f0mu.js Show response
api.fouanalytics.com/api/ Frame A04C 0
513 B 228ms
190ms Script
text/javascript 2606:4700:e4::ac40:a817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.fouanalytics.com/api/init-3392tkd9ir9ggbv3f0mu.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5LJRwEqcNtjZ6fJYn3Xda5CwSABJvKBtMmAc32NXAckRTvpM%2FXaov1dQHbhU3vtcW7pnJEHZ8QrT4xGvE7hcvilG0rTd%2BQyv6LegO5axXRe0FPF8rsKwdwgLvNudpRLYz6zlODV%2FD5Lmnv4gh67gfL0yEw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 8299cdce9c6830e8-FRA
alt-svc: h3=":443"; ma=86400
expires: 0

GET
H2 200 noscript-3392tkd9ir9ggbv3f0mu.gif
api.fouanalytics.com/api/ Frame A04C 0
285 B 229ms
190ms Image
image/gif 2606:4700:e4::ac40:a817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.fouanalytics.com/api/noscript-3392tkd9ir9ggbv3f0mu.gif
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yz4JLGFSnjFBfoWTeaptOLCdjMVsi8RHgy4llPNIZiI%2Bot3yOVoaK5sKuNRNdmDxXAYQWpAn17VDJxsCIesGY2urJpQV9hMwwH1EJtrMMxzK6JeuBm7xljLjbelkzMYSS%2Bt9BQlFThsl00o1nxhBRXqt3w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 8299cdce9c6a30e8-FRA
alt-svc: h3=":443"; ma=86400
expires: 0

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ Frame A04C 54 KB
17 KB 69ms
11ms Script
application/javascript 2.23.78.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.23.78.67 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-78-67.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:43 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Tue, 21 Nov 2023 15:15:43 GMT

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ Frame A04C 55 KB
10 KB 59ms
22ms Script
application/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Requested by: Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ee69abe38a87fd8aa0867401e1e14d2831eab6dfb1bb2d97abf65ac57cb5705

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:43 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 07 Sep 2023 17:31:32 GMT
server: cloudflare
x-amz-request-id: 907JHMEEKQ08DSV2
age: 7053
etag: W/"8bbf05f440008747d4df642e30fc4ddc"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 8299cdcecf949201-FRA
x-amz-id-2: oJpPJCbEID7z1zM9kIxlsqSbq8xeH5HC5gS4xpeHur3SW4yHO8BbtAlQwktjkw9El2h2R0B/Pt0=

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
202 B 22ms
21ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=541329820&t=pageview&_s=1&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fm.foxwebapps.com%2F&ul=en-us&de=UTF-8&dt=Simcast%20News%20portal.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAACAAI~&jid=2018842255&gjid=1160295027&cid=1992606109.1700578844&tid=UA-205158314-1&_gid=251625636.1700578844&_r=1&gtm=457e3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=2133976976

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
250 B 52ms
17ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RFSL1NPH34&gtm=45je3b81v9124667839&_p=1700578842848&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1992606109.1700578844&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&ngs=1&_s=1&sid=1700578843&sct=1&seg=0&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fm.foxwebapps.com%2F&dt=Simcast%20News%20portal.&en=page_view&_fv=1&_ss=1&tfd=2582
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RFSL1NPH34&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 66p353674srn78psn2p22n3843r9q281base.en.vtt
d29xw9s9x32j3w.cloudfront.net/videos/cc_text/ 1 KB
2 KB 22ms
22ms TextTrack
text/vtt 18.66.97.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/cc_text/66p353674srn78psn2p22n3843r9q281base.en.vtt
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-62.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a60609d39bf82a995e473336c7e9c619b9266d03e2c0399b1c313da0d9ffd5aa

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:57:12 GMT
via: 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 213
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 1194
last-modified: Tue, 21 Nov 2023 14:42:24 GMT
server: AmazonS3
etag: "398ae1a9f43361a2d96548058394ea76"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: text/vtt
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
accept-ranges: bytes
x-amz-cf-id: Fas7siPUE7ysDa98k32RTp5Q2e-uULyIf7Gz9DkjqeDvWRltrDrLzA==

GET
H2 200 7469n33r91q891q208nnrn900s70ro36.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 431 B
1007 B 11ms
11ms XHR
application/x-mpegurl 18.66.97.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/7469n33r91q891q208nnrn900s70ro36.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-62.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3a812fcd0baaeac3d222e50597bd2553ae06e529461e0c051136864f6f8d1dbb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:46 GMT
via: 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 119
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 431
last-modified: Tue, 21 Nov 2023 14:42:08 GMT
server: AmazonS3
etag: "78683a9297cd9d01d0237ea403d0da89"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: Nc3pH5RpAiLmqW5RrB5utk2DGhjaRUf82wRAPkgbHCOAgOA7Wx8ayA==

GET
H2 200 pixel;r=1978698505;source=gtm;rf=0;a=p-WFJsXCa9VD158;url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0;ref=http%3A%2F%2Fm.foxwebapps.com%2F;uht=2;fpan=1;fpa=P0-1...
pixel.quantserve.com/ 35 B
371 B 46ms
12ms Image
image/gif 2620:116:800d:21:5ed4:8d5d:fed7:f5ef
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1978698505;source=gtm;rf=0;a=p-WFJsXCa9VD158;url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0;ref=http%3A%2F%2Fm.foxwebapps.com%2F;uht=2;fpan=1;fpa=P0-17239605-1700578843781;pbc=;ns=0;ce=1;qjs=1;qv=6076e8c2-20231114150359;cm=;gdpr=0;d=simcast.com;dst=1;et=1700578844073;tzo=-60;ogl=;ses=cc1e6def-47c7-4276-a4e3-a9c1687926fc;mdl=

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5ed4:8d5d:fed7:f5ef , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 7469n33r91q891q208nnrn900s70ro36-00001.ts Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 489 KB
490 KB 16ms
16ms XHR
video/mp2t 18.66.97.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/7469n33r91q891q208nnrn900s70ro36-00001.ts
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-62.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 001e1ac59295acf0c8c3deb985c98f7e3ebe022bc019800e9270796bf0c138a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:47 GMT
via: 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 118
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 501020
last-modified: Tue, 21 Nov 2023 14:42:07 GMT
server: AmazonS3
etag: "d2c612eae36c11100a2850379ee316c4"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: video/mp2t
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: kb7avR1F8vUUa_E10c4_Buh419ffMJnE03bMhPVAEJRB-Ea3DKvWPA==

GET
H2 200 sync Show response
p2.gcprivacy.com/v2/ 451 B
815 B 120ms
120ms XHR
application/json 34.202.177.146
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p2.gcprivacy.com/v2/sync?pid=Q6CV1VBC&uid=525178f4-3e1f-46da-98ce-ba40685c6a59&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&h=simcast.com&ref=http%3A%2F%2Fm.foxwebapps.com%2F&ids=sharedid%2C525178f4-3e1f-46da-98ce-ba40685c6a59%7C&v=3
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.202.177.146 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-177-146.compute-1.amazonaws.com
Software: /
Resource Hash: d676fc5bb11e59ca89149bda50337565c6b27e850994d903a2bc7f28fe4e147a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Max
content-length: 451

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 18ms
18ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Tue, 21 Nov 2023 15:00:44 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame A04C 19 B
578 B 10ms
9ms XHR
application/json 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-35-157-214-172.eu-central-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
an-x-request-uuid: 5ac815c1-1762-4a70-b625-114d3b254e0a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame A04C 0
109 B 73ms
15ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:42 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame A04C 0
158 B 14ms
14ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame A04C 36 B
338 B 47ms
46ms XHR
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=438214
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acf4dd4f36fa8ee3fc8249c34c643b228850a22d0bba1cfa6329255b210ade8d

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SHQTOWhvf%2FfBQ0%2Bfkz0d%2BVNSQeqfPGapUVbrUUG%2FoxshM9vLmEiYyr1WoYgrSnMK2OGY4SkH3CN2qkoZt6sHw1XfCguokg%2B6Vv39KsRf0JRrOUeJoV%2BWDCflMttybJMAUEWF7N2d"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8299cdd009f29018-FRA
alt-svc: h3=":443"; ma=86400
content-length: 36
expires: 0

POST
H2 204 hb Show response
hb.undertone.com/ Frame A04C 0
516 B 342ms
281ms XHR
text/plain 18.66.97.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=3590&domain=simcast.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-14.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
via: 1.1 03ffca0f67e3596b9a0c92342fe91598.cloudfront.net (CloudFront)
accept-ch: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://simcast.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-amz-cf-id: oOTf_zmSU5KNFjR6U-ToFG8XUPXG1Pa3563LwrPcWr9MsGMRnrO0RA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame A04C 19 B
539 B 56ms
9ms XHR
application/json 35.157.214.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.5.0&referrer=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&tmax=3000

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.157.214.172 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
accept-ch: sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version
x-auction-status: 16
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame A04C 173 B
462 B 98ms
11ms XHR
application/json 69.173.144.137
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.144.137 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 2b8164c2db2fb4e10f795cdb9540180bcb1467c06c62bda03dd63bc9f80d4fc1

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
x-prebid: pbs-java/2.3.0
Content-Type: application/json
access-control-allow-origin: https://simcast.com
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 168
Expires: 0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ Frame A04C 23 B
456 B 91ms
42ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&pr=http%3A%2F%2Fm.foxwebapps.com%2F&pid=q7P9izFd2U77i&cb=0&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22id%22%3A%22standard%22%2C%22mt%22%3A%22v%22%7D%5D&schain=1.0%2C1!stnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%2C1%2C%2C%2C&pubid=6c3f03cd-6fa8-4477-ac05-2c0f4f8da092&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: 7C5B5C7W0DXCBBC11PZM
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 00DIhh-wftJZzCBcwHrJe8ek91rcQle_05dYS3NbfK11QNiNn5m0_g==

OPTIONS
H2 204 health
aegis.anonymised.io/ Frame 0
0 104ms
30ms Preflight
text/html 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://aegis.anonymised.io/health
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: OPTIONS, GET
access-control-allow-origin: https://simcast.com
allow: OPTIONS, GET
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 21 Nov 2023 15:00:44 GMT
server: Google Frontend
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via: 1.1 google
x-cloud-trace-context: 1c6669b2c24cd513f1301e799dbb5254
x-request-id: oNWaHdVKHGkloNyQYiFccPSNtbWashvd

GET
H2 200 health Show response
aegis.anonymised.io/ 2 B
146 B 27ms
27ms Fetch
text/plain 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://aegis.anonymised.io/health
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
x-cloud-trace-context: 5f0f04b607c0715d888ae2e79c8727bb
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
x-request-id: NcKIfFpVKQbVgDWbOplMsNvJBDDIaBsM

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
812 B 24ms
23ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@500;600&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

adb5521f6daa28bf7a2f73decfaa78d1bd4efc45ab6e17eca144c3fcc4ccadba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:52:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:44 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ Frame A04C 96 B
286 B 107ms
107ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=694&sync=0&domain=simcast.com&url=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9d09c8c4015a8913981c3d58725a0513e076b9be5757fba8c0cb4ca0b447366

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 8299cdd18f511c3c-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 160ms
109ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=694&sync=0&domain=simcast.com&url=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8299cdd0de8f1c3c-FRA
content-length: 0
content-type: application/json
date: Tue, 21 Nov 2023 15:00:44 GMT
debug: OPTIONS block
expires: Wed, 20 Nov 2024 15:00:44 GMT
server: cloudflare

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 47 KB
47 KB 18ms
17ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@500;600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 18:16:19 GMT
x-content-type-options: nosniff
age: 420265
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Nov 2024 18:16:19 GMT

GET
H2 200 js Show response
aggle.net/ 202 B
656 B 471ms
153ms Script
text/html 15.197.179.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.197.179.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: 832ecde2a95e0b6b350be4b477050177facd60d8b645a99aef680e64f9132419

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Tue, 21 Nov 2023 15:00:45 GMT
date: Tue, 21 Nov 2023 15:00:44 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 202
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

xandr
p2.gcprivacy.com/v3/id/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fp2.gcprivacy.com%2Fv3%2Fid%2Fxandr%3Fid%3D%24UID%26gcid%3Daf33da23-b168-4cca-9ee6-5ecd3d4a0a74
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fp2.gcprivacy.com%252Fv3%252Fid%252Fxandr%253Fid%253D%2524UID%2526gcid%253Daf33da23-b168-4cca-9ee6-5ecd3d4a0a74
https://p2.gcprivacy.com/v3/id/xandr?id=5200488137446004616&gcid=af33da23-b168-4cca-9ee6-5ecd3d4a0a74

0
37 B

110ms
110ms

Image
text/plain

34.202.177.146
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p2.gcprivacy.com/v3/id/xandr?id=5200488137446004616&gcid=af33da23-b168-4cca-9ee6-5ecd3d4a0a74
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Server: 34.202.177.146 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-177-146.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
an-x-request-uuid: 97e9b73f-3249-4868-9a20-59e39730c032
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://p2.gcprivacy.com/v3/id/xandr?id=5200488137446004616&gcid=af33da23-b168-4cca-9ee6-5ecd3d4a0a74
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 7469n33r91q891q208nnrn900s70ro36.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/ 431 B
1007 B 13ms
13ms XHR
application/x-mpegurl 18.66.97.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/7469n33r91q891q208nnrn900s70ro36.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-62.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4e53cc10c2bf52617941e63de13cb8d45141805428da8a6e1d910c42f09e0f29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:49 GMT
via: 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 116
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 431
last-modified: Tue, 21 Nov 2023 14:41:54 GMT
server: AmazonS3
etag: "d967fb2f0b8e25933b46110c83c2c322"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: EjnJJ2oap3KO6icEv2Fq0rYzPy-KjTX7U3Wfmq7F3mdzXbPcSHUPag==

GET
H2 200 anonymized_small_black.png
storage.googleapis.com/idw_static_assets/ 2 KB
2 KB 63ms
14ms Image
image/png 2a00:1450:4001:82a::201b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/idw_static_assets/anonymized_small_black.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 05adb1a8ab31ced159adf8401bc91d0c28dc75777423ea84358b9565147b5925

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:31 GMT
age: 133
x-guploader-uploadid: ABPtcPqWiDRRp2dRrM8ph31rzB1b8guPJy8BIHrhaFJ_VbeVkpXtvoUS-AZpXI958yXeiHArdf9zjUKfYA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1661
last-modified: Thu, 02 Feb 2023 09:54:23 GMT
server: UploadServer
etag: "d0042077edcb1feff233a5a0e095b327"
x-goog-generation: 1675331663329867
x-goog-hash: crc32c=A2Z1Vg==, md5=0AQgd+3LH+/yM6Wg4JWzJw==
content-type: image/png
cache-control: public,max-age=7890000,no-transform
x-goog-stored-content-length: 1661
accept-ranges: bytes
expires: Tue, 20 Feb 2024 22:38:31 GMT

GET
H3 200 bidderchecker.js Show response
static.anonymised.io/light/ 961 B
418 B 16ms
15ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/bidderchecker.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 722a4121ccf998eefa71a33203ddd5e99a0ba3243c0549cdf7302268fe0ba979

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:52:03 GMT
content-encoding: gzip
age: 521
x-guploader-uploadid: ABPtcPpJ9buZzYjnXW0HbBnAmMDBcVi5JxVm9yxYaX3HNI5-eJ-Jy6qXh-SWI8iHIy_HoMDxCK9Pv4uTRVg5nsJsUiup6A
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 387
last-modified: Wed, 15 Nov 2023 16:44:28 GMT
server: UploadServer
etag: "2b75ac851c96912eb29abd4d1a361694"
vary: Accept-Encoding
x-goog-generation: 1700066667964158
x-goog-hash: crc32c=UACcsw==, md5=K3WshRyWkS6ymr1NGjYWlA==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 387
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 21 Nov 2023 15:12:03 GMT

GET
H3 200 timeme.min.js Show response
cdnjs.cloudflare.com/ajax/libs/TimeMe.js/2.0.0/ 6 KB
2 KB 18ms
18ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/TimeMe.js/2.0.0/timeme.min.js

Requested by

Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5725f04fd1f8882b1d02561933d648bb1a91349b0f33031e78ce0668d3751db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 14961804
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1532
last-modified: Mon, 04 May 2020 16:04:02 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf2-163a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tc1fitwBu7lqr9asgVihos%2BhN2Tl2jOFh0IfBS13xcdiSEGVpnVgthG5K2%2BoVYnAyokzPzlhvrHqJ3oLrBEiSoT%2BI9YZyKsN9xy2ExznpjAnHy3SEXldnZhTWeCaChrhfJzbpnTKZ%2FyB27NWwqw90Igj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8299cdd11e3e5c9e-FRA
expires: Sun, 10 Nov 2024 15:00:44 GMT

GET
H2 200 694 Show response
a.ad.gt/api/v1/u/matches/ Frame A04C 12 KB
4 KB 63ms
22ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/694?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d5e6b9486d3915595b7aef5f16bcb46497ac15655b152bad557117dbbc5745d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 21 Nov 2023 14:58:27 GMT
server: cloudflare
age: 137
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 8299cdd27e17193c-FRA

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 101ms
101ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=E0HoXq3lFu9UkFXT&instance=214701602&version=7.26.0&age=231121&ldt=BIDS&key=jmgEr5Ik&c_id=12018&seq=1&order=5&vIndex=0&absoluteTime=3099.4&relativeTime=1283.8&sm_id=3188399&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=8783&load=1&status=LVFNLNIY&ac_id=2008&bidIndex=1&prebid.cid=0&prebid.bidders.appnexus.time=82.1&prebid.bidders.pubmatic.time=97&prebid.bidders.unruly.time=100.4&prebid.bidders.ix.time=100.2&prebid.bidders.undertone.time=345.4&prebid.bidders.triplelift.time=96.8&prebid.bidders.rubicon.time=116&prebid.start=2740.1&prebid.time=358.1&prebid.timeout=3000&adIndex=-1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 483E 156 B
145 B 271ms
239ms XHR
text/xml 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F92056281%2Fsimcast.com-premium&sz=480x270&ciu_szs=300x60&cust_params=sessionKey%3D214701602-E0HoXq3lFu9UkFXT%26schain%3Dstnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DjmgEr5Ik%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.26.0%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D19%26uhr%3D16%26us_privacy%3Dfalse%26keywchk%3Dok&url=https%3A%2F%2Fsimcast.com%2F&unviewed_position_start=1&output=xml_vast4&env=vp&gdfp_req=1&ad_rule=0&video_url_to_fetch=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&ppos=1&lip=true&min_ad_duration=0&max_ad_duration=250000&vrid=1263268&us_privacy=false&hl=en&cmsid=2631244&plcmt=2&vconp=2&video_doc_id=3188399&vpa=auto&vpmute=1&cnc=22632072816&kfa=0&tfcd=0&sdkv=h.3.605.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&u_so=l&ctv=0&mpt=stnvideo%2Fplayer&sdki=445&ptt=20&adk=2858638697&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.605.0&sid=9EBA7AD2-41CB-4613-9B61-BDCB28D0E113&nel=0&eid=44731965%2C44772139%2C44777649%2C44781409%2C44802074%2C44802463%2C44804291%2C44804614%2C44806733&ref=http%3A%2F%2Fm.foxwebapps.com%2F&top=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&loc=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&dlt=1700578842379&idt=1707&dt=1700578844539&cookie_enabled=1&correlator=4158166705971490&scor=1551525404622175&ged=ve4_td3_tt1_pd3_la3000_er0.0.0.0_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect.min.js Show response
static.anonymised.io/light/ 5 KB
2 KB 18ms
17ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/collect.min.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4421d90bbf983478021bbc14981742e33af47dcfbbbbd2df44b975257fde30cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:50:21 GMT
content-encoding: gzip
age: 623
x-guploader-uploadid: ABPtcPrPh83DKuS8B386GJpWNRBn46AGPmv71L_oCKa-TMlzDbmERDIxY0OOvN_Ho83laknA-GhVSb3oP0d_qoVDqFC8S-hPcM9W
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1975
last-modified: Wed, 15 Nov 2023 16:44:30 GMT
server: UploadServer
etag: "97360f3ec33fc756a2818c17090aa601"
vary: Accept-Encoding
x-goog-generation: 1700066670155144
x-goog-hash: crc32c=+QDa7Q==, md5=lzYPPsM/x1aigYwXCQqmAQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1975
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 21 Nov 2023 15:10:21 GMT

GET
H3 200 interestscores.js Show response
static.anonymised.io/light/ 3 KB
2 KB 16ms
15ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/interestscores.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 0409134df4107fe3d86b26248e3e8253287e929e94b690173bbab16e35686cd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:52:49 GMT
content-encoding: gzip
age: 475
x-guploader-uploadid: ABPtcPqC695RqCWPG8eE6Umg4RSawULI9kzO47XWta114EK9KXle7EuvZWG6hHPVWS-Jl42NjlN-9mmpLp3w-R6oAXhd7g
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1601
last-modified: Wed, 15 Nov 2023 16:44:31 GMT
server: UploadServer
etag: "c5b77cf922537a364f3dcc1d63109155"
vary: Accept-Encoding
x-goog-generation: 1700066671574570
x-goog-hash: crc32c=W/CKVg==, md5=xbd8+SJTejZPPcwdYxCRVQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1601
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 21 Nov 2023 15:12:49 GMT

GET
H2 200 jsync Show response
aggle.net/ 325 B
975 B 175ms
175ms Script
text/html 15.197.179.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/jsync?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: aggle.net
URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.197.179.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: e4db324c8cded44694acb46957414907cb7f959cb1ea6044d2a730a44c960f05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Tue, 21 Nov 2023 15:00:45 GMT
date: Tue, 21 Nov 2023 15:00:44 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 325
p3p: CP="NOI OUR BUS UNI COM NAV"

POST
H2 204 csi
csi.gstatic.com/ Frame 483E 0
234 B 308ms
108ms Ping
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lp8gqhzj&c=1773834809535&slotId=886917404767.5&eee=missing-element&bi=missing-id&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 101ms
100ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=E0HoXq3lFu9UkFXT&instance=214701602&version=7.26.0&age=231121&ldt=NO_IMP&key=jmgEr5Ik&c_id=12018&seq=1&order=6&vIndex=0&absoluteTime=3401.1&relativeTime=1585.5&sm_id=3188399&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=8783&load=1&status=LVFNLNIY&ac_id=2008&adIndex=-1&DS=found
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 p
sb.scorecardresearch.com/ Frame A04C 43 B
301 B 43ms
10ms Image
image/gif 18.66.112.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1700578843592&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=42375&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.3.4.190424&ns_st_pn=1&ns_st_tp=1&ns_st_ci=3188399&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_ap=0&ns_st_dap=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_st_ldw=0&ns_st_ldo=0&ns_ts=1700578844819&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1227&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc12&ns_st_ge=Sports&ns_st_st=SendtoNews&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Cheddar%20News&c3=sendtonews&c4=Business&c6=*null&c7=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&c8=&c9=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-37.fra56.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA56-P5
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: 9vGa9HoraEQQ8LHYrcbjDCzGQ3RzI7PmtSK4kcWCvnmb6LTqpDxkrg==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 100ms
99ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=E0HoXq3lFu9UkFXT&instance=214701602&version=7.26.0&age=231121&cmd=INV&key=jmgEr5Ik&c_id=12018&seq=1&order=7&vIndex=0&absoluteTime=3407.1&relativeTime=1591.5&alt=0&sC_ID=8783&sm_id=3188399&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 100ms
100ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=E0HoXq3lFu9UkFXT&instance=214701602&version=7.26.0&age=231121&cmd=PLAY&key=jmgEr5Ik&c_id=12018&seq=1&order=8&vIndex=0&absoluteTime=3407.4&relativeTime=1591.8&alt=0&sC_ID=8783&sm_id=3188399&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT&pposition=home
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET cs
a.usbrowserspeed.com/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 49ms
17ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 21 Nov 2023 15:00:44 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 198954
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
246 B 148ms
101ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&gdpr=0&src=pbjs&ver=8.21.0&coppa=0
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H/1.1 200
OK / Show response
id.a-mx.com/sync/ 66 B
264 B 218ms
14ms Fetch
application/json 131.153.158.209
SECUREDSERVERS-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=http://m.foxwebapps.com/&u=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0&tl=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0&nf=0&rt=true&v=8.21.0&av=2.0&vg=aaw&us_privacy=null&am=null&gdpr=0&gdpr_consent=
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 131.153.158.209 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU, US),
Reverse DNS
Software: /
Resource Hash: 1f24425e742cb9c13d673968258405d07982525646ef7982e15fbe60c49d64a8

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:44 GMT
access-control-allow-credentials: true
content-length: 66
content-type: application/json

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
370 B 43ms
14ms Fetch
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: application/json

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 224801
expires: 0

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
223 B 19ms
19ms Fetch
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=405&_it=prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd3a4d8bf0c729b06a3dc960854b7cec069097c4447ac6ce4606a1d18d8dd9b9

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
content-encoding: gzip
server: cloudflare
allow: POST, OPTIONS, GET
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cf-ray: 8299cdd52ba11c3c-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
412 B 62ms
15ms Fetch
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

480613f771d4b2960ecbcbf9f0a8435d009d8f5fd10ab14bba1b1018762708e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 204 any Show response
idx.liadm.com/idex/prebid/ 0
367 B 312ms
103ms Fetch 3.223.198.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/prebid/any?resolve=nonId

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.223.198.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-223-198-8.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
request-time: 1
access-control-allow-origin: https://simcast.com
cache-control: max-age=3599, private
access-control-allow-credentials: true
trace-id: 0d6d6df17f2eaf20
expires: Tue, 21 Nov 2023 16:00:45 GMT

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
314 B 223ms
31ms Fetch
application/json 176.34.182.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17228
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.182.11 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-182-11.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.14.122
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H/1.1 200
OK fpc Show response
at.teads.tv/ 0
334 B 77ms
35ms Fetch
text/plain 23.192.153.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://at.teads.tv/fpc?analytics_tag_id=PUB_17018&tfpvi=&gdpr_consent=&gdpr_status=22&gdpr_reason=220&ccpa_consent=&sv=prebid-v1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.153.28 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-153-28.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:45 GMT
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 173ms
9ms Script
application/javascript 2600:9000:223c:6c00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:6c00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:30:08 GMT
via: 1.1 50c53efe331c3da25a4faf191817af8c.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: FRA56-P2
age: 1838
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: ZlZIkFCn_6UlXU8BomSgY4HTyOemnBn0jfgvOok1qXaYTOE3yy7DGw==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 189ms
31ms Script
text/javascript 2600:9000:243d:9600:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:9600:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Tue, 21 Nov 2023 10:03:28 GMT
Via: 1.1 b70198b91ce3354ecb0c109179898d2a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-P4
Age: 17838
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: LyD8No64dM2co4PI3Q96bGcRgi_Hxgat_siqivVkTetSOYEGizc_gA==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 155 KB
34 KB 184ms
21ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

902f47bc9eeb026da8cbcef8c7ec51aaa1f73bf7ca587c8694cceb36ff91a92e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 16 Nov 2023 09:30:02 GMT
server: cloudflare
x-amz-request-id: CJPK2SH13X0A7P41
age: 779
etag: W/"5cdc7028bae687cbffcc9d7982dd9ad5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8299cdd66c21910a-FRA
x-amz-id-2: SFUZw54dWR7xUne2YGTAnbCauR3JQudYPkMc0aWGF26VXS4JIHy7gtVIsFHYQOAi9aTOT4HSnPs=

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 181ms
30ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx
etag: W/"653b5c0e-a9a7"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 22 Nov 2023 15:00:45 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 177ms
14ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 06:38:57 GMT
content-encoding: gzip
age: 807708
x-guploader-uploadid: ABPtcPqNl0_c7mOVHVehFbpvBDCYrlpMq3zlKY0iT8ZNCSTUmKqOFKvvyge5cYXvjpEp3qctN1IhbOKtoVDeGx23F8-Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Mon, 11 Nov 2024 06:38:57 GMT

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 193ms
30ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: fc0395b568c1d8cd4590fd9ad1daaa2a
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 171ms
8ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:38:20 GMT
content-encoding: gzip
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 26546
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: -E1djpITE0Ah_VhsH5PGJfZMyaTKdGE_uwod-rV6qwnJz-tN3mbnDQ==

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 32ms
17ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 26338
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230088-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=My2YqjWuuYzVvyg7VKhfXJR8LFmiABsUx4cjnrAEcCJigXcYmim4U%2BB0%2BVVcJhQVYzdYjEWUQBP%2BmitfNysIyUlnxpnIYkyVwHYRc4zURy%2BNDEYCBGgj%2FQ3XpVWXH4ifW%2B1xGcFBnYTRWmvk0vU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8299cdd57bc737de-FRA

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
5 KB 179ms
17ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cfe89b284e6a2100a86b8d6b0e52b76b85cc62622a40d63e929f328d883a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:13 GMT
server: cloudflare
age: 296282
etag: W/"65401291-2b7d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 8299cdd66d6065de-FRA
expires: Fri, 24 Nov 2023 15:00:45 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 177 KB
44 KB 573ms
572ms Fetch
text/plain 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2217604590396765&correlator=4257029276771017&eid=31079667%2C44808667%2C31079239%2C31079744%2C31079527%2C31079575&output=ldjh&gdfp_req=1&vrg=202311140101&ptt=17&impl=fifs&iu_parts=22181265%3A22632072816%2Csmc_970v_2%2Csmc_300v_4%2Csmc_300v_3%2Csmc_sticky_footer_2%2Csmc_200v_2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=970x250%7C970x90%7C728x250%7C728x90%2C336x280%7C320x100%7C300x250%7C300x100%2C336x280%7C320x100%7C300x250%7C300x100%2C728x90%2C970x90%7C728x90&ifi=2&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1700578845011&lmt=1700578845&adxs=315%2C791%2C1230%2C0%2C315&adys=310%2C1172%2C405%2C2232%2C2000&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C2&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fm.foxwebapps.com%2F&vis=1&psz=1600x0%7C417x0%7C339x0%7C1600x2162%7C1600x0&msz=1600x0%7C417x0%7C339x0%7C728x0%7C1600x0&fws=0%2C0%2C0%2C128%2C0&ohw=0%2C0%2C0%2C0%2C0&ga_vid=1992606109.1700578844&ga_sid=1700578844&ga_hid=541329820&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRjRwpeTvzFIAFICCGQSGAoJeWFob28uY29tGNDCl5O_MUgAUgIIZBIZCgp1aWRhcGkuY29tGNHCl5O_MUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y0cKXk78xSABSAghkEhwKDWNyd2RjbnRybC5uZXQY0cKXk78xSABSAghkEhkKCnB1YmNpZC5vcmcY0cKXk78xSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGNDCl5O_MUgAUgIIZBIXCghydGJob3VzZRjRwpeTvzFIAFICCGQSFAoFb3BlbngY0MKXk78xSABSAghkEhsKDGxpdmVyYW1wLmNvbRjRwpeTvzFIAFICCGQSHQoObGl2ZWludGVudC5jb20Y0cKXk78xSABSAghk&dlt=1700578842379&idt=925&ppid=525178f43e1f46da98ceba40685c6a59&prev_scp=refresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dadhesion%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D10%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D500%26wrap_l%3D1400%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D800%26padpr%3D16%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D1000%26gc_bucket%3DH%26waae%3D1100%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D2s&adks=404934892%2C3788806981%2C4205689792%2C3850137031%2C3434382807&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df8d17b31081267ed7ce2ee71fd5fc3df2d3d136b46e3c814468009ad5ba7cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44956
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9816 6 KB
3 KB 203ms
53ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Wed, 20 Nov 2024 15:00:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
271 B 153ms
17ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

838428441c139fbdb2f8976608fb144594cf3393af579f8dfc4a4be1bd7cfe9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

POST
H2 204 csi
csi.gstatic.com/ Frame 483E 0
54 B 105ms
103ms Ping
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lp8gqikw&c=1773834809535&slotId=886917404767.5&ghmsh_eids=44731965%2C44772139%2C44777649%2C44781409%2C44802074%2C44802463%2C44804291%2C44804614%2C44806733
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
199 B 225ms
13ms XHR
application/json 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fsimcast.com%2F

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://simcast.com
content-type: application/json
access-control-allow-credentials: true

POST
H2 200 579.json Show response
id5-sync.com/g/v2/ 251 B
528 B 53ms
21ms Fetch
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

bd8b2900887fc5d208dffb1fef6f0186230422e47b7e8074c187ef8502f2e29b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
330 B 57ms
31ms XHR
application/json 176.34.182.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.182.11 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-182-11.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: d7366862bf1165b68f55c939ad46eb2350ad1a5e11263e069066192650ff08ad

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.20.148
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1

85 B
203 B

119ms
118ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: d24660741687cbcd130e2cc06cd0a33e8c9c7f03ba31621215e8e551dd67ff36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-d9VsdNpDqLmBkt2w7HN8kHS/+Sw"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Tue, 21 Nov 2023 15:00:45 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://simcast.com
location: /esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 8DC1 15 KB
6 KB 15ms
14ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:44 GMT
server: Kestrel
server-processing-duration-in-ticks: 308988
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
101 B 100ms
99ms XHR
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&src=esp&ver=1.2.0
Requested by: Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ob.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 21 Nov 2023 15:00:44 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
540 B 138ms
34ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 8a7afda4a8b6b7e8751de0ee9f655f18915c7480004c4745e59d57186372e842

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 0893f313da6f9ef63bd364658673303a
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 265
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

sid Show response
mug.criteo.com/ Frame 8DC1
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=simcast.com&sn=ChromeSyncframe&so=0&topUrl=simcast.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=EOTqa3xwUTFEL0h6a1FUbW1ObkpRWFlUQkl6MzdTWHdDVk1PanErTzBWNXpwMzNMVXFsRG1rejcwVHRFcEJzVXdYTVZpZkZlVWhTWGlicW1SbzJKREJ6cENMcGlkRnRpdk9Rcjl2dGNmMGFtdFNxdmV2UUdBWkxhVHkrT0...

433 B
656 B

20ms
18ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=EOTqa3xwUTFEL0h6a1FUbW1ObkpRWFlUQkl6MzdTWHdDVk1PanErTzBWNXpwMzNMVXFsRG1rejcwVHRFcEJzVXdYTVZpZkZlVWhTWGlicW1SbzJKREJ6cENMcGlkRnRpdk9Rcjl2dGNmMGFtdFNxdmV2UUdBWkxhVHkrT0VpclcrZUZ6ZTZWbTBCZGs5N28zU3BKRndJWjBiT1VxRTBWVmRVVUlpUHQ3TjdLVmVaVlNtak1QemVCSldKNC9YQ0V2eFEzdnFoQ2dDMXZNcHFOOTlDUVlmWHhwbkVlbmJXUzY4V1dUQ2JCTkNMWmZueTIwbThuYWgzL2x4Z3UycXlPRWx0bTJ4Nytxa1FFeklYak5SbGdpSy95eStKQT09fA&cppv=2

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

1d2b3a32152780dbc7fcc2c1f2b09ba2a8e8731b4958c4c982103cefe8c27b71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1736458
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:44 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=EOTqa3xwUTFEL0h6a1FUbW1ObkpRWFlUQkl6MzdTWHdDVk1PanErTzBWNXpwMzNMVXFsRG1rejcwVHRFcEJzVXdYTVZpZkZlVWhTWGlicW1SbzJKREJ6cENMcGlkRnRpdk9Rcjl2dGNmMGFtdFNxdmV2UUdBWkxhVHkrT0VpclcrZUZ6ZTZWbTBCZGs5N28zU3BKRndJWjBiT1VxRTBWVmRVVUlpUHQ3TjdLVmVaVlNtak1QemVCSldKNC9YQ0V2eFEzdnFoQ2dDMXZNcHFOOTlDUVlmWHhwbkVlbmJXUzY4V1dUQ2JCTkNMWmZueTIwbThuYWgzL2x4Z3UycXlPRWx0bTJ4Nytxa1FFeklYak5SbGdpSy95eStKQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 243246
content-length: 0
expires: 0

GET
H2 200 cx-overlay.js Show response
tags.qortex.ai/cxo/ 127 KB
43 KB 496ms
495ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/cx-overlay.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-bootstrapper-init
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9fba1b0797e04bb4e94dffcf9068f89e75b4fa5569dc9efcb5aa72275435457b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:13:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9CThYI%2FGtgkZRnc0bl3oHvyd3YM0m52FALKLjnk6KgLuTvQ1Uf0AMh3s0Nhm1ZcLqiyN%2Fq5WsuaepennVQkIl7E9REKTrBtusDDcR3cDbVxWOocbd69tR7H0o1KKahWCxg8u%2FL%2FM5AECdebo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdd6e9093737-FRA

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 5EE4 0
176 B 69ms
23ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Tue, 21 Nov 2023 15:00:45 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012310301456000/ Frame 2712 196 KB
55 KB 112ms
38ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 02:37:57 GMT
age: 390168
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56081
x-xss-protection: 0
server: sffe
etag: "6a17d296884b026a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 02:37:57 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2712 15 KB
5 KB 138ms
65ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 18 Nov 2023 08:33:14 GMT
age: 282451
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0
server: sffe
etag: "0b7142e00666043e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 17 Nov 2024 08:33:14 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2712 95 KB
29 KB 92ms
19ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 03:53:12 GMT
age: 385653
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29077
x-xss-protection: 0
server: sffe
etag: "7b1f1965b6cd6fda"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 03:53:12 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2712 5 KB
2 KB 139ms
65ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 01:14:32 GMT
age: 395173
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5b0a82507b260c6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 01:14:32 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2712 40 KB
13 KB 139ms
66ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 16 Nov 2023 14:54:32 GMT
age: 432373
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12952
x-xss-protection: 0
server: sffe
etag: "9817e561a46c70fa"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 15 Nov 2024 14:54:32 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 2712 14 KB
1 KB 38ms
37ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:26:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2712 2 KB
3 KB 77ms
20ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 78169
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Tue, 21 Nov 2023 17:17:56 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2712 295 B
664 B 76ms
19ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 62647
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Tue, 21 Nov 2023 21:36:38 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2712 0
0 88ms
38ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT3KUiAUNXw-6SnThcfd8sCUZGx59jPA4Ul7AB74J34uomFAB0FaN-t3yvo1ekxuLgVjjBHokjSMx0cUMXyE5RpsM9LVg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 container.html Show response
65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D408 6 KB
3 KB 21ms
20ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Wed, 20 Nov 2024 15:00:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B32A 6 KB
3 KB 18ms
17ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Wed, 20 Nov 2024 15:00:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EE76 6 KB
3 KB 19ms
19ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Wed, 20 Nov 2024 15:00:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 05AA 6 KB
3 KB 19ms
18ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Wed, 20 Nov 2024 15:00:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/10363926126511710286/ Frame 2712 41 KB
41 KB 35ms
20ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10363926126511710286/14763004658117789537?w=600&h=314&tw=1&q=75

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae491debffdfe4dbfe263cc1a8cb498064b8e96785def990634272abd00c310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 03:54:34 GMT
x-content-type-options: nosniff
age: 299171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41982
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 16:47:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 17 Nov 2024 03:54:34 GMT

GET
DATA 200
OK truncated
/ Frame 2712 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 2712 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 2712 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75cc820a6fdf476d4116c4956bdd4883db2b9153e7880d05a17b5f5e8649919f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 2712 33 KB
33 KB 19ms
18ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 09:09:18 GMT
x-content-type-options: nosniff
age: 21087
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 09:09:18 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 47A4 624 B
242 B 70ms
67ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUw07t-NWDNWTi-NEdLq3agGaFiAGqbqo0bdurRbCZqBGMwgy4hkcS3--THa2VVl5Degj3TUWOPzfSJD1YypE6--BFrEaLaRgPtCXhDnoEQsok4hS0Ovp26H90yvyLboKRv-N9ZvhQUQAA8wghYa7as331oO1obdtzh4vYV95DgvCBnhTWjGCwC57C9CLHTkO-J3Ei-2NBaKOeqD05anIajRaRP9w

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D408 89 KB
31 KB 116ms
115ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D408 42 B
63 B 67ms
65ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ABQC9yFun3_IsQRE0WKl6l82iAmSKPMY1jVti7u2Xw16J0wpKiy9P6hjqwEP1ODJKGzED8E0VOKh-8UAhWS6qktgpxKft8D9N_w4a9g6dXZFld_rg

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D408 0
20 B 67ms
66ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=14960327330844478423&x=1&ct=77

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame D408 3 KB
1 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame D408 20 KB
9 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17490
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D408 202 KB
64 KB 164ms
70ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 60AE 640 B
262 B 67ms
63ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVYYZb28ZsbsqhWn0PAyHaBp6P_fUrOGBDMBWeY7TQpkKRYCFIM5YpJ-ww-r2yIgPSu7u_GzpDh7WR0cCd_MbG_iM2tSwJywcgi5gQFrNL3YFZWQgD-nW6Fgc06ou-1oq94qIVMcPyC_cFzImi-2a7oUbUSdS4klo1Ufg5mQPwBw5zv8boFy7tt0dwrH3lN1M_GJeLzIq8qzyRFyaRmMNXILKT9_g

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame B32A 89 KB
31 KB 149ms
145ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B32A 42 B
63 B 64ms
58ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DzuAo0_Qv1m2PBABMUX8V9mSE_DHQgUI6iIms2yQoBPsCcC7D-GC5HabHiahYztYWF-f6kYekvvHyLAbCeDzlHDpPRgANpZOYysOJ2pXcIb-q6N-8

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B32A 0
20 B 64ms
59ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=14078881567066324331&x=1&ct=77

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame B32A 3 KB
1 KB 53ms
25ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame B32A 20 KB
8 KB 47ms
19ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17490
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B32A 0
0 67ms
39ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT4oxFeQOgnZhBQ0td7a24k-KPjFI5Kp0_Pc-WqXwkuTUzVgQV-w1e25tf3QV7fdgX8X8xYZdIjFQif86eDVvhICWLtAg
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame B32A 202 KB
64 KB 148ms
62ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8ECC 624 B
242 B 90ms
69ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUdQEds1Z5k1k1ezHEfm3RL07ufHpUdjcj5CXxu-MjE3sUwUXSJP0sxOT_8izZTgHqeD-XdT72qMWTXA-fMRHbjQ0yZCdtVGOKX2MiLlH_LA_Eoqcwb3pbzvBM65KXkdRhRFhKk-7lC5_Hq9MhAzoDJkSxrvG01N2mGeNDKd1PYNB7FyHcNJhzYjtqS8ZkKpJZTm734XchPB9NLlMYqPPQXItzHYw

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame EE76 89 KB
31 KB 210ms
207ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EE76 42 B
63 B 61ms
59ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D3LMckyJn2RU06yhOcP1Lyz7EtPjedao0oEnRDMhFeHVgCxzckz8IUvVb77fprLf9UXny47ENmtPrOSdrSTE90Lh3AhcHWeBzKp62oZj01Oy_gERo

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EE76 0
20 B 62ms
59ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2222850762562158225&x=1&ct=77

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame EE76 3 KB
1 KB 50ms
25ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame EE76 20 KB
8 KB 47ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17490
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame EE76 0
0 62ms
38ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS5ValAqUJUnmuHZVPVcygOW20AMZ9xmdMu1zxcdgGP7YdOD8A-v2shSgtrtIumogQhgyTH3XBFPwDSRNimh-VKtpMYHA
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame EE76 202 KB
64 KB 150ms
66ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 163D 624 B
242 B 76ms
68ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNXXmHDSGkwU8__EoHOmTaR5X0Ro_3--kRPEWlf-9rRFuZ-GtMU4dOz4OaoZKj5NujfyFI5Uh77R6bzROUatg323G4L9dSKQ4XbIPotUYxw7axRfIXE7FnW0waxm7idGSn8zoYYWrLESi8j39Fe7Zv8q0Jc4zFMUEra0HufdY8zprd4W_bBluDrzSQbUlrSEL2EypU_HDbEaGxnxlFlJw7ePq7nzdw

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 05AA 89 KB
31 KB 202ms
189ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05AA 42 B
63 B 69ms
55ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CjgzSZD2-Wpdpn-Pt3twiRWfw8aJ52TD3-3D_dR3b2SHFYMe7pK8V0hVKwS75MHG3pRXO0EeUsAse8VGXeTvVLtWZnRGwVYsNzMU-8v2jifljGyhs

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05AA 0
20 B 74ms
61ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5792267097212195935&x=1&ct=77

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 05AA 3 KB
1 KB 45ms
23ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 05AA 20 KB
8 KB 44ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17490
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 05AA 0
0 61ms
37ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQjsSzYenhI44Ygf_P0ZWVvjRqywgjE5rg28nIjlDMlw0buE7FauZG3D-BC4w9HKtWLj307Xwke9fw_U561JDtyo2ZkeA
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 05AA 202 KB
64 KB 103ms
27ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:45 GMT

GET
H2 200 p-fc3a8e1a.system.js Show response
tags.qortex.ai/cxo/ 2 KB
1 KB 24ms
21ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-fc3a8e1a.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d1db393aae713dc1b2db9cbe552ac6b9a1b9452e1ccbcff3fc053e2fef7b9ce7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 68
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fo6AaN0bVFh63%2FFodjxuzboET6%2BDPmCyBLNbSjqlGEvTJprfatSjX55wa22GizMeZHjezD1wZLuTsH4q3ketlOClmx9iRlk2d1lIgiZBmtidcC7QbRhITCLNAMzt4wZ%2BayIKDt4e2ZiJ7tQb"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdda6d8d3737-FRA

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 47A4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1

43 B
733 B

34ms
28ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUw07t-NWDNWTi-NEdLq3agGaFiAGqbqo0bdurRbCZqBGMwgy4hkcS3--THa2VVl5Degj3TUWOPzfSJD1YypE6--BFrEaLaRgPtCXhDnoEQsok4hS0Ovp26H90yvyLboKRv-N9ZvhQUQAA8wghYa7as331oO1obdtzh4vYV95DgvCBnhTWjGCwC57C9CLHTkO-J3Ei-2NBaKOeqD05anIajRaRP9w
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4FN3Ck4Q7vk3Wxs58lRCNECtv3FUyKZJj5rSzkPGl1hdgtGeTYYpw0e%2B7ZuoL6suNSgUyJfyy%2BcjIALYzTm3z6LgPWXwBDB1RdNtgvrnn9Fz3%2BuIHKobUgjd3lnwZ3Odw9xChS3NEYvq8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cddb4d651e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 47A4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGHfDEca7cqQE5fhiFpgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1

43 B
731 B

38ms
36ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUw07t-NWDNWTi-NEdLq3agGaFiAGqbqo0bdurRbCZqBGMwgy4hkcS3--THa2VVl5Degj3TUWOPzfSJD1YypE6--BFrEaLaRgPtCXhDnoEQsok4hS0Ovp26H90yvyLboKRv-N9ZvhQUQAA8wghYa7as331oO1obdtzh4vYV95DgvCBnhTWjGCwC57C9CLHTkO-J3Ei-2NBaKOeqD05anIajRaRP9w
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rAmVuQ1vX5TKcZKcgKeIJP%2FOhhsOt2PbOE%2BJre3NhVmp2IA1UV480QGTaLUEQlD6o5s5ckJCE37IogAUs2%2F8IiUB2RNHqK6IdHYmgrSbyiyu%2BoaGBLJ3A4X0WJUlmnuB8ra6rYchvCfJ5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cddb7dad1e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 47A4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1

43 B
846 B

20ms
12ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUw07t-NWDNWTi-NEdLq3agGaFiAGqbqo0bdurRbCZqBGMwgy4hkcS3--THa2VVl5Degj3TUWOPzfSJD1YypE6--BFrEaLaRgPtCXhDnoEQsok4hS0Ovp26H90yvyLboKRv-N9ZvhQUQAA8wghYa7as331oO1obdtzh4vYV95DgvCBnhTWjGCwC57C9CLHTkO-J3Ei-2NBaKOeqD05anIajRaRP9w

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
an-x-request-uuid: d1971f3c-b43d-4254-a94b-369110de15c3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 47A4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D

170 B
243 B

35ms
33ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
an-x-request-uuid: ba1e0c44-e711-47a8-a3d9-8a96f0df241c
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 60AE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGhaGf6InS9XrqhXtMaEXfQ&google_cver=1

43 B
114 B

33ms
25ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGhaGf6InS9XrqhXtMaEXfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVYYZb28ZsbsqhWn0PAyHaBp6P_fUrOGBDMBWeY7TQpkKRYCFIM5YpJ-ww-r2yIgPSu7u_GzpDh7WR0cCd_MbG_iM2tSwJywcgi5gQFrNL3YFZWQgD-nW6Fgc06ou-1oq94qIVMcPyC_cFzImi-2a7oUbUSdS4klo1Ufg5mQPwBw5zv8boFy7tt0dwrH3lN1M_GJeLzIq8qzyRFyaRmMNXILKT9_g
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGhaGf6InS9XrqhXtMaEXfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 60AE 43 B
219 B 27ms
20ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVYYZb28ZsbsqhWn0PAyHaBp6P_fUrOGBDMBWeY7TQpkKRYCFIM5YpJ-ww-r2yIgPSu7u_GzpDh7WR0cCd_MbG_iM2tSwJywcgi5gQFrNL3YFZWQgD-nW6Fgc06ou-1oq94qIVMcPyC_cFzImi-2a7oUbUSdS4klo1Ufg5mQPwBw5zv8boFy7tt0dwrH3lN1M_GJeLzIq8qzyRFyaRmMNXILKT9_g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 60AE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELibxVETNqVWzC9mK3vT68Q&google_cver=1

23 B
163 B

108ms
100ms

Image
image/gif

23.192.153.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELibxVETNqVWzC9mK3vT68Q&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVYYZb28ZsbsqhWn0PAyHaBp6P_fUrOGBDMBWeY7TQpkKRYCFIM5YpJ-ww-r2yIgPSu7u_GzpDh7WR0cCd_MbG_iM2tSwJywcgi5gQFrNL3YFZWQgD-nW6Fgc06ou-1oq94qIVMcPyC_cFzImi-2a7oUbUSdS4klo1Ufg5mQPwBw5zv8boFy7tt0dwrH3lN1M_GJeLzIq8qzyRFyaRmMNXILKT9_g
Protocol: H2
Server: 23.192.153.28 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-153-28.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Tue, 21 Nov 2023 15:00:46 GMT
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESELibxVETNqVWzC9mK3vT68Q&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 60AE 23 B
163 B 77ms
40ms Image
image/gif 23.192.153.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVYYZb28ZsbsqhWn0PAyHaBp6P_fUrOGBDMBWeY7TQpkKRYCFIM5YpJ-ww-r2yIgPSu7u_GzpDh7WR0cCd_MbG_iM2tSwJywcgi5gQFrNL3YFZWQgD-nW6Fgc06ou-1oq94qIVMcPyC_cFzImi-2a7oUbUSdS4klo1Ufg5mQPwBw5zv8boFy7tt0dwrH3lN1M_GJeLzIq8qzyRFyaRmMNXILKT9_g
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.153.28 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-153-28.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Tue, 21 Nov 2023 15:00:45 GMT
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 163D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1

43 B
732 B

36ms
30ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNXXmHDSGkwU8__EoHOmTaR5X0Ro_3--kRPEWlf-9rRFuZ-GtMU4dOz4OaoZKj5NujfyFI5Uh77R6bzROUatg323G4L9dSKQ4XbIPotUYxw7axRfIXE7FnW0waxm7idGSn8zoYYWrLESi8j39Fe7Zv8q0Jc4zFMUEra0HufdY8zprd4W_bBluDrzSQbUlrSEL2EypU_HDbEaGxnxlFlJw7ePq7nzdw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xiKngVIdlnTUZBC1HFPhcSDsAD85FiNJTvPwijf2LWJ6Pr%2Btzqthc5nb5a45pNQtzT8JeOiivqxbGqoAVJ24ktHOfSdDuaLJhQz%2BiIeauCSZUacyDDaHjvDNdBs%2Fa%2FKCF7mPFeL5Q5uydw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cddb4d6b1e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 163D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGHfDEca7cqQE5fhiFpgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1

43 B
735 B

29ms
27ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNXXmHDSGkwU8__EoHOmTaR5X0Ro_3--kRPEWlf-9rRFuZ-GtMU4dOz4OaoZKj5NujfyFI5Uh77R6bzROUatg323G4L9dSKQ4XbIPotUYxw7axRfIXE7FnW0waxm7idGSn8zoYYWrLESi8j39Fe7Zv8q0Jc4zFMUEra0HufdY8zprd4W_bBluDrzSQbUlrSEL2EypU_HDbEaGxnxlFlJw7ePq7nzdw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yKZyS5k21UgD%2FK0rJ9fzrdvn%2F01po4LSt29THp4vv8vzLPFQlpq8tDOfQLqElKBxvPe4zpcwaFUvjXYOnMBhcV%2BirP7p%2FUuevWyueafo35cGqHS0Ge%2B%2FUdGsTBff2p2iaO9dW3EmAgUkpg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cddb7da91e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 163D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1

43 B
846 B

19ms
11ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNXXmHDSGkwU8__EoHOmTaR5X0Ro_3--kRPEWlf-9rRFuZ-GtMU4dOz4OaoZKj5NujfyFI5Uh77R6bzROUatg323G4L9dSKQ4XbIPotUYxw7axRfIXE7FnW0waxm7idGSn8zoYYWrLESi8j39Fe7Zv8q0Jc4zFMUEra0HufdY8zprd4W_bBluDrzSQbUlrSEL2EypU_HDbEaGxnxlFlJw7ePq7nzdw

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
an-x-request-uuid: 64e2c73a-a74a-4ea1-86a5-cbc50e6d98df
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 163D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D

170 B
232 B

35ms
33ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
an-x-request-uuid: 71816328-2998-4408-8ed6-f7e06963b229
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8ECC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1

43 B
734 B

35ms
29ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUdQEds1Z5k1k1ezHEfm3RL07ufHpUdjcj5CXxu-MjE3sUwUXSJP0sxOT_8izZTgHqeD-XdT72qMWTXA-fMRHbjQ0yZCdtVGOKX2MiLlH_LA_Eoqcwb3pbzvBM65KXkdRhRFhKk-7lC5_Hq9MhAzoDJkSxrvG01N2mGeNDKd1PYNB7FyHcNJhzYjtqS8ZkKpJZTm734XchPB9NLlMYqPPQXItzHYw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qBIdgID6U8jFilUt9%2BHqillfL78uNBZmWc4KhKGAa3duftZbnXP2QYRzq%2BNsBc8qrjESa2wugBZkQNpCvkXX1klkgFCQ76WJvkYoLbO5B3F32MOz47I3Q7j%2Fc8bj%2Bf22gtWsFzzxQezNhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cddb4d691e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8ECC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGHfDEca7cqQE5fhiFpgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1

43 B
733 B

32ms
31ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUdQEds1Z5k1k1ezHEfm3RL07ufHpUdjcj5CXxu-MjE3sUwUXSJP0sxOT_8izZTgHqeD-XdT72qMWTXA-fMRHbjQ0yZCdtVGOKX2MiLlH_LA_Eoqcwb3pbzvBM65KXkdRhRFhKk-7lC5_Hq9MhAzoDJkSxrvG01N2mGeNDKd1PYNB7FyHcNJhzYjtqS8ZkKpJZTm734XchPB9NLlMYqPPQXItzHYw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XHE7KkaYwiWNCofguxVvFIwZK6KiZXRL%2BDkr8d%2FozQhLB6VFBVjhbwdkc9hsjwC9VWRS5fFa9e%2BW7j2JoVdvvSiIOyn83kgS6%2FDAWJJ0nwjcSqlntvolsUGRl2iM6m754b1vbpqCDComIg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cddb7db81e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEEtuu2uxAlFxgvomGIFZw8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 8ECC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1

43 B
846 B

20ms
12ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUdQEds1Z5k1k1ezHEfm3RL07ufHpUdjcj5CXxu-MjE3sUwUXSJP0sxOT_8izZTgHqeD-XdT72qMWTXA-fMRHbjQ0yZCdtVGOKX2MiLlH_LA_Eoqcwb3pbzvBM65KXkdRhRFhKk-7lC5_Hq9MhAzoDJkSxrvG01N2mGeNDKd1PYNB7FyHcNJhzYjtqS8ZkKpJZTm734XchPB9NLlMYqPPQXItzHYw

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
an-x-request-uuid: 4b404793-ebd1-4493-91be-d3ec9cec5236
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPROxOEFpjnPLvJ3z1_eDPM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8ECC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D

170 B
232 B

35ms
34ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
an-x-request-uuid: 67f565e5-ff32-4d9a-8436-1e565d5fe1de
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwMDQ4ODEzNzQ0NjAwNDYxNg%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2712 2 KB
2 KB 19ms
19ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 78169
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Tue, 21 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2712 295 B
319 B 18ms
18ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 62647
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Tue, 21 Nov 2023 21:36:38 GMT

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 23ms
19ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 22 Nov 2023 15:00:45 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D408 0
20 B 60ms
59ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1164303885056&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D408 0
20 B 59ms
54ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1164303885056&version=m202309260101&ct=77&x=1&cor=14960327330844477000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D408 20 KB
14 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AHDhwEElOEhOp5ZlS-vSQU4tpXV235JY-b0BYOmW-nC4rumUCcZzsGshzT4ERR8i43F6GU7my1adKa84-VXiG7Crjot7zC3wNPHbkk2jm9R3EJpTS1wFdpGycqxTU6Sqx4wLKvOSMx1eUJbzulQ1r2XNX5uBewQInG0_yuxGPSSv1C87E&cry=1&dbm_d=AKAmf-Cio-D1fjlcTs5oXzrPPEbrsjj2hUlCfNII8Xglpdj5n297-_wLlCQF4anyoSw8ECeOMBAQ3ty5HVn2SJS_1DT5RtSLKd3olmqAA1Q2qHeWrYnyTd_uI7B_RLRSXNgH_jfIqKLzJPWzBWO5u7FSju7O2AmwwT7GeGgxEqX6gpnGXOanUfaRkfgGkCAPNbS3uqIYL_HZLTnhG-YogpQcILtJNvCl9r-1kj4RLpCTll0Cjd2e9-SmUJuAy9TF2VtKIrcdTXB8wmDWqvUkylfb_jnaiTgCfT4nUWCLM3fTfXlfyWXxgxsSRr7r4w8sV1TCjscIgWK3mCkv0ZXRatKtC0PjLVP5dccOsQUPUv6n_eS0SBHqJ28DfUxZISYuyt2K06-CYfT3n7Bp7Cs1s1euLSHoHJkvrDAeU2bnAR8RbjgFfVgeXK3CLJxWyaRYvp2yJlWtxBol4C7I2zmOrk7Z_jYHaMde4KCyOTsLO8ZPyuwIyT2HAHBjDkUsywec8RZfGw-fw_qYdIeyn6sMHKyP5MAsF7oBEtV4eHUQRbHXpKcQL8DP7PRoS_6rwpaAprTyjD78x_xp3zXRqaeVJQpP3_UaIQVqGlmJBK1DvKPAxHTHjQovrjH1H_ruD2_Y8sLySVIRGU9dE5rERortNhnb61NON5ULbzFBE9wm9caYzU32Ht03PWaXKD2TdTFY3fS0fTGwIfrNgLmpnF7ijvhWLQ2q_CxW29ikS_bmrulmDZzfyI8VBIb_u6y53GdoO3NC82eXUb0NQwCE7TMkYTRSsssPgT6CrOXxmqhF3NiERRPASmOECGjurj-y5IQEiuw67O3T0c6yEfygHqnTT_r43SnXKdiMK2xWwv-3VukcIed7BUF7_w2JLmfrVRxbL1KsmiymfMdx56D5hZxMMZGDm4k9rxA43-nnRcujf-fEij-1Ak1DZiImuCaISbSNs-nhhe2mOkHso-xwLSFEqbEkjgZy1uqI5sTQaXf0mHA0ekt8TEHIql9ebvSyDvdVIaMWeDK9Yr-XybLlaj-MVLh2hcLNMmDXbZ7w7E2MJ70VQ-y3Lu_9ld4D153SY-ToFXWq85fC1YBluV9AJnU6BY_AX9DlgTIMdVEhH9wGt_DAs4baUbxOOUQxbTFUqi4iqq0kiKWqyxWQhnNwF3dDozCcKPoRNC5Tlmp7UMDbocMBs0JtXT0vakxQyL3yQlfmuG5bQrmz_I2Ab3vqTGuY_0tNqeCnX48dPTKJywYxPmQuZwoyfCLYMiCrdn1BZUIdIoFddUKqD72ABTn5SDricHJjIOQSKyObe3tD0VMqiR5eWsXwKQ8YVC52nkqwcT9ryXyB4M7NGpFRwZ6oh9gh-nbtsy4jZ0Zpzvmj9VfmVmQdbj7IlHYruRLex0GydV_Zn5VSY-BC_laE6g7oUnlhBrAJ_HRV-B-2rDRsVrWECdpR7crdqHaxLlC6M7_yZfr9k6byDQJhx2G1TkSG80XlwhQ0fOACzL75ty0r_c502vPOZtRglYr9c_cS5a-PVU7UW9u7iH0M8IBsEf3VhH4uwtTejYRPPWTWYC4J44GBFw-yG_WqnBdH-HfTWERW5oe77WM6S90ht3MATZumgFrQ8zDMQmn6W3Vhed3-UMldbOlEQuQ72fiT7jv2WLS-UCrMLSZnujQoqr958TLGYTcdPyLWYTtM0FVCKSK1Tzdnc5F2jK-qfumLx1qKDHcA4bdB-zsr7JD8MAsM1Z4b5R9n_PpP0ucC_hsgKI4n9noA7Pot8Ueb53j5DZ2-tpnHE6iIavdXL3i1DiemKElrX4CClZ_VXFPCtMA6kIqOwnVYcMIz_9cfxwLTO7kL15hHpjiqd0p4Ljt7xk4PvhvbFjePqcInuVYoGREK1-o-v94nwtqLPdxS-roT82zDybDZv6zkFK4YdT7H5AvXalQYEsHTfTTujHtC3_vWT6JkTbOsypmlXvsZuAV1kMYHb3D0dpNIZ9NNoztWYEQ_fUplTKhhUyB_Ll3CVI5qqNtZqVHs-E1pJinwmd5WXUxecI8LmcG03UXnZqFn1PNXxTu3QPJ-wUbFU1svuNFc8IcQ3KzZ2m5RgNtri2e3O1ENdOPpRIqfjHk_3EjTv7oWrJxHBpk4VUCdJogxffEa8dQie6yyOZ_4g-lm0D5_vMwcAEkQHZ5fA0GfWUvgqI0QvE73DDeLZ3TakymrOzts-4BaUGf8LxOYHgP-3x6F_eO3S93GN-SXdFH2_Cu_o5zv3CAUkbn3ZkGuoLVbktnDqn8w19Hp9L_D838Vdf2wcrf3UuEpT1NYZ7zBdVUpGvJAoMV7nBcRmPCchPaH26t8ZETZzmHVtSjN1_t5Qs8QhESHIEMz6P22rT4cmMDVfxcwdw7i4j9-IRABXFKSKcXzgt8R5LYyF0enL-5kP4dPF-fuewi1-BGSFe1MEL7kI-tzhZ1YPtNAiYtFQFi6B83nhgORQE1CWga1AV-97PARV83GJYT_rxdsYS_B3BZtU88nc947js6qHCbrczW1mJhQHfRqJ0_Va6D-QgAnypjw_VnToZhx2ztcuU2zGPPBKSvRiiDGgC8cROEeJyfzI6THkEknRrjhlHKwzW_S-llNCdMJDHm5U40w5mZXMaQnb5OcUeixycDnRzHomeGWaJqZqQ_CWXpvkKZNui5a_oxKBPAIFXm-XWw-HBhpiKen1xnlrAjyCHO99PdnBosgUcwXsgF1HeFr7qa9G8zXSQoCvw05E5VFOcgvtnAKack_M7TfsjpwP0-Qk9kzbEAUwNHrCIaBXShyxWBbFB4143n2sCgujfrCiDKvhc_sGCJqVP4kRnDa7Mb4qYHqc0_p5oMvLbgNGJ662Y7DzXm2m0nUxDR4x-bKTsCHrINpyAKRem4F4PMqmNcFKvtEvcXmgAbqXGaQ6y_wzVZ0k_q2BJEXfARxHLTtAj8W3rIn-cjz9V0vv3QGaIWg62S6RqosfIKIvLhc2ro_jnlxMwiTv2VewYrln6LyPFNHmmvX7QygSymLgW4npV0t6bT87kbJSzYG53WJPs13gfz6FiHoZ9B5kZP8gLYGLlWNTMZMisGYr-u1ureDzuKl-x1P8hWZrSZgjeL-7YE7Jz-rnHGxBmLv-WeJFccH-q8A0Dkg5PaXXXf5hj30BSaqWn0nFMd4EppduQtsgeo0v8RrjV02M8aZDVXbAKu9nmBAq1-YgyweRzWcGS5b-R_tnoqRa8f9MUHwGdSDQMQxqeYW8QiP9yH4QlpkijoQzMdWg8RXcJF6sEBzhXVHMwPINwhgsvg9ChoNceHhBh3Lpycfi8x8nmt_bAYt3mWef-_0umWMiz73DtlkeO07SGP2SK-XYhuGcE-WPTpRl1L2AeeinCtlLCn1THsI_2222B1t9STCADd22cf6Xp8vITtjWDzw3eOq6pldEtM0v-5p1VNOXjXrKZXaewGmdXF6_-dQVIz-gSwnK_9WmYVdxrA38jfQeGfVdCarN_FVuek1cYCl0DkF5UcvxGMzZPzpI3sJV-P8oCN3TpV_PGIl10mMdk5nwK0jj0eyCLiI-4_0VVVy4HiAwBVZur4W6iIhDxbG5n_Rx7xMr-w_9wSyywpKiMxsf2YzlPhscbi-DgVTs-3IThdLq3j6HFLO0X4sKVS3uDM3TPs05vZY5q2XiloBYsdKG35HUynCekX0FESk4GtAtH96BtCREhc7euylXlubLw2jaE9GadYbFgZwrSttkLAAnXlvITJja9uvXV2Bv-E7KQ_YSmSRWgyCCbo7RBwdZ7rs80ncZWlMCBhwu0ZM3lEa_elcMURNwtSet_Wkt-nYu9AGR8N-faAUYhYYqMhB3Im4PZNSnbgXz4nAD841uoEYfrw7DZZoDAYNLr9ZFi8_QZ7R5zNYkvxGu-hL0QXjbAyUPsVYGVwCOhwrkPBvyd4Y3o478MeJh1eUgzz5cvarZzj32b27YM8tpD2liaW3P7ldvmigAf0caEM4J5PH8s0b8erqNejHMswmRETeAKXzbEfvFJQVvfq5a1TA8PGADouH7teVR1qW6MMoHuGQnP9rX2-A7OlYdQ&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=14960327330844477000&adk=3944675600&idt=119&cac=0&dtd=23

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

390d92e07369d9aaa93d29c02a583fcc85159924b0c4be3e4115ac60228d6dc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13921
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 p-31c577a7.system.js Show response
tags.qortex.ai/cxo/ 14 KB
6 KB 18ms
18ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-31c577a7.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a87dab54792ca3697212f10ca3a1504a38c2c6d609612d0e3954824d2726a172

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 68
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oyOvmMqqhxlbpptOpom0pM%2BbCWj0AyeWcKVpn52GUF78Fjg1in0lEAWcFcelHHyktecl5vCL4QcVq4bqQ4G5IZFAsgH9V6nWaxFkCvzpTQJw5MX%2Bw%2FR9mtcYlf6FqM2fpvGQcFR%2B2ms7eHKl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cddb1e5b3737-FRA

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B32A 0
20 B 54ms
48ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6075966465544&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B32A 0
20 B 54ms
48ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6075966465544&version=m202309260101&ct=77&x=1&cor=14078881567066325000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B32A 20 KB
13 KB 60ms
55ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dz0i4At6eAgov_nFuxIPYVuFHf6u22-AQf3M2VmnHpgIz7TOV1wIMeijxlK-QTqikjbpztzUMSLX9akHtEZBkvBUwrpn5tKKRW2IoZtJ3zghScS8lRepYOB31gSAFYjMC9daEOcy_2plrTWXbO9BI8aoaFmR46w0Rjbnq5RqdGar-SpTU&cry=1&dbm_d=AKAmf-AMttu_EDKWpOCTfh_Y0q_FJEE6IvySI8R3OPnV7C2zg_2r083OaymZW78wh-CwNS-jDwNcv3thNYVvMuOg1a7R72HoqrqGeE15QT8J9PKok-y5eCDdG-PadFSY_-cPlF3GqdHCZY-L_-ZgvwkYpF7pH5qadMUwfA616b9CKCgQzExV_cpMj-NJ5M0BBBNXls3wQyi_aQYoklkdB0UECO3u-Zs5Up06mf7NsaSCD9SrzF4Ta0Eyhe307SFg07FCQpz28143X-MqPejdrZEAAMxhGkrgq9re_xrELC5gjTsxhjZKiickMRaTPDEuR5FReCwGqSbP8h65E2YQklHX57BYZP07F4qIUWw-o9M8vx61gvaD9LkfmECxAKTLxnuyN6O905igvT46OmtLdgPTrTEQOIUQSHPf4Tdm_dELHICWZtWtZwDuxVy8TxGlH9GIZj-9Eb4IozGLtI5riLWGaVPdHT63lcj5A2KzsYXCh-JlRg9-j4V6fAQOhy2BiS9Zg_bl_UETZzEaJ-dmYHlUpZadw6qHFt-VIkK_ZpVFNbgZ5bJseeLEWHLS7nhNPM-QLNfr5CNXH0NPNccORhAtDuZai3XpVQ5RHQ1YsIczVGVdPfGPJKEXyqVh0K6h1AeaPm_qeVnRR9mhGMEkjgd_XZof-dnhGae8znT8fIPZtK7CdN_LcYeNXiFJ_Lx3k25857c8SHsrDauI6Sxx6aJeNfE4MZAiZbjcYUOC3MQIezGOC0p41z26oNmM4Q5uLmmqHxQVTQfcXzjDPJzZEIUHah6ADzbQGIoX4HYWtHe6FeQDqYR0wBjHFACVeFBJKjEO6Wkorn-y0WYQoTSg_2QWanlREUh_-km7Vkpc_KyPcRGS0SIxS3YjwojUrSAxpNtRWXMRzmo5e7JVTviLF77SBxZdYTItDbiCYXF6tDlbCIa5nJZTs1ykdD1Vsh709rETru2eWqH3-Yzdrv_hAZ7MjGY_8PchFXGbV8I2cj_0ncBbWNVlps-ZUjdH09CJYAlHvD5ULaN3VlEBtJeuzHJb1gyYkUPdYx7XX7x3NzYnttXGJwMd21uDuXQf32_fefYLEXYiOYUcXjTru5LU49smoiyNXS_kzVGaNjU6667ZTe1555zBNH050dd4kKuxFg2gjEAjeDTRsSP2Nqj3G8H2ETKsoI244stzyUq_fRka3HFCKPqinGqxCqJ1DnfnZQo3gkqlznJFMNu5gV4lYMPB_EGF_7RjyNe-rPYQAbBMBe8or0YjyufNTG1RQ2VqnI1E1lPJmr39-K64gR1flTFF4YEFP7qMxTmaAAmp8veyYDrQMWqCcU3rWRWt9vjTEvjgy22vqrqUfSs25OLuPmy2FwUaa6j49lQNflhRbXK_KtUZ8S6DA5z3mNvB3W1FkUp7AtUURccedUxmvLknLD0TG3-ESI8nyAxJULiFB_BhIc4TVhnTbtbiibPd2BbM4G67ZXuUh4Yu3ehb4J6J0UIUVWD4YjCpvHfZonCUHvD-p092eG88uRHgAeWOzMoWHtPnAw513PMnGzOYYpineuPDKe8QQgs7PBfCG0t-cHv8eMEWstjVNMtA7tKcwc9FrO70-sVi2JS2V0u9lY6BlL50u9haAZT2eI_eiX6IJaxKOH0C1q09xkjiwTdqxR1Edg80JDuC9xT_ufy12K6FdfI3l_0if1Dl8lSJryTwkAL6totJLQxcSHUcTG4P7DHPthAwcOIGWx-OEYMn0GWZYWGbkbhpvZdLHHAo0JFSg9k0jOY6gubFz8a2shCRsf5cf3KgYWqC5-1oca4QbV_WCU1Z_6jijGvHd-p9HC2yqZdeI54Cmr16scgXcqP8IaIr0i7-FSbuziSFwqAqXronBG2DFrXorMxqRIN1JwrA__BZvFdOI4-gjEnIUfKo4V1UeT8skhvC1iMWDeM61zyMWEadF72q0q8Piv0BJJibIpkGb_a4UkQ2ODgpPJ3RSbBWGAYc0ycv_twopBaVYGu9vY9JSS6w0sXn9znQmmjwhLBiPdgy3yIwp2Wpgu6yskbJMJvtXgnaZPji7577rY51d_1_81syQ2BVtKnCqp1z6cffj-1HpfvvvN6rkqg9GTOcnJDK_HlUHwg8lx-C6-9S4rH258NdcLmUKkPrix8bpXfhgeXgg6fc9_UdJ22G2AUEv0MC1ljk1L_K_Bg9M_I2b4HdPmkdxCgV5ALgvg5isropsGJmNImXzF5F1WXUHQJku8iy97ytlbKuGK2gUEBxhQeYZauYzWDq6_JZwUO6VUiIcNitYypBNmuBS3ET-k7AbLTObEJyIrsmt8kOYCGtW5eiNIvB5XuKbKpE7ZhTw5abf_0IPtsoHLfOKQIekkuoxyvPNfphWg3cl9o_IuBWjOAfQiZkKLEWKLjoYAm3hCNkX-egVZpsoptexpY8TKd05IQ_fLj-Lr8m6TfGE0BFPMCxC7v6hnCBbjiDqv32RjuMEIbxGHU1vpoyOMaLCgcvpuV9DOM_4vAbxPhrn4Elz_VhdGNMSndUkA0OBkxeGgh_qY5yUckqeVD59xQATT_qBSAG_zBVOVoVlr_w0jFEfUXNWk0anbQfB3RYHv_mBklkHav6e17aLHopxBgxd5NYqRRhmh4gMH-Wr4oFMPWv12pPA_e6N_RgGxTk_8EzQ6V51Df9A22E3xpzjhCiSrdLfEnUNkLjGp0nfGqV2oWl6pauzdW8pbv1HjhAc7qaBSb8370xV5pedgYOSLe3kbh4fxD_vYhF26dzVkCEmAwTL6Ng92_7HDx599c7qGFiuZn5HRwZZyBed_q0MDEr7-TKlAddzTSBQzQGuz7KsrymSD50h3zUtQ9QK3-bWSMeWzxZMMgZP9CY0Ei_QtpfAzrHs-WBIjYVzeo0COCjwA4c8cdCo_Yuw5CD-W0xV5EgiZxXyjoOwKnmj25cu_KBNKRGssJFv_84m038MAeO-GhJnJkIBwsRKLwDOI7XGjxiStbs_fX9pcnhs6tCy7i3I9Xfk1N-yHS5vmUV25r0VWzYtFReH6nb5_OSnbm6M3UN_wyS0SfpYIQ5fWme78B1v4-iOTz4Bq-C0H4pCyixhytix8-vWqQ5UkeNVb3ytl1LcNFACVfQBP2dYulxSs-ZEeqPHZrotIxas95EHem8sPKy4s139u6lzzHecNtfcblQC7hHyhahZxfdwDy-yd0DZAGj2QCNsDf53-N0ehxGgL2AxnMP92laDfTlKoj17wqzjdJXT06y86QMkVA80tXbuIaN1j3fBfAQLCcdPhqa8rDFzQ5SbMDf7X4kzmV6AwBIbY2f4Oxsd3h6_t9sj5IpumArYMWIJlaFoR6lwlS1uFCuSnRB47-97PW32j6mBW8g7Y3kr-0JJB5m05m0d8f9rUGLpxVmUCZP2WmW_ccXGGG0K5MxjAof21LWD1YRyfPmMzKngRg33Nqz9WAhy4Hezxb4AE4-H9p3uX6C27P7ciB7fU5PiL6D3EGNm1YyWxqZ-1exqlw-esATOqaiFvjXMKeQb9g4f6xXJsdq3IfzbxmJIjhkFNeORd1FV3bdFlqy9wA_L-VNE5ycM5d7QMA9sDfS3oz3mS37W7BNzohWXQTz_IhvSWABcq8DTrZene0GvOQq0PhovRK1NGCjPYK9qh_d2lpXeCuxGeWBmHA5RVc5-7W7btFFD3xIFcpdm6DWPQalKC76WwZqNzu81sYHdfCUjIHAcffk-v1ZP8MG3XzfITpPi0-DIPwVYzr_YDB73tzAEKstzOFiGn36qYKTTRCNPtstxnzqK1C3wg35218-Hfm5Jr6dpuc3rJhyhSuy7gCxu8VlqN2uh6yjP1J1Am-7wKVTmKezM6yGiez6dIxaCcK_bZs8-Y3507_juUfXF5Zpn06zFGegvsNhwIKlMYosuIGYO9syM2cjFroqwdYlV1hu0pqwoJ2_MP7dQQAJarcXLfo86q_9rkTcN3pCgQwKMrdlNJwWokQHKj4f6fplEHTYTGwgAyhM4Pe0R_DMnwW27xz6_oBHp8jzore9y3D5dVBopnN8DazsHKB3JvF4HG-dnkLwhmtU_w&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=14078881567066325000&adk=943508955&idt=158&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d67ba1f3519131fda32c70ae335f3745da9292008812b8466d24d911f298827c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13756
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2712 0
0 79ms
75ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=ClBGKHcZcZYDbBYrE7gP83YpQ6syigHTh5L2-ihL6vZym2UAQASCG94YmYJXipoKwB6AB6f31zwPIAQngAgCoAwHIAwqqBMICT9CHwWCPCE3leFxevtNx9OUEembpgw7TznxHfE8GkLIFq87iiLc8XyMKi8BQBQEVf5tbZPIZi4OqYVmO5fMJbaCHZ6SL6FvKoGosENgqLRMn9NKXqTPVroN94FRfFnNxzZrdKtrXwiYP0LOpwDwb7s5sYBfKlFpqGhWwxyIEeJjyOU-Hr4ANLmW8tbpm7SzXvmxO2oimmFdsX2u7iCkvY8bS4iRLEuCaYxZ0QZzfkpHt6Cy08BlE0bw-l9_Cr14oBcj4op6Wn8XzIJ1mjSg6OclOR4QeW23KkokEsit6PdZpbdu3pYfztK0jtwvnXOob3xuCk1ZhXzRtFrAolHkQkdkQ3OLYzco29N6CMjCkMzzc_oqdjBwEoMSNbFQPvxRt__cRtLLF0P4-ssbGmmtaOrFDkvncKtCId4Ub1KOGW_sol8AEi4asqbwE4AQBiAWhgY7FTJIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAfSuIq4BKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEELXMDtIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqaCYwBaHR0cHM6Ly9zZWFyY2gudnlhZ2VyLmNvbS8_cmdpZD04Njk3Nzcmc3ViPWdjbGlkJnF1ZXJ5PUJlc3RlJTIwRmVzdGdlbGR6aW5zZW4lMjAlRTIlODAlOTMlMjBBa3R1ZWxsZSUyMEFuZ2Vib3RlJTIwYW5zZWhlbiZwbGNtbnQ9c2ltY2FzdC5jb22ACgPICwGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQLiDRMIudXj763VggMVCqJ7Ch38rgIK2BMMiBQC0BUBgBcBshceChwIABIUcHViLTg1ODYyNjUwMTE2MjQxMDcYgdQc&sigh=lc0wrN6bcIU&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&template_id=5000&cbvp=2
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 65ms
35ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 22 Nov 2023 15:00:45 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05AA 0
20 B 53ms
52ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=817290403295&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05AA 0
20 B 52ms
52ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=817290403295&version=m202309260101&ct=77&x=1&cor=5792267097212196000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 05AA 20 KB
14 KB 57ms
54ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ANIS6UTHUKpfE8Hln3tq6nomZ6kNrt0LVDu2AP4m_t4w_gs1EfUTUY0D5lk5546Cp9lzVEMnnTNZrqdVrAtnkxtqP2rwbNFobGvH5KPAwPMDqfSCWo1JGwWnGOIymrvpsiFN14kULkvGRg4Web93_1w1fwCk8yr7U1N2--uJqOELcz6Uk&cry=1&dbm_d=AKAmf-DYonBe4kt016A3o-wFN10K2olnssSewAHvixk03UzkuEtlZ1viGAWFo8APW-A2fUX13MYbOrlcMycob_kOfvhmJixOg3dyP8r6UpauocH6rfCl6_52rzRZ5--53XCfm4JgfBOjuo5yD-9lX8-mCA-L3pvpTladviIpu3ZorK287PbKUgEpE7--lojV5i85PyD-k_MIKBoS1cTXdu8H0L7EojoTBFxymV6ca7FVHAax2j7eMXGtK9GkCIbH6vUAooqJ_E1mWRJe6_RI9QDx9QRKUem27ZrqtmPrk8n3ennYEJt2UALR25vw-IsrNHLuti-8Bt8eD0MR-Xp40_bPdIAdXCnRuz5EyNENon4HxNmCPNpjCZnyJMK-NVuxJNfxXSY26qB_lJGIKLgJg0lJQXp0CPHo-K9Rvdrr-XT8DlMBGvTTKptajUOAIVFa06a5nlZFwhoh0g-MfQxT_N1PD1__u-a-KM3B0Sx2X2SSAnpfzMgbxsvPTdbnrLuR70_tZsZlAtXBqhNwTnknbfZ07_FJ4KveU0U4w6FKjcFAAIFZXclfEcmTLHq_SPEFlhn_4rmHNQ5AoqETtir9syjFHs09mr869VoNYL2KxsRvPV7ukmsOZvZofPXKAQQ9XGytlDoJD3S5DhvjIJjkNz6NILAlTn_qRhX-_5ddf1RSFFgaysAbJkkie84n_J4FKIX2U_ItjBzADJ5TU7cAB4gp8iLCwPiyqFrsTpxU02ki-Y20yMKQVi-Gb3OtiXaRzo8IVtw020ZvG0I_VQe0eH_CIq0vIb4mmsX8NELMATXSMKkcG_HDcoSnDFBWJM7s2Hb4vHieYrF6LIEurRv3FlIROT2megbWnWa-wECFGU026hITTWS7I-kRtF27-7Sp46DcBu4jSpCIhQS9O2ezorf-iU8zd64ugSF-IqfAqg8qsG946cY-42YPc4cXy4zBOnZhv567szKoj7udKvxVgPatzNAeAZ0ot9ZOpahQUFyfJfav7bz7RG6jenslji4-HCcnH9NDfLs_F36E1wv9f9zjXPjJv1a5TwZuzYR2a-jj1ZfzSvBEq3IWp63sXOOvjMmXsDeGrPeAoqoRaao22mGDOe68gzByVPzrUUsYCll5whToBDv1OMgHql8Q0mnAUpSKwHx4gfpQ9-X7uexCPKmQuEjek4stTYb7a3iwbLWPTpnhoBho0VdfpCiEagiyr0sV_BWUKEGmTJQSF3Zh4GLN2M2cgECj75t1bKlCNefBkO9T0dEgDkXDwjmHGqjVyy4FIJZIW_PFq-IXvcL1JJbZZVW1paA8sZvbZLwzWlcz66ygUrmP4R5yHqjTkLvMTXHnLPJW5eNqg8b09uoifD8A469cb6oFKz6LFL4FK2frInt0o9AHPuXCn1P1qARk26y1obCMYyZgTmpyAFxHOcpbf7vUPVtVCd_VEHW9c3AyyFdpE52FJVVkzTK3dgUteyiRTF6PZL3LJlqyKQzeXeWA2uKE4NUmW4z4dOYmlfpsNZSspHKHzPRprUihO_n6IUlBLSY1zDZVBIwpbGoTkJjGeD9XxrOQL9IZV0cXIkHdk0wDoRqDDxdYVLRuNJGSUfJwha2CUNkQGVa2kTisWGE2bqXMM6M25ocZLzGzApGof-_cDeUz6nc-lrUclcTl10Vclm2WRDXbRu8LlD0rpVisSKy-478zNL4bjB-hwd1ql44u5plKe7oKBYlqESxpjrjPr011huMgtgvXjFnfK44V5oLuwHMMHOVuu7fPW_7fnoYiWhhb3RC2ow5w9ZQ1cPp5A7Z2eaMJNBheR2YgGBMAm7Ke670JApKOyL_-w3TcOl92oUVOqZ3oxu1CBIaMkNOk9toIedgLnEafeA9DPITeFRMD5scRafqAQXZdbYr2rJnxnYbZztv1AArjZ2nZXmcqj3FLFNIv9e3Lv28IygbN8PfZplB8O0sfbztWfT2e65IOCw9-Av4dm5m-tKwKt6UNxQgN1oZ8EP-zoOTesYybIXL8ZTja0XpgMPdS_kloG8gA5kSjC021ziq2jliwWYA741rluBob4dhqPmJlBgoE2PjW3vx77ilzvIpccXA8S4LJcao6oMrCxE-4qBanifpY4fDMxhJhPYvlJsOgyvwcJ_sUMV6femmEsltDnO1qKhiexs82uXaYPL0IVUrUf2eLpa6cNJ8u1pKlK728lbRz2dejCpzUGzhMQfrIRq2rAfvPLkNBEGoWjwxCbVYZNgTL4rvj2oivWoh475TSKqB1w4zN8-2k1dPe1umkXd6AdtKX7FwiMarPkgUIb-WWYdBl2TATyV1gZaQOYkIo22w06LB4UV5ra8JWc-p-yVxMXrXv2_snEyXwwl68zGbYJyZ_iTxVHlU_MRX1GKjnHxlQniyizLzRQD_IFW_3gJmoX113uT8-HCc-Bco_1_24z7I3IOymFwjhu4nhnEhNjIQJVGxrD7iK7SErXrw9WTpAmHj9ovZeVRl2AhsRFNQwlW6x6GqMME8wnFc6hOYxAu6-qoIW53izdaYYy9MKYveCvxclh40epvG3n5hdGU6d0jBXZ8x86Y4q7DISAIiYUDyYrDKd45bmPnXkhDEypVyZOovO6XFJ7ZEaN691tfrV2KPiimu4PHsMoa-mg6gD7gO_o2OqZr9_Rtn3gowZTV3_iAVigaOKKORNvr2xvraiYHl_MKmHTK4a26J7BJ_pmya43SC5EC9PSblTYNdklLuZ__8jYZmOwRpTTI6JXnMYBqwGvsBmUfFPVSp9edbF0D4rIIzhQRqcMUJkL2FZt7tR1FaT-ovVdUs2al71j1usgFUkWS_epWzhB_lbtCU2Q1fMfTC2LeuIuIadF_herynVxjHlcrQ9t2Ex3DzlPoXJipcT9Ey-w3oSbX6ZbH6jSI3MEvGK8elQEv9FdH1pwpX6JWjvy6lqSCgsIunV-2-CW8gTt9dVH0AEMEqJ-fUJaTqqNpoLWWyVM3ytQFDBw_9yUUHed1rGfoBSdeO-X1amA7ZNngtUvXl1KjLU66ohqAWsyQcxihx08ugn9n8l6I6yLCsfabVFZHitjubuCnPOXjq807qMTfIdIOsG-vTm4qohjokKzQSNeQhqOoz6ASr8aO2Guv3MwxqrKzCaq3mz8aNhbxN5d6FmpjTKz5PWglKJL6DZHHW9nm1a6DD2ohur23cvWJ0_kLZxvBzvE4qmF2E0OLV2KePku0-m8ak_yo1T04QYEs0qvdd9kSRNw2a9k9K2b03wKRJyFTNz9FsKmxNo0klmBcpc0pSIvW7qVYe7zTs3fequzDJ6Lugjz7AVgZAvhrHuoF7roG0eYXALrfNUYX824fiMrFWuK5hNEasheL2KfxJgOyWIncba4mn1qWqc1Y1Vae2MWAYLUkTNVHZ0KcwQh-jSuQxYf75aLNSFZj8ptbIJICFJXr9eXWgiKgKa7uA0SwDOGCkVCm7LPzOa4P0kFql5ZRtH4hS0dFCJILs0234YfxLwpvfCmosvUL4ziBtQHTCnC-cc8o3upm8kBFOMJwGM28EGM0oT7Y-vh2ERIIwRxjZTE3dEpmzll2hDeg3QyXkR0WjguWE2wVrzpcdG9L8gdF7g2fCGQnTMUpQ5TbVLv0xoyiHbnrVma-eROm64n0SnCZYOy1-stFjuzxb9pu1V9e-VJjMqxkZyWxIZn0AHDEWRVa2U6gXh5gj27PwSdRBKRPIV_DAsRuDYtqrxf189vKFduOeV6csdI8W7rsUaV5V2F6g01dxkyEHJxvJjypVubbFvi2FzH9babpfud0xW3MCVVX2fY0qVvmJJqQvzOOk8MTKjCVyT75dbXmHXdWX3ii7kcvFhhPccw6DloVWaHpUEm2h8_nOZ8a7udoyVdOx0i43fasmyQLsYxCIK01ySnFUpOoAfau9xhF_zo6nu2g4e341ePl-0SKd1keZML963TY61tC7w6H__VlXTWnhrtu8d9L0bii_GNczurLzSZzpZyw1yRNpHpY6Fvn6rDqhnB7BX_DoX8jS1MQqgXrJ61LTe8cpVnwlUjjTwf58E&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=5792267097212196000&adk=1033480531&idt=216&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96ad5a925cbbaa1062874137d01ab1e44765e8fc346863af7c45788fe14f62ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14002
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EE76 0
20 B 53ms
51ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2062271855436&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EE76 0
20 B 53ms
51ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2062271855436&version=m202309260101&ct=77&x=1&cor=2222850762562158300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame EE76 20 KB
14 KB 65ms
63ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BIEVOsDxNFxaeJMVhiUGNqJTBwaILn6C2wmkFWsAwfCPHtin3QDrF15AupbjcvyElM0RSX5akf_UQ_X4L_-yYNJtTXh2eMLE_0Ueq3g2L5iOkJBJEw0lp20EXaYfDGwHcWx9rTUO5L3w-ygRiHPHlKUAP7_04wkdzSqFh-KGAaybA6iqw&cry=1&dbm_d=AKAmf-AfnlmnX2kkcVQ-YIFCMlCL6adi0ThP3Usf8i31AYSNeSZUaCjqDVqrCFwAK0V9CcUCCh1bfPdmXFxZdEAIug9n6MThtO_UVxPVRJ0fQ0wcyOhRRVoA1wjkRhg_2QDLG-aCM1plKhGrX5lzYn_RD43w-KRECe86YgbVYRxjVujm0hERSSKKS3sjPB509qZjKwEB4wOdZzfaYCau5ZtKY78Y76DVFpL9FfQ6Dje6Ij_IJQ9nmXy6TD9eKOhH4Jhfg-CKa2ivQAxoFZCvlR2t3lEwY-ZeKqpYwDakEmCn1ArCR8dxe4KQ5S_qpdTFnsFbuyZgOIv8pUUyWpvZN4sOoMYmbVRykbbhwnK2Xyu50wy526F9iQ5IXBCru60xXYF40NHnEse2Fe4fhSZ7YK31TYdsQZux7QdXEruxeeOI6ZArZrbWbcYJLPAV-ZwYyOEclNyiJOU9X-aDqGZ71usRaZrvaV0EZA2403y-kwk54fWoP2EY0biG6rQjlWDwIkCZ-VsCg-ODcudxdSYHTnFXv-k2p5OYVWWAgF3kA9JBVA7DS2wct5BqrZeAQkXP99zywAF1eODXsRRD7MkZRSO7lEhbtMjIeL_ILlFSAE1Ms3BdgfHMl6ka8Zv_LZ28QJ_XJ8aHuvBCrdO8rbvtCPPkizyz8ZdIqU2TvTf5mtcO31JA-335QJCdu7_OaxWDpLGqVQ-ghcmPpq422tZ80sl4AVd_b94BiNPrred_XnY88WMLuObjxJfHW1weDDhbI3RT47-iRiUSGKddRqSl5EI34Zj1Q2SjTMSx6v2Q5zIbDWqEkCOP-N0M8GKAtBiD9_8jbAd9HE-6Mmaat1A9M88vf1xwwBZU8jDEJQ4Lun8spH4sIeS_23mGVryfX9kcXbLcd7uHXKMokdfYjW-VTmrdZkPvRM3W4hVx9ToD5CoOE1P7x1eY_3pOZ3X-cQo_0BmCz4HCbs1VdJwkp0O2NIPCep7LhSzDrXGvfQh4M6agsbUiXj703VaFRZPgXBkhRgG1NeJChBAwzoj65V4JDCwFB-r2_0OduF_Bj1wgGUqDNc67cezDLi9a4M3jtxYGjoWOTaamx4iwXc_JqqKxgD9sCvep5hRift1U3Xg_ru8jPv3IJ_cbFVGEhlhNfYO4Cq9NW6mwHJrqRG1Pj863AzCNzLjSZKxomtdFW8CzNPYKqX3U1sknQZj3L9dzx0KJuEDWYMKhK1tGuVbc5AG-lsN_0AkYkdcAgJV0zwp819JN9buWh5ucPwPXUDqCE86FSGzK-7oJnxltVTPlohJFJs-H8dzvJjghG4yWdKTttZveINbt3XJtJPhsjf4X8FXeQ4SQWvUOKgbAxQUTGRJKXLMSwo59bvMbyTzWf9YgaVPZFGdFqY4AkdbnBcLaKjrc91yLxawrwTQZ1C7Mr4zy3d9YtC9cyBjEpPz-kphRF7iiNuFowf3_NLgI8lua1ThBXu-H3dBQWNwVQBEUMYyBBaUNG4JxUdMEYjyLYDqE6jKZ6yOFZG0LQdM6F-eXnoQ5ZveP4Ls5-By19VfdJHYgNciExPYN7KdCWDd5WuxLE_rOk1PjN0q06nwYyUN4ORKzSdwgVA8dWCpNyRWOSdPxzJCubo0kjJs-whlVmzVwD87bd_4mQd8AkiCSXslwjgz3yIbgImITauJFgPJow9AkZdZFqJ5TtS4yFmA8oeUtcAy1IroEbiR0hYxSs_gF9i04fEGlX8jImxVJHChEkvZHk2TElOUfBhxy6eAxpDDWvscKqIoQrPuvsEmiwFAMuOCh5LYygLJu36LTKx4OWUjLnu_pJQi74Rl8BcsekZ1o87IESLX00GcrXABO9WL0eLvt9J03EuEnGQ_t1qCm6dxeHQPWXeh3d_CZZiGN2_FPcLpacf6kTLplECoXu7nNzITICTVWLZSFUrP5-UG8YQXxgORgNOiR3nje8huXSDq-lUtAau36VTFmhT-jOoQQITVnZoupYvnPv0Nin4sI8HPn0DxqthA_xhtg5-VN0J_M8pROH-uuEqO7uQFKHVi4od4xPD05NMgi8e5xXZquMD3Sm_XbJCjtyUkPz430m_hFMxxxgNzJ0j2q3ExMW4XAiqAXYfYslD6F4Mxl7mnmyaugHmNblxnbagDBXnqMamsDpb4lkiJ9qWJcVQ4-6OAwdlQELSclXENlNNoIsE8EP2d8yVQmoRg7mBGjLEH0yV9Q4ooU6d-1PRiI2ii58eVEbVNh8AIbN3qPLskPVwQrWNIpbfx1MypnUoh2NPMB3VEvk2AcdyWo2ufO5Uca3_xfitjBmfJh1hMEX_l-pCqZY6w8K1TnHmv6iUQ8OUQVeDRvgBTRiyzx1V6UZLuuRu4TGlN32AzvZBCsKtDH2SfswyAQTuS8jdyBL3seIJysQCXm7NKWr8bvBpIG_ZrNGP-zHAT5TA4N5EhQmKOTjx1CwLW9ZVDi88mNawCHLpcPQwasgGNLKnb_V0aRyh0UjpPAYP0Irm2pzU9ngjuB7q7YJJZNlxQZu4GNIx2qWJknqr3D7Pt5kmtDZEvVv5hVqcUXxOFHe0cRM_II5GTqfdLJQyiFmDYJF3A1latRbMhfeBFWx9K8tn-vInIeBVKlHk68nmwi4lYLu5fBJAdQ6fBZaTkhQQ0ZfPEYA_NrdkYJz7ez0hnxxQSUzay1ohnmQK4gq9lQYPfW70NnM0iXJJATzQugZwMliHE-3fo1OLMeBdxm82g7A1MT7N0PT4ovQYzw3X7b3KJbCV-C1_thpOXbNYTC_UTC8x5FwtTBAFpUxJrIDp0ZWSmR57Q5hdi-69rzKuqvXSo3JkxbQJbiuWQOLdD6K7l9fR-Kp-Cy9bAsDcbNDMeJZz-6jq3L0as8uSHj4KHTp1QcWIG6g1jPb4gUEaF7R4GtcIKHAfahpX8iCUk9-z_qf0A0SJ-_LnravyncgyEvlay8BYjaFSKtDfAxXfHl7irRA_7KA_k1_QeMjA_LWEXkIdnal_EbxYi_s0eUiYJqox32p59HyzpD6RG4C1ZNa1GpD2Cf8prLoRPYo54e5P7Ub6H__7BR-opBiIHrhd8rVkfMCFP1LFhQokra8bLZ5avLARCdTGAlGgR0C-coWKUGj_0bdgQ4j1YlyvFbI6nUnZyWoBig_Lbm3ADs28lT3HpkHBKMzUQe9NwqJrO8Xgi5FaHKwdBqR2lWeAd2Vz7c2xPx4Ozf3vG-wp0K9JgaB2opYIY_eXwV810agj3spjFe6iH9r3Hi0EjsdTI9DDqNson7uGvhKZTjqq3SNgvFiAasuWqKGQWf5ncmjCNu16vXbFu5LmOeAYE5hTd48efzmihqMssSwKXW2xnRc6jEV2JG-VaNa5DPVgh1K-VsqVOZ41HfEQgckS0rgceon9uNhIdK9xQCxiHoWdpGBNJKc4_hSb83pki2hRtgmS19N9HZq91SPpDsXmWt17om_X9FNHJCZ9RG559ytf6VZg2IEfxjvgDbsE3c9uxWBGvg1vsSR2MleYYk6WuzC2qmay0pLo5BhrHfcFkuowO8inju6oFdsi7mA8YB_Kq8V8Ia_MkCh0kyR1trPrR9aYqK9G0kmXTKbiZtb0G0vaERiMS7yDTKWskxrFNSUJaXDlKkcz2jWhrSRWFszuuAsSmrgVJoBGw_QLOGbv53fNnt7u8WRMWQuV90aHnwqYObgDnBZJHseuyDQ2dbTTUub2m-y22Z9lB3rUVgq2JemWNvI3IzvQgPomuj86VycVfnYQm6wi2XLIhqWyQc4VCR0Y2ya8W4yFdi5y2n55X5M8TSrlohNfMTc4Eb-eS0j4xHzH2gxl63jOu4Hv2DG8knKO1hBc588BMINlYmfvrrDFa3kbPILoRn2JuvvS7_sLcV-pNG97ewfuq8wyK6lMEXXVyFTjYhdOkOQlPK63Eozz-9Nc23NnyXYhHGzgKuaF5TrYsipEYg7AqINBoxOlgOXLgU0npXjLmsf7QnyEFMxT3F0xhr0J4PZRcD0GJBDN4Rmlb1qjFvpVgCLGwwMmMJ6Qf8zcit-TarFpV52d6K&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=2222850762562158300&adk=3690638929&idt=219&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db0b228bb5c1e2ddc5ef11bccdb0406412b01912f77c97db006bb2ca47f0aa50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13922
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 p-5ce3b907.system.entry.js Show response
tags.qortex.ai/cxo/ 549 KB
127 KB 47ms
41ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e41780e3be523fb5a473724fb211d62f1895023465dd7da82bded927412d2b54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 68
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9oiXLXGqv8LhUk69NdU73U8BsU8B5cLUa26sj%2BtuOufRkXoAY68GsQlbxlikvdZ7sqmd5HvrPPYFj1Sf4%2BXiC%2FfTETAXtqeUmVFZY8mDLsDL0gmTUdh4fHaQCdZyb9B7cD7qSbPwJPxWQtar"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cddb9f213737-FRA

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D408 41 KB
14 KB 29ms
26ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AHDhwEElOEhOp5ZlS-vSQU4tpXV235JY-b0BYOmW-nC4rumUCcZzsGshzT4ERR8i43F6GU7my1adKa84-VXiG7Crjot7zC3wNPHbkk2jm9R3EJpTS1wFdpGycqxTU6Sqx4wLKvOSMx1eUJbzulQ1r2XNX5uBewQInG0_yuxGPSSv1C87E&cry=1&dbm_d=AKAmf-Cio-D1fjlcTs5oXzrPPEbrsjj2hUlCfNII8Xglpdj5n297-_wLlCQF4anyoSw8ECeOMBAQ3ty5HVn2SJS_1DT5RtSLKd3olmqAA1Q2qHeWrYnyTd_uI7B_RLRSXNgH_jfIqKLzJPWzBWO5u7FSju7O2AmwwT7GeGgxEqX6gpnGXOanUfaRkfgGkCAPNbS3uqIYL_HZLTnhG-YogpQcILtJNvCl9r-1kj4RLpCTll0Cjd2e9-SmUJuAy9TF2VtKIrcdTXB8wmDWqvUkylfb_jnaiTgCfT4nUWCLM3fTfXlfyWXxgxsSRr7r4w8sV1TCjscIgWK3mCkv0ZXRatKtC0PjLVP5dccOsQUPUv6n_eS0SBHqJ28DfUxZISYuyt2K06-CYfT3n7Bp7Cs1s1euLSHoHJkvrDAeU2bnAR8RbjgFfVgeXK3CLJxWyaRYvp2yJlWtxBol4C7I2zmOrk7Z_jYHaMde4KCyOTsLO8ZPyuwIyT2HAHBjDkUsywec8RZfGw-fw_qYdIeyn6sMHKyP5MAsF7oBEtV4eHUQRbHXpKcQL8DP7PRoS_6rwpaAprTyjD78x_xp3zXRqaeVJQpP3_UaIQVqGlmJBK1DvKPAxHTHjQovrjH1H_ruD2_Y8sLySVIRGU9dE5rERortNhnb61NON5ULbzFBE9wm9caYzU32Ht03PWaXKD2TdTFY3fS0fTGwIfrNgLmpnF7ijvhWLQ2q_CxW29ikS_bmrulmDZzfyI8VBIb_u6y53GdoO3NC82eXUb0NQwCE7TMkYTRSsssPgT6CrOXxmqhF3NiERRPASmOECGjurj-y5IQEiuw67O3T0c6yEfygHqnTT_r43SnXKdiMK2xWwv-3VukcIed7BUF7_w2JLmfrVRxbL1KsmiymfMdx56D5hZxMMZGDm4k9rxA43-nnRcujf-fEij-1Ak1DZiImuCaISbSNs-nhhe2mOkHso-xwLSFEqbEkjgZy1uqI5sTQaXf0mHA0ekt8TEHIql9ebvSyDvdVIaMWeDK9Yr-XybLlaj-MVLh2hcLNMmDXbZ7w7E2MJ70VQ-y3Lu_9ld4D153SY-ToFXWq85fC1YBluV9AJnU6BY_AX9DlgTIMdVEhH9wGt_DAs4baUbxOOUQxbTFUqi4iqq0kiKWqyxWQhnNwF3dDozCcKPoRNC5Tlmp7UMDbocMBs0JtXT0vakxQyL3yQlfmuG5bQrmz_I2Ab3vqTGuY_0tNqeCnX48dPTKJywYxPmQuZwoyfCLYMiCrdn1BZUIdIoFddUKqD72ABTn5SDricHJjIOQSKyObe3tD0VMqiR5eWsXwKQ8YVC52nkqwcT9ryXyB4M7NGpFRwZ6oh9gh-nbtsy4jZ0Zpzvmj9VfmVmQdbj7IlHYruRLex0GydV_Zn5VSY-BC_laE6g7oUnlhBrAJ_HRV-B-2rDRsVrWECdpR7crdqHaxLlC6M7_yZfr9k6byDQJhx2G1TkSG80XlwhQ0fOACzL75ty0r_c502vPOZtRglYr9c_cS5a-PVU7UW9u7iH0M8IBsEf3VhH4uwtTejYRPPWTWYC4J44GBFw-yG_WqnBdH-HfTWERW5oe77WM6S90ht3MATZumgFrQ8zDMQmn6W3Vhed3-UMldbOlEQuQ72fiT7jv2WLS-UCrMLSZnujQoqr958TLGYTcdPyLWYTtM0FVCKSK1Tzdnc5F2jK-qfumLx1qKDHcA4bdB-zsr7JD8MAsM1Z4b5R9n_PpP0ucC_hsgKI4n9noA7Pot8Ueb53j5DZ2-tpnHE6iIavdXL3i1DiemKElrX4CClZ_VXFPCtMA6kIqOwnVYcMIz_9cfxwLTO7kL15hHpjiqd0p4Ljt7xk4PvhvbFjePqcInuVYoGREK1-o-v94nwtqLPdxS-roT82zDybDZv6zkFK4YdT7H5AvXalQYEsHTfTTujHtC3_vWT6JkTbOsypmlXvsZuAV1kMYHb3D0dpNIZ9NNoztWYEQ_fUplTKhhUyB_Ll3CVI5qqNtZqVHs-E1pJinwmd5WXUxecI8LmcG03UXnZqFn1PNXxTu3QPJ-wUbFU1svuNFc8IcQ3KzZ2m5RgNtri2e3O1ENdOPpRIqfjHk_3EjTv7oWrJxHBpk4VUCdJogxffEa8dQie6yyOZ_4g-lm0D5_vMwcAEkQHZ5fA0GfWUvgqI0QvE73DDeLZ3TakymrOzts-4BaUGf8LxOYHgP-3x6F_eO3S93GN-SXdFH2_Cu_o5zv3CAUkbn3ZkGuoLVbktnDqn8w19Hp9L_D838Vdf2wcrf3UuEpT1NYZ7zBdVUpGvJAoMV7nBcRmPCchPaH26t8ZETZzmHVtSjN1_t5Qs8QhESHIEMz6P22rT4cmMDVfxcwdw7i4j9-IRABXFKSKcXzgt8R5LYyF0enL-5kP4dPF-fuewi1-BGSFe1MEL7kI-tzhZ1YPtNAiYtFQFi6B83nhgORQE1CWga1AV-97PARV83GJYT_rxdsYS_B3BZtU88nc947js6qHCbrczW1mJhQHfRqJ0_Va6D-QgAnypjw_VnToZhx2ztcuU2zGPPBKSvRiiDGgC8cROEeJyfzI6THkEknRrjhlHKwzW_S-llNCdMJDHm5U40w5mZXMaQnb5OcUeixycDnRzHomeGWaJqZqQ_CWXpvkKZNui5a_oxKBPAIFXm-XWw-HBhpiKen1xnlrAjyCHO99PdnBosgUcwXsgF1HeFr7qa9G8zXSQoCvw05E5VFOcgvtnAKack_M7TfsjpwP0-Qk9kzbEAUwNHrCIaBXShyxWBbFB4143n2sCgujfrCiDKvhc_sGCJqVP4kRnDa7Mb4qYHqc0_p5oMvLbgNGJ662Y7DzXm2m0nUxDR4x-bKTsCHrINpyAKRem4F4PMqmNcFKvtEvcXmgAbqXGaQ6y_wzVZ0k_q2BJEXfARxHLTtAj8W3rIn-cjz9V0vv3QGaIWg62S6RqosfIKIvLhc2ro_jnlxMwiTv2VewYrln6LyPFNHmmvX7QygSymLgW4npV0t6bT87kbJSzYG53WJPs13gfz6FiHoZ9B5kZP8gLYGLlWNTMZMisGYr-u1ureDzuKl-x1P8hWZrSZgjeL-7YE7Jz-rnHGxBmLv-WeJFccH-q8A0Dkg5PaXXXf5hj30BSaqWn0nFMd4EppduQtsgeo0v8RrjV02M8aZDVXbAKu9nmBAq1-YgyweRzWcGS5b-R_tnoqRa8f9MUHwGdSDQMQxqeYW8QiP9yH4QlpkijoQzMdWg8RXcJF6sEBzhXVHMwPINwhgsvg9ChoNceHhBh3Lpycfi8x8nmt_bAYt3mWef-_0umWMiz73DtlkeO07SGP2SK-XYhuGcE-WPTpRl1L2AeeinCtlLCn1THsI_2222B1t9STCADd22cf6Xp8vITtjWDzw3eOq6pldEtM0v-5p1VNOXjXrKZXaewGmdXF6_-dQVIz-gSwnK_9WmYVdxrA38jfQeGfVdCarN_FVuek1cYCl0DkF5UcvxGMzZPzpI3sJV-P8oCN3TpV_PGIl10mMdk5nwK0jj0eyCLiI-4_0VVVy4HiAwBVZur4W6iIhDxbG5n_Rx7xMr-w_9wSyywpKiMxsf2YzlPhscbi-DgVTs-3IThdLq3j6HFLO0X4sKVS3uDM3TPs05vZY5q2XiloBYsdKG35HUynCekX0FESk4GtAtH96BtCREhc7euylXlubLw2jaE9GadYbFgZwrSttkLAAnXlvITJja9uvXV2Bv-E7KQ_YSmSRWgyCCbo7RBwdZ7rs80ncZWlMCBhwu0ZM3lEa_elcMURNwtSet_Wkt-nYu9AGR8N-faAUYhYYqMhB3Im4PZNSnbgXz4nAD841uoEYfrw7DZZoDAYNLr9ZFi8_QZ7R5zNYkvxGu-hL0QXjbAyUPsVYGVwCOhwrkPBvyd4Y3o478MeJh1eUgzz5cvarZzj32b27YM8tpD2liaW3P7ldvmigAf0caEM4J5PH8s0b8erqNejHMswmRETeAKXzbEfvFJQVvfq5a1TA8PGADouH7teVR1qW6MMoHuGQnP9rX2-A7OlYdQ&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=14960327330844477000&adk=3944675600&idt=119&cac=0&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25314
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NTkzOTY2OAogIHNlcnZlcl9pcDogMTM5Nzk0Mjk0CiAgcHJvY2Vzc19pZDogNDE5NTA4OTQzMwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame D408 0
499 B 215ms
63ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NTkzOTY2OAogIHNlcnZlcl9pcDogMTM5Nzk0Mjk0CiAgcHJvY2Vzc19pZDogNDE5NTA4OTQzMwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMzAzNjk3NTM1Njc2MDg3ODgwOQpkZWJ1Z19rZXk6IDEwMDM5MTAxMzAyNzU0MjQzMzgxCmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyMy0xMS0yMSIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMjU5NzQxCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMTIzMjAKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2FkLXNydi5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9rbGljay13ZWx0LmRlIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0x5f0c1d01f29745670000000000000000"},"debug_key":"10039101302754243381","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"13036975356760878809"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame D408 12 KB
4 KB 166ms
23ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1700578845093569&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmqNpHcZcZYHbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9AhnesWBchLU0dPCEl6xd-ZFf5qy1E0DanOqT0b9ZZPaEDdapxOTga1Bye79vODRkXGZzfRGZl_43XDvT66Wdqpis1FKvzdlokPqpc7FivU8qeazbxugSVDYrFoGXpEixWI5Ld7nORP2eT-atW7E33GyO9FWoUeiXtVQX0KqHph7ksz4cviGmQiS7Wt25b6ymhZR03XBU14z6Hm9fIi0br_73qixgWg0HUaoxsVko-P31LXOjrfj9sDHNMoRP8xxykbBWRoU2vhZtraqqtvl6Qex9_3UgSsILtxpqca-UL-PBPoTZDlaNTkfjZGeMJkp5yb0trfMXOdo6bxR_g4gsSLrVWeduZO0gXhdr7PILgoRKQbKt95wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIutXj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_2tDjD1rltF5C7yMW_YeJ2Pp-kSQg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-D_zHx_Y6u6ja5FOpOW9cbaj7KEC3TZFbo9W1aoeq_8Gj3pjl684WiS5BVYmjK0wtKXo-vSxOYsfwPEBcCv7NbmS4hcwbEKGLF7Lz392LCcqFqUiwBSrJRFtZQBgtp0Vx2RDeR4eHNF5QB7xnIB1PSEgg9EQVUIfC98xJhhV_0xi6W2-nw%26cry%3D1%26dbm_d%3DAKAmf-DPVaTofoCIq3h5qoYODhjqFGaf5sglwEsbgZN9EgROAWVJ6_iyDOfCeXCvedDs-zHtFHFPbwB8lsJ8BclHwAl_pK2_4gMxjqj5FsGEA1iwH8jPioVYUpOEoZKAljqfXq65GKfCrl-AAOxBa5_-ff7-oJDeJnK30OPm7-c1bxbL50L5a-mqHbU7Rptoe1XOtgcRGznQyA8iZE1Wf5sdu_XrSGdtu1GCjEDdrHEj2gO3NfE94iHbnzGSwU5-bkcgVf4xxd_WA_O3IQoDUkIh-E8HQsTUBwlR0fjEYx7uvH9Ccru7epSf3elJkIuvUrISaFFwrcUZ_dp1NWDSUAj7SQnNnID9CMwEhZLtbl8UKXkCt-MhNGSH-7_5D1HrZe1v7MMNdAGO8P_gERfJTCFt9V9mktnv5-YeW8frJ2gemSF7_QUMNt7TcP-Q_uWIxNS8G2KIXnpvod_Gibyyic5H1H75II3r9yaaaYHwoM8QptqsH1rwaGTpbHXaaGyvnOsNdmnx_FnK2YdKSycZCI-djfgbULB-NcaiuR4tgQzYurQHBGI6Ie_O3bQmLoDwqTJ2sM7xLuIEBvruD7XPswMxSAo-OaoabQ%26adurl%3D
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 98ccac7d0a2eb7926bdba4924e4aae4a00b65ba08424c7458472bbdda43f9d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4263
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame B32A 41 KB
14 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dz0i4At6eAgov_nFuxIPYVuFHf6u22-AQf3M2VmnHpgIz7TOV1wIMeijxlK-QTqikjbpztzUMSLX9akHtEZBkvBUwrpn5tKKRW2IoZtJ3zghScS8lRepYOB31gSAFYjMC9daEOcy_2plrTWXbO9BI8aoaFmR46w0Rjbnq5RqdGar-SpTU&cry=1&dbm_d=AKAmf-AMttu_EDKWpOCTfh_Y0q_FJEE6IvySI8R3OPnV7C2zg_2r083OaymZW78wh-CwNS-jDwNcv3thNYVvMuOg1a7R72HoqrqGeE15QT8J9PKok-y5eCDdG-PadFSY_-cPlF3GqdHCZY-L_-ZgvwkYpF7pH5qadMUwfA616b9CKCgQzExV_cpMj-NJ5M0BBBNXls3wQyi_aQYoklkdB0UECO3u-Zs5Up06mf7NsaSCD9SrzF4Ta0Eyhe307SFg07FCQpz28143X-MqPejdrZEAAMxhGkrgq9re_xrELC5gjTsxhjZKiickMRaTPDEuR5FReCwGqSbP8h65E2YQklHX57BYZP07F4qIUWw-o9M8vx61gvaD9LkfmECxAKTLxnuyN6O905igvT46OmtLdgPTrTEQOIUQSHPf4Tdm_dELHICWZtWtZwDuxVy8TxGlH9GIZj-9Eb4IozGLtI5riLWGaVPdHT63lcj5A2KzsYXCh-JlRg9-j4V6fAQOhy2BiS9Zg_bl_UETZzEaJ-dmYHlUpZadw6qHFt-VIkK_ZpVFNbgZ5bJseeLEWHLS7nhNPM-QLNfr5CNXH0NPNccORhAtDuZai3XpVQ5RHQ1YsIczVGVdPfGPJKEXyqVh0K6h1AeaPm_qeVnRR9mhGMEkjgd_XZof-dnhGae8znT8fIPZtK7CdN_LcYeNXiFJ_Lx3k25857c8SHsrDauI6Sxx6aJeNfE4MZAiZbjcYUOC3MQIezGOC0p41z26oNmM4Q5uLmmqHxQVTQfcXzjDPJzZEIUHah6ADzbQGIoX4HYWtHe6FeQDqYR0wBjHFACVeFBJKjEO6Wkorn-y0WYQoTSg_2QWanlREUh_-km7Vkpc_KyPcRGS0SIxS3YjwojUrSAxpNtRWXMRzmo5e7JVTviLF77SBxZdYTItDbiCYXF6tDlbCIa5nJZTs1ykdD1Vsh709rETru2eWqH3-Yzdrv_hAZ7MjGY_8PchFXGbV8I2cj_0ncBbWNVlps-ZUjdH09CJYAlHvD5ULaN3VlEBtJeuzHJb1gyYkUPdYx7XX7x3NzYnttXGJwMd21uDuXQf32_fefYLEXYiOYUcXjTru5LU49smoiyNXS_kzVGaNjU6667ZTe1555zBNH050dd4kKuxFg2gjEAjeDTRsSP2Nqj3G8H2ETKsoI244stzyUq_fRka3HFCKPqinGqxCqJ1DnfnZQo3gkqlznJFMNu5gV4lYMPB_EGF_7RjyNe-rPYQAbBMBe8or0YjyufNTG1RQ2VqnI1E1lPJmr39-K64gR1flTFF4YEFP7qMxTmaAAmp8veyYDrQMWqCcU3rWRWt9vjTEvjgy22vqrqUfSs25OLuPmy2FwUaa6j49lQNflhRbXK_KtUZ8S6DA5z3mNvB3W1FkUp7AtUURccedUxmvLknLD0TG3-ESI8nyAxJULiFB_BhIc4TVhnTbtbiibPd2BbM4G67ZXuUh4Yu3ehb4J6J0UIUVWD4YjCpvHfZonCUHvD-p092eG88uRHgAeWOzMoWHtPnAw513PMnGzOYYpineuPDKe8QQgs7PBfCG0t-cHv8eMEWstjVNMtA7tKcwc9FrO70-sVi2JS2V0u9lY6BlL50u9haAZT2eI_eiX6IJaxKOH0C1q09xkjiwTdqxR1Edg80JDuC9xT_ufy12K6FdfI3l_0if1Dl8lSJryTwkAL6totJLQxcSHUcTG4P7DHPthAwcOIGWx-OEYMn0GWZYWGbkbhpvZdLHHAo0JFSg9k0jOY6gubFz8a2shCRsf5cf3KgYWqC5-1oca4QbV_WCU1Z_6jijGvHd-p9HC2yqZdeI54Cmr16scgXcqP8IaIr0i7-FSbuziSFwqAqXronBG2DFrXorMxqRIN1JwrA__BZvFdOI4-gjEnIUfKo4V1UeT8skhvC1iMWDeM61zyMWEadF72q0q8Piv0BJJibIpkGb_a4UkQ2ODgpPJ3RSbBWGAYc0ycv_twopBaVYGu9vY9JSS6w0sXn9znQmmjwhLBiPdgy3yIwp2Wpgu6yskbJMJvtXgnaZPji7577rY51d_1_81syQ2BVtKnCqp1z6cffj-1HpfvvvN6rkqg9GTOcnJDK_HlUHwg8lx-C6-9S4rH258NdcLmUKkPrix8bpXfhgeXgg6fc9_UdJ22G2AUEv0MC1ljk1L_K_Bg9M_I2b4HdPmkdxCgV5ALgvg5isropsGJmNImXzF5F1WXUHQJku8iy97ytlbKuGK2gUEBxhQeYZauYzWDq6_JZwUO6VUiIcNitYypBNmuBS3ET-k7AbLTObEJyIrsmt8kOYCGtW5eiNIvB5XuKbKpE7ZhTw5abf_0IPtsoHLfOKQIekkuoxyvPNfphWg3cl9o_IuBWjOAfQiZkKLEWKLjoYAm3hCNkX-egVZpsoptexpY8TKd05IQ_fLj-Lr8m6TfGE0BFPMCxC7v6hnCBbjiDqv32RjuMEIbxGHU1vpoyOMaLCgcvpuV9DOM_4vAbxPhrn4Elz_VhdGNMSndUkA0OBkxeGgh_qY5yUckqeVD59xQATT_qBSAG_zBVOVoVlr_w0jFEfUXNWk0anbQfB3RYHv_mBklkHav6e17aLHopxBgxd5NYqRRhmh4gMH-Wr4oFMPWv12pPA_e6N_RgGxTk_8EzQ6V51Df9A22E3xpzjhCiSrdLfEnUNkLjGp0nfGqV2oWl6pauzdW8pbv1HjhAc7qaBSb8370xV5pedgYOSLe3kbh4fxD_vYhF26dzVkCEmAwTL6Ng92_7HDx599c7qGFiuZn5HRwZZyBed_q0MDEr7-TKlAddzTSBQzQGuz7KsrymSD50h3zUtQ9QK3-bWSMeWzxZMMgZP9CY0Ei_QtpfAzrHs-WBIjYVzeo0COCjwA4c8cdCo_Yuw5CD-W0xV5EgiZxXyjoOwKnmj25cu_KBNKRGssJFv_84m038MAeO-GhJnJkIBwsRKLwDOI7XGjxiStbs_fX9pcnhs6tCy7i3I9Xfk1N-yHS5vmUV25r0VWzYtFReH6nb5_OSnbm6M3UN_wyS0SfpYIQ5fWme78B1v4-iOTz4Bq-C0H4pCyixhytix8-vWqQ5UkeNVb3ytl1LcNFACVfQBP2dYulxSs-ZEeqPHZrotIxas95EHem8sPKy4s139u6lzzHecNtfcblQC7hHyhahZxfdwDy-yd0DZAGj2QCNsDf53-N0ehxGgL2AxnMP92laDfTlKoj17wqzjdJXT06y86QMkVA80tXbuIaN1j3fBfAQLCcdPhqa8rDFzQ5SbMDf7X4kzmV6AwBIbY2f4Oxsd3h6_t9sj5IpumArYMWIJlaFoR6lwlS1uFCuSnRB47-97PW32j6mBW8g7Y3kr-0JJB5m05m0d8f9rUGLpxVmUCZP2WmW_ccXGGG0K5MxjAof21LWD1YRyfPmMzKngRg33Nqz9WAhy4Hezxb4AE4-H9p3uX6C27P7ciB7fU5PiL6D3EGNm1YyWxqZ-1exqlw-esATOqaiFvjXMKeQb9g4f6xXJsdq3IfzbxmJIjhkFNeORd1FV3bdFlqy9wA_L-VNE5ycM5d7QMA9sDfS3oz3mS37W7BNzohWXQTz_IhvSWABcq8DTrZene0GvOQq0PhovRK1NGCjPYK9qh_d2lpXeCuxGeWBmHA5RVc5-7W7btFFD3xIFcpdm6DWPQalKC76WwZqNzu81sYHdfCUjIHAcffk-v1ZP8MG3XzfITpPi0-DIPwVYzr_YDB73tzAEKstzOFiGn36qYKTTRCNPtstxnzqK1C3wg35218-Hfm5Jr6dpuc3rJhyhSuy7gCxu8VlqN2uh6yjP1J1Am-7wKVTmKezM6yGiez6dIxaCcK_bZs8-Y3507_juUfXF5Zpn06zFGegvsNhwIKlMYosuIGYO9syM2cjFroqwdYlV1hu0pqwoJ2_MP7dQQAJarcXLfo86q_9rkTcN3pCgQwKMrdlNJwWokQHKj4f6fplEHTYTGwgAyhM4Pe0R_DMnwW27xz6_oBHp8jzore9y3D5dVBopnN8DazsHKB3JvF4HG-dnkLwhmtU_w&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=14078881567066325000&adk=943508955&idt=158&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25314
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NTk3NjExNAogIHNlcnZlcl9pcDogMTc1ODc0MzE0CiAgcHJvY2Vzc19pZDogMjYzNDgxNjE4Mwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame B32A 0
858 B 201ms
63ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NTk3NjExNAogIHNlcnZlcl9pcDogMTc1ODc0MzE0CiAgcHJvY2Vzc19pZDogMjYzNDgxNjE4Mwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNzExMDk3NzczODk1MDMyNTc4NwpkZWJ1Z19rZXk6IDEzOTAyMDYwNzMyMTEwMzI1ODEyCmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyMy0xMS0yMSIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMjU5NzQxCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMTIzMjAKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2FkLXNydi5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9rbGljay13ZWx0LmRlIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0x5f0c1d01f29745670000000000000000"},"debug_key":"13902060732110325812","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"17110977738950325787"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame B32A 12 KB
4 KB 153ms
23ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1700578845093570&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCP9jPHcZcZYLbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9CXqX_KtBMSEdOw6cce6QF1Z_9EeeRbHftV3AuKXqNFhBUM2rWZlbIz-08WUob8raEJ2uQUMCR-PbQcYt2eU_fr-zM0H55uULV9OnlVHfI0GGNNa2__fj4h8ogZXybdP-cHpIfKzCBzJdwtteRayNJa4LiDIyiNrc_7b0SdLnKm2mtGguPYUJA1TieQDN3iKjPAkdDrQdqnug80nRt4kAK_2t5ILaM34mevHb_nZODG_MevPYlExnf2-lxv-AWjnzTaYxntDN5_IeGiAWFe3AnxYQ_Z08IOAYZlE0hkZfMxxszHAT1kb1wLut3WJtIn8McCA5fZ9-5oI7BX0B6DYXNmturP0xeOJeMKbMBXmx8YsqfSr6wtwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIu9Xj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3fJEYO12H-PR4cy2iTkS7jrB8cGQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-Cc1bwq9twZ9RCfcsndQqXIatlCdzsi6TnI7k7NEW5KrQc6c-Ap7T7SxHJKqoYdOY6u5DzT0UmD0XzLBlXneAvtU-uEAzNtOG6pZjSCDPJ6yyZfDMlIKw87EK4aRtNXAU2v4LRorsQoswa0UmmvbPkpjhYJBRjTY8QiFg31OMzxLfcRGO4%26cry%3D1%26dbm_d%3DAKAmf-C24PUSM65CSGyE0PUa8KipY1LQL_CApgRT0DGao9CTBTXJoKXVvtPENU9e02s8Eol228w2DrTModm949c0e9ADZBecJAFJUrIQjp444vEXUe34ogQhnnU2YzFUzQFXmCL4KtOUpY7DCmZKBQCSC8Ir0HgEshj8t0lAxlwwV9bf1AyfG-xm2N2EFKLm55ZtfJx03Dr1ojYjZJRFQcNLSPc_NYPlGfeU_EHt5Zj7FtqkOm0Ld0U7PjNLJqodgx_oAX6w1U6gyRe5YP4SBv36wiyTPKJhx8DEMWholmPAFJiC_MiAGX0kBv2wG9gTdLyXOealI4lGRPJSZKPE033JdZGCFGYpEKObA3XB5mPCpM-YlaPpz66RPSNoH8BMmCRNtjdPds-_ObNo7BeOpuW0zj4zoheuz0iCACQFtccJPdPeebZXtyzyiTtJTz4ddf9Wni7azMufWE3LGIArrnSx02xw5Wl0ciG6yJGHfzlOFHP66FIpT2ThNcpRltg2wMhyyJcHL9jrXFnG-AUMzbTLbJJcvqEpaSC8Eaya0wUWLb_8YkBehhg185GN7zoCX5M5eqJhlKc7gZuP2s_c7DfRXMKGNtIWaA%26adurl%3D
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 2abc50e1d88ead388d9d198cd02ae93f619f01315fe06198203bb83139b9ab8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4264
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 8CC1 38 KB
13 KB 38ms
25ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25314
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 05AA 41 KB
14 KB 18ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ANIS6UTHUKpfE8Hln3tq6nomZ6kNrt0LVDu2AP4m_t4w_gs1EfUTUY0D5lk5546Cp9lzVEMnnTNZrqdVrAtnkxtqP2rwbNFobGvH5KPAwPMDqfSCWo1JGwWnGOIymrvpsiFN14kULkvGRg4Web93_1w1fwCk8yr7U1N2--uJqOELcz6Uk&cry=1&dbm_d=AKAmf-DYonBe4kt016A3o-wFN10K2olnssSewAHvixk03UzkuEtlZ1viGAWFo8APW-A2fUX13MYbOrlcMycob_kOfvhmJixOg3dyP8r6UpauocH6rfCl6_52rzRZ5--53XCfm4JgfBOjuo5yD-9lX8-mCA-L3pvpTladviIpu3ZorK287PbKUgEpE7--lojV5i85PyD-k_MIKBoS1cTXdu8H0L7EojoTBFxymV6ca7FVHAax2j7eMXGtK9GkCIbH6vUAooqJ_E1mWRJe6_RI9QDx9QRKUem27ZrqtmPrk8n3ennYEJt2UALR25vw-IsrNHLuti-8Bt8eD0MR-Xp40_bPdIAdXCnRuz5EyNENon4HxNmCPNpjCZnyJMK-NVuxJNfxXSY26qB_lJGIKLgJg0lJQXp0CPHo-K9Rvdrr-XT8DlMBGvTTKptajUOAIVFa06a5nlZFwhoh0g-MfQxT_N1PD1__u-a-KM3B0Sx2X2SSAnpfzMgbxsvPTdbnrLuR70_tZsZlAtXBqhNwTnknbfZ07_FJ4KveU0U4w6FKjcFAAIFZXclfEcmTLHq_SPEFlhn_4rmHNQ5AoqETtir9syjFHs09mr869VoNYL2KxsRvPV7ukmsOZvZofPXKAQQ9XGytlDoJD3S5DhvjIJjkNz6NILAlTn_qRhX-_5ddf1RSFFgaysAbJkkie84n_J4FKIX2U_ItjBzADJ5TU7cAB4gp8iLCwPiyqFrsTpxU02ki-Y20yMKQVi-Gb3OtiXaRzo8IVtw020ZvG0I_VQe0eH_CIq0vIb4mmsX8NELMATXSMKkcG_HDcoSnDFBWJM7s2Hb4vHieYrF6LIEurRv3FlIROT2megbWnWa-wECFGU026hITTWS7I-kRtF27-7Sp46DcBu4jSpCIhQS9O2ezorf-iU8zd64ugSF-IqfAqg8qsG946cY-42YPc4cXy4zBOnZhv567szKoj7udKvxVgPatzNAeAZ0ot9ZOpahQUFyfJfav7bz7RG6jenslji4-HCcnH9NDfLs_F36E1wv9f9zjXPjJv1a5TwZuzYR2a-jj1ZfzSvBEq3IWp63sXOOvjMmXsDeGrPeAoqoRaao22mGDOe68gzByVPzrUUsYCll5whToBDv1OMgHql8Q0mnAUpSKwHx4gfpQ9-X7uexCPKmQuEjek4stTYb7a3iwbLWPTpnhoBho0VdfpCiEagiyr0sV_BWUKEGmTJQSF3Zh4GLN2M2cgECj75t1bKlCNefBkO9T0dEgDkXDwjmHGqjVyy4FIJZIW_PFq-IXvcL1JJbZZVW1paA8sZvbZLwzWlcz66ygUrmP4R5yHqjTkLvMTXHnLPJW5eNqg8b09uoifD8A469cb6oFKz6LFL4FK2frInt0o9AHPuXCn1P1qARk26y1obCMYyZgTmpyAFxHOcpbf7vUPVtVCd_VEHW9c3AyyFdpE52FJVVkzTK3dgUteyiRTF6PZL3LJlqyKQzeXeWA2uKE4NUmW4z4dOYmlfpsNZSspHKHzPRprUihO_n6IUlBLSY1zDZVBIwpbGoTkJjGeD9XxrOQL9IZV0cXIkHdk0wDoRqDDxdYVLRuNJGSUfJwha2CUNkQGVa2kTisWGE2bqXMM6M25ocZLzGzApGof-_cDeUz6nc-lrUclcTl10Vclm2WRDXbRu8LlD0rpVisSKy-478zNL4bjB-hwd1ql44u5plKe7oKBYlqESxpjrjPr011huMgtgvXjFnfK44V5oLuwHMMHOVuu7fPW_7fnoYiWhhb3RC2ow5w9ZQ1cPp5A7Z2eaMJNBheR2YgGBMAm7Ke670JApKOyL_-w3TcOl92oUVOqZ3oxu1CBIaMkNOk9toIedgLnEafeA9DPITeFRMD5scRafqAQXZdbYr2rJnxnYbZztv1AArjZ2nZXmcqj3FLFNIv9e3Lv28IygbN8PfZplB8O0sfbztWfT2e65IOCw9-Av4dm5m-tKwKt6UNxQgN1oZ8EP-zoOTesYybIXL8ZTja0XpgMPdS_kloG8gA5kSjC021ziq2jliwWYA741rluBob4dhqPmJlBgoE2PjW3vx77ilzvIpccXA8S4LJcao6oMrCxE-4qBanifpY4fDMxhJhPYvlJsOgyvwcJ_sUMV6femmEsltDnO1qKhiexs82uXaYPL0IVUrUf2eLpa6cNJ8u1pKlK728lbRz2dejCpzUGzhMQfrIRq2rAfvPLkNBEGoWjwxCbVYZNgTL4rvj2oivWoh475TSKqB1w4zN8-2k1dPe1umkXd6AdtKX7FwiMarPkgUIb-WWYdBl2TATyV1gZaQOYkIo22w06LB4UV5ra8JWc-p-yVxMXrXv2_snEyXwwl68zGbYJyZ_iTxVHlU_MRX1GKjnHxlQniyizLzRQD_IFW_3gJmoX113uT8-HCc-Bco_1_24z7I3IOymFwjhu4nhnEhNjIQJVGxrD7iK7SErXrw9WTpAmHj9ovZeVRl2AhsRFNQwlW6x6GqMME8wnFc6hOYxAu6-qoIW53izdaYYy9MKYveCvxclh40epvG3n5hdGU6d0jBXZ8x86Y4q7DISAIiYUDyYrDKd45bmPnXkhDEypVyZOovO6XFJ7ZEaN691tfrV2KPiimu4PHsMoa-mg6gD7gO_o2OqZr9_Rtn3gowZTV3_iAVigaOKKORNvr2xvraiYHl_MKmHTK4a26J7BJ_pmya43SC5EC9PSblTYNdklLuZ__8jYZmOwRpTTI6JXnMYBqwGvsBmUfFPVSp9edbF0D4rIIzhQRqcMUJkL2FZt7tR1FaT-ovVdUs2al71j1usgFUkWS_epWzhB_lbtCU2Q1fMfTC2LeuIuIadF_herynVxjHlcrQ9t2Ex3DzlPoXJipcT9Ey-w3oSbX6ZbH6jSI3MEvGK8elQEv9FdH1pwpX6JWjvy6lqSCgsIunV-2-CW8gTt9dVH0AEMEqJ-fUJaTqqNpoLWWyVM3ytQFDBw_9yUUHed1rGfoBSdeO-X1amA7ZNngtUvXl1KjLU66ohqAWsyQcxihx08ugn9n8l6I6yLCsfabVFZHitjubuCnPOXjq807qMTfIdIOsG-vTm4qohjokKzQSNeQhqOoz6ASr8aO2Guv3MwxqrKzCaq3mz8aNhbxN5d6FmpjTKz5PWglKJL6DZHHW9nm1a6DD2ohur23cvWJ0_kLZxvBzvE4qmF2E0OLV2KePku0-m8ak_yo1T04QYEs0qvdd9kSRNw2a9k9K2b03wKRJyFTNz9FsKmxNo0klmBcpc0pSIvW7qVYe7zTs3fequzDJ6Lugjz7AVgZAvhrHuoF7roG0eYXALrfNUYX824fiMrFWuK5hNEasheL2KfxJgOyWIncba4mn1qWqc1Y1Vae2MWAYLUkTNVHZ0KcwQh-jSuQxYf75aLNSFZj8ptbIJICFJXr9eXWgiKgKa7uA0SwDOGCkVCm7LPzOa4P0kFql5ZRtH4hS0dFCJILs0234YfxLwpvfCmosvUL4ziBtQHTCnC-cc8o3upm8kBFOMJwGM28EGM0oT7Y-vh2ERIIwRxjZTE3dEpmzll2hDeg3QyXkR0WjguWE2wVrzpcdG9L8gdF7g2fCGQnTMUpQ5TbVLv0xoyiHbnrVma-eROm64n0SnCZYOy1-stFjuzxb9pu1V9e-VJjMqxkZyWxIZn0AHDEWRVa2U6gXh5gj27PwSdRBKRPIV_DAsRuDYtqrxf189vKFduOeV6csdI8W7rsUaV5V2F6g01dxkyEHJxvJjypVubbFvi2FzH9babpfud0xW3MCVVX2fY0qVvmJJqQvzOOk8MTKjCVyT75dbXmHXdWX3ii7kcvFhhPccw6DloVWaHpUEm2h8_nOZ8a7udoyVdOx0i43fasmyQLsYxCIK01ySnFUpOoAfau9xhF_zo6nu2g4e341ePl-0SKd1keZML963TY61tC7w6H__VlXTWnhrtu8d9L0bii_GNczurLzSZzpZyw1yRNpHpY6Fvn6rDqhnB7BX_DoX8jS1MQqgXrJ61LTe8cpVnwlUjjTwf58E&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=5792267097212196000&adk=1033480531&idt=216&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25314
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NjAxMDM4NQogIHNlcnZlcl9pcDogMTM5Nzg5NjU4CiAgcHJvY2Vzc19pZDogNDEyNzUxOTk3Ngp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 05AA 0
496 B 174ms
67ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NjAxMDM4NQogIHNlcnZlcl9pcDogMTM5Nzg5NjU4CiAgcHJvY2Vzc19pZDogNDEyNzUxOTk3Ngp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA1NjM0ODc5MjE2OTUwNTIwNTcwCmRlYnVnX2tleTogNzU0NDQxNTkxMDY2MTE2Mjc4MgppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTEtMjEiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NDg0OQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA2OTY5CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0xda158e2d191c64a50000000000000000"},"debug_key":"7544415910661162782","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"5634879216950520570"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 5zyrr3xpcfb3 Show response
hal9000.redintelligence.net/zone/ Frame 05AA 12 KB
4 KB 121ms
24ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/5zyrr3xpcfb3?subid=&gdpr=&gdpr_consent=&rnd=1700578845093572&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCJcPFHcZcZYTbBYrE7gP83YpQpuW9oGmdl5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9CzkS_uN5pQlLoc_7bYIPCJ8iGIltmEYWHVMue-x3-laZNYgVzPEUY1K2-jBEvOqSdmbZM5xCaImpgpJLNCCElnE4msCipPO3BYvQcHAgdH4SU_2OgPpDjxFoqDq0TrKcUPDgQ6Udh5au0NHh26hHvHU00YC0lApicZqhR2qasMTsyOQjl5R-2ykxReoSJZq8nGisFsUGsXePMeuFFfj2Us-T2mO5qnK8XG2_s9JwffYSLCL1-6t7pBiPOY77hYka5h-EHueMJCylRy5zxNa70DUmV94aHU361VcJgmLJ4hUR5t6eQ6rYqfwWoo2R9EojiY3lQQB_c1ljxJ3V_hWuVBBo5S-NpJD_wWIgbZdtP4kBBimafABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi91ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_29cBfsSA1YbUdfv0a3ytBs-bQ4yA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AscBT0qz8YO_oowxGv8IfcxyZMMVowjK0ENAtT0QuQmjEJf6ewrWowMKwoukaYBQ5fZnPJ85tA81pBzh26HQ3EkXt_BlZVidnr-4cMRjtUTVBQHumuSpHcrbp6OA-AslXZrmSqrbX8koLV1AstGd8NuO9pMP9SKt1CYugmFHa-DoiDNM0%26cry%3D1%26dbm_d%3DAKAmf-A_BPGTK8GEQMkc2VFO_yeTjrwPDLAyAyau_ZYCbe5TrtXSq_ISCVlE3fbJNYoTEIqSxrnsWZwp16qnp9Xsj0OPmQ0fU56cTAjjo8LGaSU_sCZDDVMvtLLazIOeTgYW4vUpb_rG2-A7nasL8j_yomn_TbhHaGDqqnw4wcbYk3LIct06Eba4Jxuf8Qo411iqZ__x_8f5V_9eaL6FC0qfUp-0euwrnQDWbBLBfht1gI9wwnzgrQ24bdlguCUfaQpD6hyAceQuborKwVOfSntW7-SEcYjtGJysD4YpM5QfR6xgFMCGIVbhYwSdpaRS7ZfwpmttbXgbxI21h3cw6gwrsEFHop9cwvhgWC4BhvUmmaCwVcyABlDcLtPQQssg2jEfos2H_2x87RyAilV1IAqXPDYPr90AkcP-tVQe8dB139HlYMmWxEShTh3J4hFIlQQT-qJdj6yf4OKMG4zJjfxhcyCk8OI4H4YQ_j7lqKmJgVUiU1lAJNRY8sbhBH-Hq3nOS4A0QagzQI0ULL3rd3KIjqfvS8eT8xzfWb_5RPpV9uoexTvag5xONrq_E3gVHYF9z2n9pZ0HaHSOsI27qtQvdvCIp_j9Gg%26adurl%3D
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 2d6ace4530d29f12c73acfc9e9e573c801fb44a6ecb94ec7d7779be6ee61decf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4263
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame EE76 41 KB
14 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BIEVOsDxNFxaeJMVhiUGNqJTBwaILn6C2wmkFWsAwfCPHtin3QDrF15AupbjcvyElM0RSX5akf_UQ_X4L_-yYNJtTXh2eMLE_0Ueq3g2L5iOkJBJEw0lp20EXaYfDGwHcWx9rTUO5L3w-ygRiHPHlKUAP7_04wkdzSqFh-KGAaybA6iqw&cry=1&dbm_d=AKAmf-AfnlmnX2kkcVQ-YIFCMlCL6adi0ThP3Usf8i31AYSNeSZUaCjqDVqrCFwAK0V9CcUCCh1bfPdmXFxZdEAIug9n6MThtO_UVxPVRJ0fQ0wcyOhRRVoA1wjkRhg_2QDLG-aCM1plKhGrX5lzYn_RD43w-KRECe86YgbVYRxjVujm0hERSSKKS3sjPB509qZjKwEB4wOdZzfaYCau5ZtKY78Y76DVFpL9FfQ6Dje6Ij_IJQ9nmXy6TD9eKOhH4Jhfg-CKa2ivQAxoFZCvlR2t3lEwY-ZeKqpYwDakEmCn1ArCR8dxe4KQ5S_qpdTFnsFbuyZgOIv8pUUyWpvZN4sOoMYmbVRykbbhwnK2Xyu50wy526F9iQ5IXBCru60xXYF40NHnEse2Fe4fhSZ7YK31TYdsQZux7QdXEruxeeOI6ZArZrbWbcYJLPAV-ZwYyOEclNyiJOU9X-aDqGZ71usRaZrvaV0EZA2403y-kwk54fWoP2EY0biG6rQjlWDwIkCZ-VsCg-ODcudxdSYHTnFXv-k2p5OYVWWAgF3kA9JBVA7DS2wct5BqrZeAQkXP99zywAF1eODXsRRD7MkZRSO7lEhbtMjIeL_ILlFSAE1Ms3BdgfHMl6ka8Zv_LZ28QJ_XJ8aHuvBCrdO8rbvtCPPkizyz8ZdIqU2TvTf5mtcO31JA-335QJCdu7_OaxWDpLGqVQ-ghcmPpq422tZ80sl4AVd_b94BiNPrred_XnY88WMLuObjxJfHW1weDDhbI3RT47-iRiUSGKddRqSl5EI34Zj1Q2SjTMSx6v2Q5zIbDWqEkCOP-N0M8GKAtBiD9_8jbAd9HE-6Mmaat1A9M88vf1xwwBZU8jDEJQ4Lun8spH4sIeS_23mGVryfX9kcXbLcd7uHXKMokdfYjW-VTmrdZkPvRM3W4hVx9ToD5CoOE1P7x1eY_3pOZ3X-cQo_0BmCz4HCbs1VdJwkp0O2NIPCep7LhSzDrXGvfQh4M6agsbUiXj703VaFRZPgXBkhRgG1NeJChBAwzoj65V4JDCwFB-r2_0OduF_Bj1wgGUqDNc67cezDLi9a4M3jtxYGjoWOTaamx4iwXc_JqqKxgD9sCvep5hRift1U3Xg_ru8jPv3IJ_cbFVGEhlhNfYO4Cq9NW6mwHJrqRG1Pj863AzCNzLjSZKxomtdFW8CzNPYKqX3U1sknQZj3L9dzx0KJuEDWYMKhK1tGuVbc5AG-lsN_0AkYkdcAgJV0zwp819JN9buWh5ucPwPXUDqCE86FSGzK-7oJnxltVTPlohJFJs-H8dzvJjghG4yWdKTttZveINbt3XJtJPhsjf4X8FXeQ4SQWvUOKgbAxQUTGRJKXLMSwo59bvMbyTzWf9YgaVPZFGdFqY4AkdbnBcLaKjrc91yLxawrwTQZ1C7Mr4zy3d9YtC9cyBjEpPz-kphRF7iiNuFowf3_NLgI8lua1ThBXu-H3dBQWNwVQBEUMYyBBaUNG4JxUdMEYjyLYDqE6jKZ6yOFZG0LQdM6F-eXnoQ5ZveP4Ls5-By19VfdJHYgNciExPYN7KdCWDd5WuxLE_rOk1PjN0q06nwYyUN4ORKzSdwgVA8dWCpNyRWOSdPxzJCubo0kjJs-whlVmzVwD87bd_4mQd8AkiCSXslwjgz3yIbgImITauJFgPJow9AkZdZFqJ5TtS4yFmA8oeUtcAy1IroEbiR0hYxSs_gF9i04fEGlX8jImxVJHChEkvZHk2TElOUfBhxy6eAxpDDWvscKqIoQrPuvsEmiwFAMuOCh5LYygLJu36LTKx4OWUjLnu_pJQi74Rl8BcsekZ1o87IESLX00GcrXABO9WL0eLvt9J03EuEnGQ_t1qCm6dxeHQPWXeh3d_CZZiGN2_FPcLpacf6kTLplECoXu7nNzITICTVWLZSFUrP5-UG8YQXxgORgNOiR3nje8huXSDq-lUtAau36VTFmhT-jOoQQITVnZoupYvnPv0Nin4sI8HPn0DxqthA_xhtg5-VN0J_M8pROH-uuEqO7uQFKHVi4od4xPD05NMgi8e5xXZquMD3Sm_XbJCjtyUkPz430m_hFMxxxgNzJ0j2q3ExMW4XAiqAXYfYslD6F4Mxl7mnmyaugHmNblxnbagDBXnqMamsDpb4lkiJ9qWJcVQ4-6OAwdlQELSclXENlNNoIsE8EP2d8yVQmoRg7mBGjLEH0yV9Q4ooU6d-1PRiI2ii58eVEbVNh8AIbN3qPLskPVwQrWNIpbfx1MypnUoh2NPMB3VEvk2AcdyWo2ufO5Uca3_xfitjBmfJh1hMEX_l-pCqZY6w8K1TnHmv6iUQ8OUQVeDRvgBTRiyzx1V6UZLuuRu4TGlN32AzvZBCsKtDH2SfswyAQTuS8jdyBL3seIJysQCXm7NKWr8bvBpIG_ZrNGP-zHAT5TA4N5EhQmKOTjx1CwLW9ZVDi88mNawCHLpcPQwasgGNLKnb_V0aRyh0UjpPAYP0Irm2pzU9ngjuB7q7YJJZNlxQZu4GNIx2qWJknqr3D7Pt5kmtDZEvVv5hVqcUXxOFHe0cRM_II5GTqfdLJQyiFmDYJF3A1latRbMhfeBFWx9K8tn-vInIeBVKlHk68nmwi4lYLu5fBJAdQ6fBZaTkhQQ0ZfPEYA_NrdkYJz7ez0hnxxQSUzay1ohnmQK4gq9lQYPfW70NnM0iXJJATzQugZwMliHE-3fo1OLMeBdxm82g7A1MT7N0PT4ovQYzw3X7b3KJbCV-C1_thpOXbNYTC_UTC8x5FwtTBAFpUxJrIDp0ZWSmR57Q5hdi-69rzKuqvXSo3JkxbQJbiuWQOLdD6K7l9fR-Kp-Cy9bAsDcbNDMeJZz-6jq3L0as8uSHj4KHTp1QcWIG6g1jPb4gUEaF7R4GtcIKHAfahpX8iCUk9-z_qf0A0SJ-_LnravyncgyEvlay8BYjaFSKtDfAxXfHl7irRA_7KA_k1_QeMjA_LWEXkIdnal_EbxYi_s0eUiYJqox32p59HyzpD6RG4C1ZNa1GpD2Cf8prLoRPYo54e5P7Ub6H__7BR-opBiIHrhd8rVkfMCFP1LFhQokra8bLZ5avLARCdTGAlGgR0C-coWKUGj_0bdgQ4j1YlyvFbI6nUnZyWoBig_Lbm3ADs28lT3HpkHBKMzUQe9NwqJrO8Xgi5FaHKwdBqR2lWeAd2Vz7c2xPx4Ozf3vG-wp0K9JgaB2opYIY_eXwV810agj3spjFe6iH9r3Hi0EjsdTI9DDqNson7uGvhKZTjqq3SNgvFiAasuWqKGQWf5ncmjCNu16vXbFu5LmOeAYE5hTd48efzmihqMssSwKXW2xnRc6jEV2JG-VaNa5DPVgh1K-VsqVOZ41HfEQgckS0rgceon9uNhIdK9xQCxiHoWdpGBNJKc4_hSb83pki2hRtgmS19N9HZq91SPpDsXmWt17om_X9FNHJCZ9RG559ytf6VZg2IEfxjvgDbsE3c9uxWBGvg1vsSR2MleYYk6WuzC2qmay0pLo5BhrHfcFkuowO8inju6oFdsi7mA8YB_Kq8V8Ia_MkCh0kyR1trPrR9aYqK9G0kmXTKbiZtb0G0vaERiMS7yDTKWskxrFNSUJaXDlKkcz2jWhrSRWFszuuAsSmrgVJoBGw_QLOGbv53fNnt7u8WRMWQuV90aHnwqYObgDnBZJHseuyDQ2dbTTUub2m-y22Z9lB3rUVgq2JemWNvI3IzvQgPomuj86VycVfnYQm6wi2XLIhqWyQc4VCR0Y2ya8W4yFdi5y2n55X5M8TSrlohNfMTc4Eb-eS0j4xHzH2gxl63jOu4Hv2DG8knKO1hBc588BMINlYmfvrrDFa3kbPILoRn2JuvvS7_sLcV-pNG97ewfuq8wyK6lMEXXVyFTjYhdOkOQlPK63Eozz-9Nc23NnyXYhHGzgKuaF5TrYsipEYg7AqINBoxOlgOXLgU0npXjLmsf7QnyEFMxT3F0xhr0J4PZRcD0GJBDN4Rmlb1qjFvpVgCLGwwMmMJ6Qf8zcit-TarFpV52d6K&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=2222850762562158300&adk=3690638929&idt=219&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25314
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NjAxNzMwNAogIHNlcnZlcl9pcDogMTM5Nzg4NTM2CiAgcHJvY2Vzc19pZDogNjU1MTMyMDc4Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame EE76 0
498 B 162ms
66ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0NjAxNzMwNAogIHNlcnZlcl9pcDogMTM5Nzg4NTM2CiAgcHJvY2Vzc19pZDogNjU1MTMyMDc4Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDE2Mjg0Mzk2MTE3NTIxOTk3NDY4CmRlYnVnX2tleTogMTIwNTM0MjMxMDIzMjM5OTg5OTcKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTIxIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzQ4NDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwODYzOAogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0x12d474bacf6c64820000000000000000"},"debug_key":"12053423102323998997","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"16284396117521997468"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame EE76 12 KB
4 KB 112ms
24ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1700578845093571&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC_jk1HcZcZYPbBYrE7gP83YpQpuW9oGmFlZynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9AmhCrg5ydvuu3STA5ebEwj1j_Fo-FljZwuKk1cyxk8mJ5WOE03y56hD9jDsChUkoLH-CKeWVZZF1jtR5M2zM1EGWSbBk83qklIuVzlRNNLBfJ6UB9TmuXDT0mF9HOnA8bhObSoeA40vLsUrGZtZE_D_i_i_UXGAN8TqyOF7DQ_CiXSdGB03PCgMfnNulrnjq3pVmmXdD5ejGLa6ixkG39lsz_gYvHLgIm3mfWMtIXOxfw8uhS55PXT2BHde7puW-I2wDWciireK9HSOzfS5-yH3wjqKG3Bp3Gqo-HqmD8GtzV7T0eAmDuPy-MY41yA5bcb6Yf5GT8hQ1tK0yycbBrHhKglPOjiP8luYq4qAV39XhhU5OvABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi81ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3C_LhFwqrmbHselRmdQoRrZ37HNg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A2mgrZX27FgwCT_RRcixKqD5RBZpT40m6G_CntiGlR-5tXmRQQ7yOo-wEdHNEq9WSFgRX_mUEqaPGwp3IJ79jKFoafP2XEwtnDW6v15gSgxJ6VrsEFTY6q8pNnePlCGfG4_wFWN0k_0ct8vsJaIGrMev3GfIPD-IDCJ0CjqOAIQFs1GJ8%26cry%3D1%26dbm_d%3DAKAmf-Dt_VPjxeyMUz4rIR-bHH1mtgdn1uRWYgC5ufbToRPLVCWr0RAcpwU6i-Slg0YE9odVeABzTEDHN9tCwBUv_soQfZXpORQPk3WMVQFT7WoIIRFTrIP0iDfgXojNZcw7aZo8s9dP7-YuKCYfxd8h_TOkk6xm8-BcVlbtLIedvcqxCmhnHxzKIhvW7JZYjwxZ71g0lVrjYXtMyx73zzute-qj8b3cISD8E2DMbSY2B8CVfiidW_wPR8iM-RQ-4RkZ6Z9edp_-YsA7kQySHtZlsR_YuLs266uNeB1uDkB8dADMiB3HKuObB8Zw5G0QMr14ulcyF-JP-B_ZMw8d4bXYd8_uiB7ACIZUQAow4khAMn7zEwgxqkqTcut1P7iJv1cVT-5KS91OOK15tFnBkLhcBloWDxfVefgTJ6t9t8mIUcSbGGEPURCkQi7MlJE7OIM82N6cpHGl8rGkQSPEGvn0XeX0VOcPRgp344HDN0qGPltsdBQhNmEm4uZwO2B81N5GU0W9w79T_o8AaV-WgailL4Hc4jrxyiKgANudGkWiBlfgVwydXQ96aqHqYhu4KWEL8U-R4_9l4MNUfY7ZG5Vzwn8jUcnfoQ%26adurl%3D
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: cae527b355b235f1c80e0fbec08a3afa1423d32a2614b38a2c041edac9694014

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4270
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
254 B 119ms
118ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J1gqypCFYN7ZvTdWZqj8w84iGfntJDZI4xYoMIrG18z9rV5vwBoVftFnA8X4kA20G8I1izoFTVO8ylHNExebM2ABkyOcWcnrHpBqUbrmIyW1g2m7OBUlzy4EkiM1b7edvdAZzy5wHTlrkn9rOac%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cddcdab79bdd-FRA
content-length: 0

GET
H2 200 simcast.com Show response
demand.qortex.ai/api/v1/group/configs/stn-12018/ 20 KB
5 KB 238ms
219ms XHR
application/json 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://demand.qortex.ai/api/v1/group/configs/stn-12018/simcast.com
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d34a1e3754cdcef36a00f7f87080053067738af1b2ee1ff6e059cd65748d87f

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZFmV4JS76iN4N327OanOE9H7w%2BhWY5MINmetCEhFeN0vJKQIPEl5U3GuzkSYZP3%2BXXerSMhDlwtvBLvZr7citk7DvHJMdEAAbBRWuc%2B6co%2ByEYbx%2FawgQfQHyqUh2gbbe4Ivi5jykxjkfEgQEvI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cf-ray: 8299cddc39e69bdd-FRA

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
258 B 133ms
132ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3mjNHHH7gNZtLosc5el779EcUj%2FUgrrdjrZyrHh3UAhNr90T7aaUQX1HJtbfRbC1e%2B6LWsK9oNgBS37FbrIiDJdrmhiNCCqGa2fE%2B32wbU5iKO%2BXt9vc3jPhVyvUn6ALBfdBA5557dtPBMgYyGk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cddd9bc99bdd-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 117ms
116ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cddc19bc9bdd-FRA
date: Tue, 21 Nov 2023 15:00:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SYaIxEcLdVbgbq1JJB44kXPQwSk0HSrzSZ%2BjCchJHuts9uTU22NjaRznokWwqu3Ax%2BV%2FByYsmB9dzy%2F7OrZpnHRX3oh8dqs7VJkdCJOZ4yeQdQRAE2Y11DFFJZXvr4oWnmdIZvFMuNw%2FPLtvwtk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 209ms
208ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cddc19c89bdd-FRA
date: Tue, 21 Nov 2023 15:00:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1NDmxYsv21tnzBVeNVTQLQ36R%2BrhzhNrtj61OYi3q6YXGyjR8%2BxPaZdfltR2T63w45YEAQ0l9wCvZLGMoLqFNXq4kPRNY8PVPIGjrY7ta%2BxI%2FZn4BwT9XHSG5OMw2eaXsJ8xbOl2qeybv7vivos%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame E85F 38 KB
13 KB 27ms
25ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25314
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 7D3F 38 KB
13 KB 28ms
26ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25314
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3E1B 38 KB
13 KB 39ms
37ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25314
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal90003.redintelligence.net/ Frame D408
Redirect Chain

https://hal90003.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=68e1db6b83&subid=&uid=edc9d36b9635f477&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90003.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=68e1db6b83&subid=&uid=edc9d36b9635f477&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

130ms
81ms

Script
application/x-javascript

138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90003.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=68e1db6b83&subid=&uid=edc9d36b9635f477&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmqNpHcZcZYHbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9AhnesWBchLU0dPCEl6xd-ZFf5qy1E0DanOqT0b9ZZPaEDdapxOTga1Bye79vODRkXGZzfRGZl_43XDvT66Wdqpis1FKvzdlokPqpc7FivU8qeazbxugSVDYrFoGXpEixWI5Ld7nORP2eT-atW7E33GyO9FWoUeiXtVQX0KqHph7ksz4cviGmQiS7Wt25b6ymhZR03XBU14z6Hm9fIi0br_73qixgWg0HUaoxsVko-P31LXOjrfj9sDHNMoRP8xxykbBWRoU2vhZtraqqtvl6Qex9_3UgSsILtxpqca-UL-PBPoTZDlaNTkfjZGeMJkp5yb0trfMXOdo6bxR_g4gsSLrVWeduZO0gXhdr7PILgoRKQbKt95wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIutXj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_2tDjD1rltF5C7yMW_YeJ2Pp-kSQg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-D_zHx_Y6u6ja5FOpOW9cbaj7KEC3TZFbo9W1aoeq_8Gj3pjl684WiS5BVYmjK0wtKXo-vSxOYsfwPEBcCv7NbmS4hcwbEKGLF7Lz392LCcqFqUiwBSrJRFtZQBgtp0Vx2RDeR4eHNF5QB7xnIB1PSEgg9EQVUIfC98xJhhV_0xi6W2-nw%26cry%3D1%26dbm_d%3DAKAmf-DPVaTofoCIq3h5qoYODhjqFGaf5sglwEsbgZN9EgROAWVJ6_iyDOfCeXCvedDs-zHtFHFPbwB8lsJ8BclHwAl_pK2_4gMxjqj5FsGEA1iwH8jPioVYUpOEoZKAljqfXq65GKfCrl-AAOxBa5_-ff7-oJDeJnK30OPm7-c1bxbL50L5a-mqHbU7Rptoe1XOtgcRGznQyA8iZE1Wf5sdu_XrSGdtu1GCjEDdrHEj2gO3NfE94iHbnzGSwU5-bkcgVf4xxd_WA_O3IQoDUkIh-E8HQsTUBwlR0fjEYx7uvH9Ccru7epSf3elJkIuvUrISaFFwrcUZ_dp1NWDSUAj7SQnNnID9CMwEhZLtbl8UKXkCt-MhNGSH-7_5D1HrZe1v7MMNdAGO8P_gERfJTCFt9V9mktnv5-YeW8frJ2gemSF7_QUMNt7TcP-Q_uWIxNS8G2KIXnpvod_Gibyyic5H1H75II3r9yaaaYHwoM8QptqsH1rwaGTpbHXaaGyvnOsNdmnx_FnK2YdKSycZCI-djfgbULB-NcaiuR4tgQzYurQHBGI6Ie_O3bQmLoDwqTJ2sM7xLuIEBvruD7XPswMxSAo-OaoabQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1877210419018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.117 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4fab88e13fd3dd6640fed4e54c7229a466e8f2d2402fb0ac3b8d3fb5909ae6ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 78315200094716204444994012515003
Connection: close
Content-Length: 1353
Expires: Tue, 21 Nov 2023 15:00:46 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=68e1db6b83&subid=&uid=edc9d36b9635f477&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmqNpHcZcZYHbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9AhnesWBchLU0dPCEl6xd-ZFf5qy1E0DanOqT0b9ZZPaEDdapxOTga1Bye79vODRkXGZzfRGZl_43XDvT66Wdqpis1FKvzdlokPqpc7FivU8qeazbxugSVDYrFoGXpEixWI5Ld7nORP2eT-atW7E33GyO9FWoUeiXtVQX0KqHph7ksz4cviGmQiS7Wt25b6ymhZR03XBU14z6Hm9fIi0br_73qixgWg0HUaoxsVko-P31LXOjrfj9sDHNMoRP8xxykbBWRoU2vhZtraqqtvl6Qex9_3UgSsILtxpqca-UL-PBPoTZDlaNTkfjZGeMJkp5yb0trfMXOdo6bxR_g4gsSLrVWeduZO0gXhdr7PILgoRKQbKt95wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIutXj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_2tDjD1rltF5C7yMW_YeJ2Pp-kSQg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-D_zHx_Y6u6ja5FOpOW9cbaj7KEC3TZFbo9W1aoeq_8Gj3pjl684WiS5BVYmjK0wtKXo-vSxOYsfwPEBcCv7NbmS4hcwbEKGLF7Lz392LCcqFqUiwBSrJRFtZQBgtp0Vx2RDeR4eHNF5QB7xnIB1PSEgg9EQVUIfC98xJhhV_0xi6W2-nw%26cry%3D1%26dbm_d%3DAKAmf-DPVaTofoCIq3h5qoYODhjqFGaf5sglwEsbgZN9EgROAWVJ6_iyDOfCeXCvedDs-zHtFHFPbwB8lsJ8BclHwAl_pK2_4gMxjqj5FsGEA1iwH8jPioVYUpOEoZKAljqfXq65GKfCrl-AAOxBa5_-ff7-oJDeJnK30OPm7-c1bxbL50L5a-mqHbU7Rptoe1XOtgcRGznQyA8iZE1Wf5sdu_XrSGdtu1GCjEDdrHEj2gO3NfE94iHbnzGSwU5-bkcgVf4xxd_WA_O3IQoDUkIh-E8HQsTUBwlR0fjEYx7uvH9Ccru7epSf3elJkIuvUrISaFFwrcUZ_dp1NWDSUAj7SQnNnID9CMwEhZLtbl8UKXkCt-MhNGSH-7_5D1HrZe1v7MMNdAGO8P_gERfJTCFt9V9mktnv5-YeW8frJ2gemSF7_QUMNt7TcP-Q_uWIxNS8G2KIXnpvod_Gibyyic5H1H75II3r9yaaaYHwoM8QptqsH1rwaGTpbHXaaGyvnOsNdmnx_FnK2YdKSycZCI-djfgbULB-NcaiuR4tgQzYurQHBGI6Ie_O3bQmLoDwqTJ2sM7xLuIEBvruD7XPswMxSAo-OaoabQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1877210419018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:46 +0100

GET
H/1.1

200
OK

request.php Show response
hal90008.redintelligence.net/ Frame B32A
Redirect Chain

https://hal90008.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=09b7505222&subid=&uid=f8d3ad0df702a4dc&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90008.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=09b7505222&subid=&uid=f8d3ad0df702a4dc&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

140ms
92ms

Script
application/x-javascript

138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=09b7505222&subid=&uid=f8d3ad0df702a4dc&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCP9jPHcZcZYLbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9CXqX_KtBMSEdOw6cce6QF1Z_9EeeRbHftV3AuKXqNFhBUM2rWZlbIz-08WUob8raEJ2uQUMCR-PbQcYt2eU_fr-zM0H55uULV9OnlVHfI0GGNNa2__fj4h8ogZXybdP-cHpIfKzCBzJdwtteRayNJa4LiDIyiNrc_7b0SdLnKm2mtGguPYUJA1TieQDN3iKjPAkdDrQdqnug80nRt4kAK_2t5ILaM34mevHb_nZODG_MevPYlExnf2-lxv-AWjnzTaYxntDN5_IeGiAWFe3AnxYQ_Z08IOAYZlE0hkZfMxxszHAT1kb1wLut3WJtIn8McCA5fZ9-5oI7BX0B6DYXNmturP0xeOJeMKbMBXmx8YsqfSr6wtwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIu9Xj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3fJEYO12H-PR4cy2iTkS7jrB8cGQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-Cc1bwq9twZ9RCfcsndQqXIatlCdzsi6TnI7k7NEW5KrQc6c-Ap7T7SxHJKqoYdOY6u5DzT0UmD0XzLBlXneAvtU-uEAzNtOG6pZjSCDPJ6yyZfDMlIKw87EK4aRtNXAU2v4LRorsQoswa0UmmvbPkpjhYJBRjTY8QiFg31OMzxLfcRGO4%26cry%3D1%26dbm_d%3DAKAmf-C24PUSM65CSGyE0PUa8KipY1LQL_CApgRT0DGao9CTBTXJoKXVvtPENU9e02s8Eol228w2DrTModm949c0e9ADZBecJAFJUrIQjp444vEXUe34ogQhnnU2YzFUzQFXmCL4KtOUpY7DCmZKBQCSC8Ir0HgEshj8t0lAxlwwV9bf1AyfG-xm2N2EFKLm55ZtfJx03Dr1ojYjZJRFQcNLSPc_NYPlGfeU_EHt5Zj7FtqkOm0Ld0U7PjNLJqodgx_oAX6w1U6gyRe5YP4SBv36wiyTPKJhx8DEMWholmPAFJiC_MiAGX0kBv2wG9gTdLyXOealI4lGRPJSZKPE033JdZGCFGYpEKObA3XB5mPCpM-YlaPpz66RPSNoH8BMmCRNtjdPds-_ObNo7BeOpuW0zj4zoheuz0iCACQFtccJPdPeebZXtyzyiTtJTz4ddf9Wni7azMufWE3LGIArrnSx02xw5Wl0ciG6yJGHfzlOFHP66FIpT2ThNcpRltg2wMhyyJcHL9jrXFnG-AUMzbTLbJJcvqEpaSC8Eaya0wUWLb_8YkBehhg185GN7zoCX5M5eqJhlKc7gZuP2s_c7DfRXMKGNtIWaA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1691609899628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 64b1c388d7e86ed9a9a91e717b1dea94634c4ac434e576554eec8008f51fc752

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 12088300089271904444994012515008
Connection: close
Content-Length: 1351
Expires: Tue, 21 Nov 2023 15:00:46 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=09b7505222&subid=&uid=f8d3ad0df702a4dc&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCP9jPHcZcZYLbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9CXqX_KtBMSEdOw6cce6QF1Z_9EeeRbHftV3AuKXqNFhBUM2rWZlbIz-08WUob8raEJ2uQUMCR-PbQcYt2eU_fr-zM0H55uULV9OnlVHfI0GGNNa2__fj4h8ogZXybdP-cHpIfKzCBzJdwtteRayNJa4LiDIyiNrc_7b0SdLnKm2mtGguPYUJA1TieQDN3iKjPAkdDrQdqnug80nRt4kAK_2t5ILaM34mevHb_nZODG_MevPYlExnf2-lxv-AWjnzTaYxntDN5_IeGiAWFe3AnxYQ_Z08IOAYZlE0hkZfMxxszHAT1kb1wLut3WJtIn8McCA5fZ9-5oI7BX0B6DYXNmturP0xeOJeMKbMBXmx8YsqfSr6wtwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIu9Xj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3fJEYO12H-PR4cy2iTkS7jrB8cGQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-Cc1bwq9twZ9RCfcsndQqXIatlCdzsi6TnI7k7NEW5KrQc6c-Ap7T7SxHJKqoYdOY6u5DzT0UmD0XzLBlXneAvtU-uEAzNtOG6pZjSCDPJ6yyZfDMlIKw87EK4aRtNXAU2v4LRorsQoswa0UmmvbPkpjhYJBRjTY8QiFg31OMzxLfcRGO4%26cry%3D1%26dbm_d%3DAKAmf-C24PUSM65CSGyE0PUa8KipY1LQL_CApgRT0DGao9CTBTXJoKXVvtPENU9e02s8Eol228w2DrTModm949c0e9ADZBecJAFJUrIQjp444vEXUe34ogQhnnU2YzFUzQFXmCL4KtOUpY7DCmZKBQCSC8Ir0HgEshj8t0lAxlwwV9bf1AyfG-xm2N2EFKLm55ZtfJx03Dr1ojYjZJRFQcNLSPc_NYPlGfeU_EHt5Zj7FtqkOm0Ld0U7PjNLJqodgx_oAX6w1U6gyRe5YP4SBv36wiyTPKJhx8DEMWholmPAFJiC_MiAGX0kBv2wG9gTdLyXOealI4lGRPJSZKPE033JdZGCFGYpEKObA3XB5mPCpM-YlaPpz66RPSNoH8BMmCRNtjdPds-_ObNo7BeOpuW0zj4zoheuz0iCACQFtccJPdPeebZXtyzyiTtJTz4ddf9Wni7azMufWE3LGIArrnSx02xw5Wl0ciG6yJGHfzlOFHP66FIpT2ThNcpRltg2wMhyyJcHL9jrXFnG-AUMzbTLbJJcvqEpaSC8Eaya0wUWLb_8YkBehhg185GN7zoCX5M5eqJhlKc7gZuP2s_c7DfRXMKGNtIWaA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1691609899628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:46 +0100

GET
H/1.1

200
OK

request.php Show response
hal900021.redintelligence.net/ Frame 05AA
Redirect Chain

https://hal900021.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=c03aa7d106&subid=&uid=d2d81a9aeaeaae99&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900021.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=c03aa7d106&subid=&uid=d2d81a9aeaeaae99&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

154ms
95ms

Script
application/x-javascript

144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=c03aa7d106&subid=&uid=d2d81a9aeaeaae99&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCJcPFHcZcZYTbBYrE7gP83YpQpuW9oGmdl5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9CzkS_uN5pQlLoc_7bYIPCJ8iGIltmEYWHVMue-x3-laZNYgVzPEUY1K2-jBEvOqSdmbZM5xCaImpgpJLNCCElnE4msCipPO3BYvQcHAgdH4SU_2OgPpDjxFoqDq0TrKcUPDgQ6Udh5au0NHh26hHvHU00YC0lApicZqhR2qasMTsyOQjl5R-2ykxReoSJZq8nGisFsUGsXePMeuFFfj2Us-T2mO5qnK8XG2_s9JwffYSLCL1-6t7pBiPOY77hYka5h-EHueMJCylRy5zxNa70DUmV94aHU361VcJgmLJ4hUR5t6eQ6rYqfwWoo2R9EojiY3lQQB_c1ljxJ3V_hWuVBBo5S-NpJD_wWIgbZdtP4kBBimafABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi91ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_29cBfsSA1YbUdfv0a3ytBs-bQ4yA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AscBT0qz8YO_oowxGv8IfcxyZMMVowjK0ENAtT0QuQmjEJf6ewrWowMKwoukaYBQ5fZnPJ85tA81pBzh26HQ3EkXt_BlZVidnr-4cMRjtUTVBQHumuSpHcrbp6OA-AslXZrmSqrbX8koLV1AstGd8NuO9pMP9SKt1CYugmFHa-DoiDNM0%26cry%3D1%26dbm_d%3DAKAmf-A_BPGTK8GEQMkc2VFO_yeTjrwPDLAyAyau_ZYCbe5TrtXSq_ISCVlE3fbJNYoTEIqSxrnsWZwp16qnp9Xsj0OPmQ0fU56cTAjjo8LGaSU_sCZDDVMvtLLazIOeTgYW4vUpb_rG2-A7nasL8j_yomn_TbhHaGDqqnw4wcbYk3LIct06Eba4Jxuf8Qo411iqZ__x_8f5V_9eaL6FC0qfUp-0euwrnQDWbBLBfht1gI9wwnzgrQ24bdlguCUfaQpD6hyAceQuborKwVOfSntW7-SEcYjtGJysD4YpM5QfR6xgFMCGIVbhYwSdpaRS7ZfwpmttbXgbxI21h3cw6gwrsEFHop9cwvhgWC4BhvUmmaCwVcyABlDcLtPQQssg2jEfos2H_2x87RyAilV1IAqXPDYPr90AkcP-tVQe8dB139HlYMmWxEShTh3J4hFIlQQT-qJdj6yf4OKMG4zJjfxhcyCk8OI4H4YQ_j7lqKmJgVUiU1lAJNRY8sbhBH-Hq3nOS4A0QagzQI0ULL3rd3KIjqfvS8eT8xzfWb_5RPpV9uoexTvag5xONrq_E3gVHYF9z2n9pZ0HaHSOsI27qtQvdvCIp_j9Gg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=863488993574&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 144.76.238.55 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 9c35d0cde1bff74310b38d253123c472631c01bbd1365e8c26227271b174e5ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 82345500110683204445002012515021
Connection: close
Content-Length: 1325
Expires: Tue, 21 Nov 2023 15:00:46 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=c03aa7d106&subid=&uid=d2d81a9aeaeaae99&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCJcPFHcZcZYTbBYrE7gP83YpQpuW9oGmdl5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9CzkS_uN5pQlLoc_7bYIPCJ8iGIltmEYWHVMue-x3-laZNYgVzPEUY1K2-jBEvOqSdmbZM5xCaImpgpJLNCCElnE4msCipPO3BYvQcHAgdH4SU_2OgPpDjxFoqDq0TrKcUPDgQ6Udh5au0NHh26hHvHU00YC0lApicZqhR2qasMTsyOQjl5R-2ykxReoSJZq8nGisFsUGsXePMeuFFfj2Us-T2mO5qnK8XG2_s9JwffYSLCL1-6t7pBiPOY77hYka5h-EHueMJCylRy5zxNa70DUmV94aHU361VcJgmLJ4hUR5t6eQ6rYqfwWoo2R9EojiY3lQQB_c1ljxJ3V_hWuVBBo5S-NpJD_wWIgbZdtP4kBBimafABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi91ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_29cBfsSA1YbUdfv0a3ytBs-bQ4yA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AscBT0qz8YO_oowxGv8IfcxyZMMVowjK0ENAtT0QuQmjEJf6ewrWowMKwoukaYBQ5fZnPJ85tA81pBzh26HQ3EkXt_BlZVidnr-4cMRjtUTVBQHumuSpHcrbp6OA-AslXZrmSqrbX8koLV1AstGd8NuO9pMP9SKt1CYugmFHa-DoiDNM0%26cry%3D1%26dbm_d%3DAKAmf-A_BPGTK8GEQMkc2VFO_yeTjrwPDLAyAyau_ZYCbe5TrtXSq_ISCVlE3fbJNYoTEIqSxrnsWZwp16qnp9Xsj0OPmQ0fU56cTAjjo8LGaSU_sCZDDVMvtLLazIOeTgYW4vUpb_rG2-A7nasL8j_yomn_TbhHaGDqqnw4wcbYk3LIct06Eba4Jxuf8Qo411iqZ__x_8f5V_9eaL6FC0qfUp-0euwrnQDWbBLBfht1gI9wwnzgrQ24bdlguCUfaQpD6hyAceQuborKwVOfSntW7-SEcYjtGJysD4YpM5QfR6xgFMCGIVbhYwSdpaRS7ZfwpmttbXgbxI21h3cw6gwrsEFHop9cwvhgWC4BhvUmmaCwVcyABlDcLtPQQssg2jEfos2H_2x87RyAilV1IAqXPDYPr90AkcP-tVQe8dB139HlYMmWxEShTh3J4hFIlQQT-qJdj6yf4OKMG4zJjfxhcyCk8OI4H4YQ_j7lqKmJgVUiU1lAJNRY8sbhBH-Hq3nOS4A0QagzQI0ULL3rd3KIjqfvS8eT8xzfWb_5RPpV9uoexTvag5xONrq_E3gVHYF9z2n9pZ0HaHSOsI27qtQvdvCIp_j9Gg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=863488993574&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:46 +0100

GET
H/1.1

200
OK

request.php Show response
hal900016.redintelligence.net/ Frame EE76
Redirect Chain

https://hal900016.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=438720507b&subid=&uid=73ac9936a2835c85&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900016.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=438720507b&subid=&uid=73ac9936a2835c85&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

122ms
88ms

Script
application/x-javascript

138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=438720507b&subid=&uid=73ac9936a2835c85&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC_jk1HcZcZYPbBYrE7gP83YpQpuW9oGmFlZynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9AmhCrg5ydvuu3STA5ebEwj1j_Fo-FljZwuKk1cyxk8mJ5WOE03y56hD9jDsChUkoLH-CKeWVZZF1jtR5M2zM1EGWSbBk83qklIuVzlRNNLBfJ6UB9TmuXDT0mF9HOnA8bhObSoeA40vLsUrGZtZE_D_i_i_UXGAN8TqyOF7DQ_CiXSdGB03PCgMfnNulrnjq3pVmmXdD5ejGLa6ixkG39lsz_gYvHLgIm3mfWMtIXOxfw8uhS55PXT2BHde7puW-I2wDWciireK9HSOzfS5-yH3wjqKG3Bp3Gqo-HqmD8GtzV7T0eAmDuPy-MY41yA5bcb6Yf5GT8hQ1tK0yycbBrHhKglPOjiP8luYq4qAV39XhhU5OvABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi81ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3C_LhFwqrmbHselRmdQoRrZ37HNg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A2mgrZX27FgwCT_RRcixKqD5RBZpT40m6G_CntiGlR-5tXmRQQ7yOo-wEdHNEq9WSFgRX_mUEqaPGwp3IJ79jKFoafP2XEwtnDW6v15gSgxJ6VrsEFTY6q8pNnePlCGfG4_wFWN0k_0ct8vsJaIGrMev3GfIPD-IDCJ0CjqOAIQFs1GJ8%26cry%3D1%26dbm_d%3DAKAmf-Dt_VPjxeyMUz4rIR-bHH1mtgdn1uRWYgC5ufbToRPLVCWr0RAcpwU6i-Slg0YE9odVeABzTEDHN9tCwBUv_soQfZXpORQPk3WMVQFT7WoIIRFTrIP0iDfgXojNZcw7aZo8s9dP7-YuKCYfxd8h_TOkk6xm8-BcVlbtLIedvcqxCmhnHxzKIhvW7JZYjwxZ71g0lVrjYXtMyx73zzute-qj8b3cISD8E2DMbSY2B8CVfiidW_wPR8iM-RQ-4RkZ6Z9edp_-YsA7kQySHtZlsR_YuLs266uNeB1uDkB8dADMiB3HKuObB8Zw5G0QMr14ulcyF-JP-B_ZMw8d4bXYd8_uiB7ACIZUQAow4khAMn7zEwgxqkqTcut1P7iJv1cVT-5KS91OOK15tFnBkLhcBloWDxfVefgTJ6t9t8mIUcSbGGEPURCkQi7MlJE7OIM82N6cpHGl8rGkQSPEGvn0XeX0VOcPRgp344HDN0qGPltsdBQhNmEm4uZwO2B81N5GU0W9w79T_o8AaV-WgailL4Hc4jrxyiKgANudGkWiBlfgVwydXQ96aqHqYhu4KWEL8U-R4_9l4MNUfY7ZG5Vzwn8jUcnfoQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7714023737365&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: af972bc32e06045d3ab903812558fe423c13e1a0821e3cbe9282d0ba8349c91e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 69514600099249304444550012515016
Connection: close
Content-Length: 1354
Expires: Tue, 21 Nov 2023 15:00:46 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=438720507b&subid=&uid=73ac9936a2835c85&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC_jk1HcZcZYPbBYrE7gP83YpQpuW9oGmFlZynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9AmhCrg5ydvuu3STA5ebEwj1j_Fo-FljZwuKk1cyxk8mJ5WOE03y56hD9jDsChUkoLH-CKeWVZZF1jtR5M2zM1EGWSbBk83qklIuVzlRNNLBfJ6UB9TmuXDT0mF9HOnA8bhObSoeA40vLsUrGZtZE_D_i_i_UXGAN8TqyOF7DQ_CiXSdGB03PCgMfnNulrnjq3pVmmXdD5ejGLa6ixkG39lsz_gYvHLgIm3mfWMtIXOxfw8uhS55PXT2BHde7puW-I2wDWciireK9HSOzfS5-yH3wjqKG3Bp3Gqo-HqmD8GtzV7T0eAmDuPy-MY41yA5bcb6Yf5GT8hQ1tK0yycbBrHhKglPOjiP8luYq4qAV39XhhU5OvABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi81ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3C_LhFwqrmbHselRmdQoRrZ37HNg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A2mgrZX27FgwCT_RRcixKqD5RBZpT40m6G_CntiGlR-5tXmRQQ7yOo-wEdHNEq9WSFgRX_mUEqaPGwp3IJ79jKFoafP2XEwtnDW6v15gSgxJ6VrsEFTY6q8pNnePlCGfG4_wFWN0k_0ct8vsJaIGrMev3GfIPD-IDCJ0CjqOAIQFs1GJ8%26cry%3D1%26dbm_d%3DAKAmf-Dt_VPjxeyMUz4rIR-bHH1mtgdn1uRWYgC5ufbToRPLVCWr0RAcpwU6i-Slg0YE9odVeABzTEDHN9tCwBUv_soQfZXpORQPk3WMVQFT7WoIIRFTrIP0iDfgXojNZcw7aZo8s9dP7-YuKCYfxd8h_TOkk6xm8-BcVlbtLIedvcqxCmhnHxzKIhvW7JZYjwxZ71g0lVrjYXtMyx73zzute-qj8b3cISD8E2DMbSY2B8CVfiidW_wPR8iM-RQ-4RkZ6Z9edp_-YsA7kQySHtZlsR_YuLs266uNeB1uDkB8dADMiB3HKuObB8Zw5G0QMr14ulcyF-JP-B_ZMw8d4bXYd8_uiB7ACIZUQAow4khAMn7zEwgxqkqTcut1P7iJv1cVT-5KS91OOK15tFnBkLhcBloWDxfVefgTJ6t9t8mIUcSbGGEPURCkQi7MlJE7OIM82N6cpHGl8rGkQSPEGvn0XeX0VOcPRgp344HDN0qGPltsdBQhNmEm4uZwO2B81N5GU0W9w79T_o8AaV-WgailL4Hc4jrxyiKgANudGkWiBlfgVwydXQ96aqHqYhu4KWEL8U-R4_9l4MNUfY7ZG5Vzwn8jUcnfoQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7714023737365&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:46 +0100

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 8CC1 39 KB
15 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1434
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame E85F 39 KB
15 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1434
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 7D3F 39 KB
15 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1434
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 3E1B 39 KB
15 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1434
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 110ms
108ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdde3c849bdd-FRA
date: Tue, 21 Nov 2023 15:00:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QafGzClbbgTlSN7xy90U8K7%2FqzmwBllrhurF6ExJqqFi3uU8hqhyAEiOOq1A4mI2AeMhWOuGrZq2G83ffZEA9ZAGGynt6rMb0d%2BGtCihby8OnsFFTZYJp3iKIRuVvtCwJvfFO%2BJDAVtq5VO2%2FmQ%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/161089/5500/ 212 KB
64 KB 48ms
12ms Script
application/javascript 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/161089/5500/pwt.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4dcf78b31f69c1674cb5a75cd5fd5744538b50eaf34076396d9cf54acebee6e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 00:43:34 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=68783
accept-ranges: bytes
content-length: 65407
expires: Wed, 22 Nov 2023 10:07:09 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 112ms
112ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3zQl8CnxxUMr4ZvTKXqXczww5vQZXgYiPeMnW950qLiXkY%2BR8YV%2FVIcs52jdrTA1m4V5asdKQyotsIWxziAFyD3isi9MOhsQbSr7Bk2%2BhpUtxhJGQArydXHMCMJztneE4IVKUHf0EzzWggRHaMU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cddeed5a9bdd-FRA
content-length: 0

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame AC28 0
160 B 81ms
19ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=200527&r=https%3A%2F%2Fdemand.qortex.ai%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fsimcast.com%7C%7BUID%7D
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 21 Nov 2023 15:00:46 GMT
Pragma: no-cache
Server: nginx

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 117ms
117ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RNPTaTL1qCAwTNpnRHwcHgG%2BxD8mrOYfKwgu6NdqyMTY6PKmlgE9yzLWvWbTY9JEXuwcRB8PZWqjq7TdHeugCAHqeYv1eBPVPXvo0sFNr4lxEjr0cywZIt11xkleaoJrBrR7WX97u%2BNKo%2BY2OiY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cddefd959bdd-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 111ms
109ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdde4c999bdd-FRA
date: Tue, 21 Nov 2023 15:00:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0h0MG0ASbMH2Z0N7rrv052JGYuaExf4a6yinn2uJdcWKvcDhWowaQ%2B4z52gTGxn6og7Hanwi6sS%2B10108ea30rFIatcHKnUG5qB7us5Lw95eGoYkW%2FgeKa0h3LZsergbo2wsEFpGDTwskIJ4aRg%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 3685
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=82345500110683204445002012515021&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=82345500110683204445002012515021&actionid=879111&produktid=ratenkredit&dt_url=

0
201 B

91ms
49ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=82345500110683204445002012515021&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=c03aa7d106&subid=&uid=d2d81a9aeaeaae99&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCJcPFHcZcZYTbBYrE7gP83YpQpuW9oGmdl5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9CzkS_uN5pQlLoc_7bYIPCJ8iGIltmEYWHVMue-x3-laZNYgVzPEUY1K2-jBEvOqSdmbZM5xCaImpgpJLNCCElnE4msCipPO3BYvQcHAgdH4SU_2OgPpDjxFoqDq0TrKcUPDgQ6Udh5au0NHh26hHvHU00YC0lApicZqhR2qasMTsyOQjl5R-2ykxReoSJZq8nGisFsUGsXePMeuFFfj2Us-T2mO5qnK8XG2_s9JwffYSLCL1-6t7pBiPOY77hYka5h-EHueMJCylRy5zxNa70DUmV94aHU361VcJgmLJ4hUR5t6eQ6rYqfwWoo2R9EojiY3lQQB_c1ljxJ3V_hWuVBBo5S-NpJD_wWIgbZdtP4kBBimafABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi91ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_29cBfsSA1YbUdfv0a3ytBs-bQ4yA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AscBT0qz8YO_oowxGv8IfcxyZMMVowjK0ENAtT0QuQmjEJf6ewrWowMKwoukaYBQ5fZnPJ85tA81pBzh26HQ3EkXt_BlZVidnr-4cMRjtUTVBQHumuSpHcrbp6OA-AslXZrmSqrbX8koLV1AstGd8NuO9pMP9SKt1CYugmFHa-DoiDNM0%26cry%3D1%26dbm_d%3DAKAmf-A_BPGTK8GEQMkc2VFO_yeTjrwPDLAyAyau_ZYCbe5TrtXSq_ISCVlE3fbJNYoTEIqSxrnsWZwp16qnp9Xsj0OPmQ0fU56cTAjjo8LGaSU_sCZDDVMvtLLazIOeTgYW4vUpb_rG2-A7nasL8j_yomn_TbhHaGDqqnw4wcbYk3LIct06Eba4Jxuf8Qo411iqZ__x_8f5V_9eaL6FC0qfUp-0euwrnQDWbBLBfht1gI9wwnzgrQ24bdlguCUfaQpD6hyAceQuborKwVOfSntW7-SEcYjtGJysD4YpM5QfR6xgFMCGIVbhYwSdpaRS7ZfwpmttbXgbxI21h3cw6gwrsEFHop9cwvhgWC4BhvUmmaCwVcyABlDcLtPQQssg2jEfos2H_2x87RyAilV1IAqXPDYPr90AkcP-tVQe8dB139HlYMmWxEShTh3J4hFIlQQT-qJdj6yf4OKMG4zJjfxhcyCk8OI4H4YQ_j7lqKmJgVUiU1lAJNRY8sbhBH-Hq3nOS4A0QagzQI0ULL3rd3KIjqfvS8eT8xzfWb_5RPpV9uoexTvag5xONrq_E3gVHYF9z2n9pZ0HaHSOsI27qtQvdvCIp_j9Gg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=863488993574&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:46 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:46 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=82345500110683204445002012515021&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: B2A2D183:B06C_91EFC182:01BB_655CC61E_67CBF0B:1E87A

GET
H2 200 / Show response
adv.office-partner.de/ Frame 6200 930 B
922 B 57ms
9ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=c03aa7d106&subid=&uid=d2d81a9aeaeaae99&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCJcPFHcZcZYTbBYrE7gP83YpQpuW9oGmdl5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9CzkS_uN5pQlLoc_7bYIPCJ8iGIltmEYWHVMue-x3-laZNYgVzPEUY1K2-jBEvOqSdmbZM5xCaImpgpJLNCCElnE4msCipPO3BYvQcHAgdH4SU_2OgPpDjxFoqDq0TrKcUPDgQ6Udh5au0NHh26hHvHU00YC0lApicZqhR2qasMTsyOQjl5R-2ykxReoSJZq8nGisFsUGsXePMeuFFfj2Us-T2mO5qnK8XG2_s9JwffYSLCL1-6t7pBiPOY77hYka5h-EHueMJCylRy5zxNa70DUmV94aHU361VcJgmLJ4hUR5t6eQ6rYqfwWoo2R9EojiY3lQQB_c1ljxJ3V_hWuVBBo5S-NpJD_wWIgbZdtP4kBBimafABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi91ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_29cBfsSA1YbUdfv0a3ytBs-bQ4yA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AscBT0qz8YO_oowxGv8IfcxyZMMVowjK0ENAtT0QuQmjEJf6ewrWowMKwoukaYBQ5fZnPJ85tA81pBzh26HQ3EkXt_BlZVidnr-4cMRjtUTVBQHumuSpHcrbp6OA-AslXZrmSqrbX8koLV1AstGd8NuO9pMP9SKt1CYugmFHa-DoiDNM0%26cry%3D1%26dbm_d%3DAKAmf-A_BPGTK8GEQMkc2VFO_yeTjrwPDLAyAyau_ZYCbe5TrtXSq_ISCVlE3fbJNYoTEIqSxrnsWZwp16qnp9Xsj0OPmQ0fU56cTAjjo8LGaSU_sCZDDVMvtLLazIOeTgYW4vUpb_rG2-A7nasL8j_yomn_TbhHaGDqqnw4wcbYk3LIct06Eba4Jxuf8Qo411iqZ__x_8f5V_9eaL6FC0qfUp-0euwrnQDWbBLBfht1gI9wwnzgrQ24bdlguCUfaQpD6hyAceQuborKwVOfSntW7-SEcYjtGJysD4YpM5QfR6xgFMCGIVbhYwSdpaRS7ZfwpmttbXgbxI21h3cw6gwrsEFHop9cwvhgWC4BhvUmmaCwVcyABlDcLtPQQssg2jEfos2H_2x87RyAilV1IAqXPDYPr90AkcP-tVQe8dB139HlYMmWxEShTh3J4hFIlQQT-qJdj6yf4OKMG4zJjfxhcyCk8OI4H4YQ_j7lqKmJgVUiU1lAJNRY8sbhBH-Hq3nOS4A0QagzQI0ULL3rd3KIjqfvS8eT8xzfWb_5RPpV9uoexTvag5xONrq_E3gVHYF9z2n9pZ0HaHSOsI27qtQvdvCIp_j9Gg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=863488993574&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:46 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:46 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 05AA 2 KB
2 KB 154ms
79ms Script
text/html 18.130.85.236
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=82345500110683204445002012515021&nw=1
Requested by: Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.85.236 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-130-85-236.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: c641c3d6cb3fdc016ee9fd51ac1c434b9a6a880196f9d8ef4da8c75d1933de34

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Tue, 21 Nov 2023 15:00:46 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:46 GMT

GET
H2

200

activityi;dc_pre=CIjVwPCt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656 Show response
5994599.fls.doubleclick.net/ Frame 3893
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CIjVwPCt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656?

392 B
329 B

59ms
56ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CIjVwPCt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656?

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fb9bfa8503785b15f84b87120a8d61e511f663446b7b10de54c4cff1b794f0ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 220
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Tue, 21 Nov 2023 15:00:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIjVwPCt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900021.redintelligence.net/ Frame 3528 7 KB
2 KB 43ms
13ms Document
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request_content.php?s=82345500110683204445002012515021&a=e0a83d03
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=c03aa7d106&subid=&uid=d2d81a9aeaeaae99&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCJcPFHcZcZYTbBYrE7gP83YpQpuW9oGmdl5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9CzkS_uN5pQlLoc_7bYIPCJ8iGIltmEYWHVMue-x3-laZNYgVzPEUY1K2-jBEvOqSdmbZM5xCaImpgpJLNCCElnE4msCipPO3BYvQcHAgdH4SU_2OgPpDjxFoqDq0TrKcUPDgQ6Udh5au0NHh26hHvHU00YC0lApicZqhR2qasMTsyOQjl5R-2ykxReoSJZq8nGisFsUGsXePMeuFFfj2Us-T2mO5qnK8XG2_s9JwffYSLCL1-6t7pBiPOY77hYka5h-EHueMJCylRy5zxNa70DUmV94aHU361VcJgmLJ4hUR5t6eQ6rYqfwWoo2R9EojiY3lQQB_c1ljxJ3V_hWuVBBo5S-NpJD_wWIgbZdtP4kBBimafABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi91ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_29cBfsSA1YbUdfv0a3ytBs-bQ4yA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AscBT0qz8YO_oowxGv8IfcxyZMMVowjK0ENAtT0QuQmjEJf6ewrWowMKwoukaYBQ5fZnPJ85tA81pBzh26HQ3EkXt_BlZVidnr-4cMRjtUTVBQHumuSpHcrbp6OA-AslXZrmSqrbX8koLV1AstGd8NuO9pMP9SKt1CYugmFHa-DoiDNM0%26cry%3D1%26dbm_d%3DAKAmf-A_BPGTK8GEQMkc2VFO_yeTjrwPDLAyAyau_ZYCbe5TrtXSq_ISCVlE3fbJNYoTEIqSxrnsWZwp16qnp9Xsj0OPmQ0fU56cTAjjo8LGaSU_sCZDDVMvtLLazIOeTgYW4vUpb_rG2-A7nasL8j_yomn_TbhHaGDqqnw4wcbYk3LIct06Eba4Jxuf8Qo411iqZ__x_8f5V_9eaL6FC0qfUp-0euwrnQDWbBLBfht1gI9wwnzgrQ24bdlguCUfaQpD6hyAceQuborKwVOfSntW7-SEcYjtGJysD4YpM5QfR6xgFMCGIVbhYwSdpaRS7ZfwpmttbXgbxI21h3cw6gwrsEFHop9cwvhgWC4BhvUmmaCwVcyABlDcLtPQQssg2jEfos2H_2x87RyAilV1IAqXPDYPr90AkcP-tVQe8dB139HlYMmWxEShTh3J4hFIlQQT-qJdj6yf4OKMG4zJjfxhcyCk8OI4H4YQ_j7lqKmJgVUiU1lAJNRY8sbhBH-Hq3nOS4A0QagzQI0ULL3rd3KIjqfvS8eT8xzfWb_5RPpV9uoexTvag5xONrq_E3gVHYF9z2n9pZ0HaHSOsI27qtQvdvCIp_j9Gg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=863488993574&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 0c8097f1134510cfa01fdaa51fb47bae6f2658edf43d5472bbb40c45014f6c6c

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2091
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:46 GMT
Expires: Tue, 21 Nov 2023 15:00:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 05AA
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=82345500110683204445002012515021&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=82345500110683204445002012515021&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
666 B

172ms
60ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=82345500110683204445002012515021&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B080_91EFC182:01BB_655CC61E_6846369:1A428
x-iplb-instance: 40028
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=82345500110683204445002012515021&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Tue, 21 Nov 2023 15:00:46 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 05AA 43 B
704 B 103ms
63ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=82345500110683204445002012515021&pv=1

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 42F5
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=78315200094716204444994012515003&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78315200094716204444994012515003&actionid=879111&produktid=ratenkredit&dt_url=

0
201 B

122ms
64ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78315200094716204444994012515003&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90003.redintelligence.net
URL: https://hal90003.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=68e1db6b83&subid=&uid=edc9d36b9635f477&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmqNpHcZcZYHbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9AhnesWBchLU0dPCEl6xd-ZFf5qy1E0DanOqT0b9ZZPaEDdapxOTga1Bye79vODRkXGZzfRGZl_43XDvT66Wdqpis1FKvzdlokPqpc7FivU8qeazbxugSVDYrFoGXpEixWI5Ld7nORP2eT-atW7E33GyO9FWoUeiXtVQX0KqHph7ksz4cviGmQiS7Wt25b6ymhZR03XBU14z6Hm9fIi0br_73qixgWg0HUaoxsVko-P31LXOjrfj9sDHNMoRP8xxykbBWRoU2vhZtraqqtvl6Qex9_3UgSsILtxpqca-UL-PBPoTZDlaNTkfjZGeMJkp5yb0trfMXOdo6bxR_g4gsSLrVWeduZO0gXhdr7PILgoRKQbKt95wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIutXj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_2tDjD1rltF5C7yMW_YeJ2Pp-kSQg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-D_zHx_Y6u6ja5FOpOW9cbaj7KEC3TZFbo9W1aoeq_8Gj3pjl684WiS5BVYmjK0wtKXo-vSxOYsfwPEBcCv7NbmS4hcwbEKGLF7Lz392LCcqFqUiwBSrJRFtZQBgtp0Vx2RDeR4eHNF5QB7xnIB1PSEgg9EQVUIfC98xJhhV_0xi6W2-nw%26cry%3D1%26dbm_d%3DAKAmf-DPVaTofoCIq3h5qoYODhjqFGaf5sglwEsbgZN9EgROAWVJ6_iyDOfCeXCvedDs-zHtFHFPbwB8lsJ8BclHwAl_pK2_4gMxjqj5FsGEA1iwH8jPioVYUpOEoZKAljqfXq65GKfCrl-AAOxBa5_-ff7-oJDeJnK30OPm7-c1bxbL50L5a-mqHbU7Rptoe1XOtgcRGznQyA8iZE1Wf5sdu_XrSGdtu1GCjEDdrHEj2gO3NfE94iHbnzGSwU5-bkcgVf4xxd_WA_O3IQoDUkIh-E8HQsTUBwlR0fjEYx7uvH9Ccru7epSf3elJkIuvUrISaFFwrcUZ_dp1NWDSUAj7SQnNnID9CMwEhZLtbl8UKXkCt-MhNGSH-7_5D1HrZe1v7MMNdAGO8P_gERfJTCFt9V9mktnv5-YeW8frJ2gemSF7_QUMNt7TcP-Q_uWIxNS8G2KIXnpvod_Gibyyic5H1H75II3r9yaaaYHwoM8QptqsH1rwaGTpbHXaaGyvnOsNdmnx_FnK2YdKSycZCI-djfgbULB-NcaiuR4tgQzYurQHBGI6Ie_O3bQmLoDwqTJ2sM7xLuIEBvruD7XPswMxSAo-OaoabQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1877210419018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:46 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:46 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78315200094716204444994012515003&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: B2A2D183:B06A_91EFC182:01BB_655CC61E_6842FD1:1A42B

GET
H2 200 / Show response
adv.office-partner.de/ Frame B33D 930 B
923 B 50ms
8ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90003.redintelligence.net
URL: https://hal90003.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=68e1db6b83&subid=&uid=edc9d36b9635f477&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmqNpHcZcZYHbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9AhnesWBchLU0dPCEl6xd-ZFf5qy1E0DanOqT0b9ZZPaEDdapxOTga1Bye79vODRkXGZzfRGZl_43XDvT66Wdqpis1FKvzdlokPqpc7FivU8qeazbxugSVDYrFoGXpEixWI5Ld7nORP2eT-atW7E33GyO9FWoUeiXtVQX0KqHph7ksz4cviGmQiS7Wt25b6ymhZR03XBU14z6Hm9fIi0br_73qixgWg0HUaoxsVko-P31LXOjrfj9sDHNMoRP8xxykbBWRoU2vhZtraqqtvl6Qex9_3UgSsILtxpqca-UL-PBPoTZDlaNTkfjZGeMJkp5yb0trfMXOdo6bxR_g4gsSLrVWeduZO0gXhdr7PILgoRKQbKt95wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIutXj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_2tDjD1rltF5C7yMW_YeJ2Pp-kSQg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-D_zHx_Y6u6ja5FOpOW9cbaj7KEC3TZFbo9W1aoeq_8Gj3pjl684WiS5BVYmjK0wtKXo-vSxOYsfwPEBcCv7NbmS4hcwbEKGLF7Lz392LCcqFqUiwBSrJRFtZQBgtp0Vx2RDeR4eHNF5QB7xnIB1PSEgg9EQVUIfC98xJhhV_0xi6W2-nw%26cry%3D1%26dbm_d%3DAKAmf-DPVaTofoCIq3h5qoYODhjqFGaf5sglwEsbgZN9EgROAWVJ6_iyDOfCeXCvedDs-zHtFHFPbwB8lsJ8BclHwAl_pK2_4gMxjqj5FsGEA1iwH8jPioVYUpOEoZKAljqfXq65GKfCrl-AAOxBa5_-ff7-oJDeJnK30OPm7-c1bxbL50L5a-mqHbU7Rptoe1XOtgcRGznQyA8iZE1Wf5sdu_XrSGdtu1GCjEDdrHEj2gO3NfE94iHbnzGSwU5-bkcgVf4xxd_WA_O3IQoDUkIh-E8HQsTUBwlR0fjEYx7uvH9Ccru7epSf3elJkIuvUrISaFFwrcUZ_dp1NWDSUAj7SQnNnID9CMwEhZLtbl8UKXkCt-MhNGSH-7_5D1HrZe1v7MMNdAGO8P_gERfJTCFt9V9mktnv5-YeW8frJ2gemSF7_QUMNt7TcP-Q_uWIxNS8G2KIXnpvod_Gibyyic5H1H75II3r9yaaaYHwoM8QptqsH1rwaGTpbHXaaGyvnOsNdmnx_FnK2YdKSycZCI-djfgbULB-NcaiuR4tgQzYurQHBGI6Ie_O3bQmLoDwqTJ2sM7xLuIEBvruD7XPswMxSAo-OaoabQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1877210419018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:46 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:46 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame D408
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=78315200094716204444994012515003&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78315200094716204444994012515003&actionid=879111&produktid=ratenkredit&dt_url=

0
202 B

61ms
61ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78315200094716204444994012515003&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 21 Nov 2023 04:00:46 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40028
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B080_91EFC182:01BB_655CC61E_6846354:1A428
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78315200094716204444994012515003&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame D408 43 B
666 B 188ms
124ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=78315200094716204444994012515003&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B06E_91EFC182:01BB_655CC61E_67CBF0F:1E87A
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame D408 43 B
704 B 109ms
74ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=78315200094716204444994012515003&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame F776
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=12088300089271904444994012515008&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=12088300089271904444994012515008&actionid=879111&produktid=ratenkredit&dt_url=

0
201 B

67ms
49ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=12088300089271904444994012515008&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=09b7505222&subid=&uid=f8d3ad0df702a4dc&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCP9jPHcZcZYLbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9CXqX_KtBMSEdOw6cce6QF1Z_9EeeRbHftV3AuKXqNFhBUM2rWZlbIz-08WUob8raEJ2uQUMCR-PbQcYt2eU_fr-zM0H55uULV9OnlVHfI0GGNNa2__fj4h8ogZXybdP-cHpIfKzCBzJdwtteRayNJa4LiDIyiNrc_7b0SdLnKm2mtGguPYUJA1TieQDN3iKjPAkdDrQdqnug80nRt4kAK_2t5ILaM34mevHb_nZODG_MevPYlExnf2-lxv-AWjnzTaYxntDN5_IeGiAWFe3AnxYQ_Z08IOAYZlE0hkZfMxxszHAT1kb1wLut3WJtIn8McCA5fZ9-5oI7BX0B6DYXNmturP0xeOJeMKbMBXmx8YsqfSr6wtwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIu9Xj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3fJEYO12H-PR4cy2iTkS7jrB8cGQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-Cc1bwq9twZ9RCfcsndQqXIatlCdzsi6TnI7k7NEW5KrQc6c-Ap7T7SxHJKqoYdOY6u5DzT0UmD0XzLBlXneAvtU-uEAzNtOG6pZjSCDPJ6yyZfDMlIKw87EK4aRtNXAU2v4LRorsQoswa0UmmvbPkpjhYJBRjTY8QiFg31OMzxLfcRGO4%26cry%3D1%26dbm_d%3DAKAmf-C24PUSM65CSGyE0PUa8KipY1LQL_CApgRT0DGao9CTBTXJoKXVvtPENU9e02s8Eol228w2DrTModm949c0e9ADZBecJAFJUrIQjp444vEXUe34ogQhnnU2YzFUzQFXmCL4KtOUpY7DCmZKBQCSC8Ir0HgEshj8t0lAxlwwV9bf1AyfG-xm2N2EFKLm55ZtfJx03Dr1ojYjZJRFQcNLSPc_NYPlGfeU_EHt5Zj7FtqkOm0Ld0U7PjNLJqodgx_oAX6w1U6gyRe5YP4SBv36wiyTPKJhx8DEMWholmPAFJiC_MiAGX0kBv2wG9gTdLyXOealI4lGRPJSZKPE033JdZGCFGYpEKObA3XB5mPCpM-YlaPpz66RPSNoH8BMmCRNtjdPds-_ObNo7BeOpuW0zj4zoheuz0iCACQFtccJPdPeebZXtyzyiTtJTz4ddf9Wni7azMufWE3LGIArrnSx02xw5Wl0ciG6yJGHfzlOFHP66FIpT2ThNcpRltg2wMhyyJcHL9jrXFnG-AUMzbTLbJJcvqEpaSC8Eaya0wUWLb_8YkBehhg185GN7zoCX5M5eqJhlKc7gZuP2s_c7DfRXMKGNtIWaA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1691609899628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:46 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:46 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=12088300089271904444994012515008&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: B2A2D183:B07A_91EFC182:01BB_655CC61E_683F943:1A42A

GET
H2 200 / Show response
adv.office-partner.de/ Frame 732D 930 B
922 B 37ms
9ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=09b7505222&subid=&uid=f8d3ad0df702a4dc&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCP9jPHcZcZYLbBYrE7gP83YpQpuW9oGm9k5ynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJcCT9CXqX_KtBMSEdOw6cce6QF1Z_9EeeRbHftV3AuKXqNFhBUM2rWZlbIz-08WUob8raEJ2uQUMCR-PbQcYt2eU_fr-zM0H55uULV9OnlVHfI0GGNNa2__fj4h8ogZXybdP-cHpIfKzCBzJdwtteRayNJa4LiDIyiNrc_7b0SdLnKm2mtGguPYUJA1TieQDN3iKjPAkdDrQdqnug80nRt4kAK_2t5ILaM34mevHb_nZODG_MevPYlExnf2-lxv-AWjnzTaYxntDN5_IeGiAWFe3AnxYQ_Z08IOAYZlE0hkZfMxxszHAT1kb1wLut3WJtIn8McCA5fZ9-5oI7BX0B6DYXNmturP0xeOJeMKbMBXmx8YsqfSr6wtwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIu9Xj763VggMVCqJ7Ch38rgIKsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3fJEYO12H-PR4cy2iTkS7jrB8cGQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-Cc1bwq9twZ9RCfcsndQqXIatlCdzsi6TnI7k7NEW5KrQc6c-Ap7T7SxHJKqoYdOY6u5DzT0UmD0XzLBlXneAvtU-uEAzNtOG6pZjSCDPJ6yyZfDMlIKw87EK4aRtNXAU2v4LRorsQoswa0UmmvbPkpjhYJBRjTY8QiFg31OMzxLfcRGO4%26cry%3D1%26dbm_d%3DAKAmf-C24PUSM65CSGyE0PUa8KipY1LQL_CApgRT0DGao9CTBTXJoKXVvtPENU9e02s8Eol228w2DrTModm949c0e9ADZBecJAFJUrIQjp444vEXUe34ogQhnnU2YzFUzQFXmCL4KtOUpY7DCmZKBQCSC8Ir0HgEshj8t0lAxlwwV9bf1AyfG-xm2N2EFKLm55ZtfJx03Dr1ojYjZJRFQcNLSPc_NYPlGfeU_EHt5Zj7FtqkOm0Ld0U7PjNLJqodgx_oAX6w1U6gyRe5YP4SBv36wiyTPKJhx8DEMWholmPAFJiC_MiAGX0kBv2wG9gTdLyXOealI4lGRPJSZKPE033JdZGCFGYpEKObA3XB5mPCpM-YlaPpz66RPSNoH8BMmCRNtjdPds-_ObNo7BeOpuW0zj4zoheuz0iCACQFtccJPdPeebZXtyzyiTtJTz4ddf9Wni7azMufWE3LGIArrnSx02xw5Wl0ciG6yJGHfzlOFHP66FIpT2ThNcpRltg2wMhyyJcHL9jrXFnG-AUMzbTLbJJcvqEpaSC8Eaya0wUWLb_8YkBehhg185GN7zoCX5M5eqJhlKc7gZuP2s_c7DfRXMKGNtIWaA%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1691609899628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:46 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:46 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame B32A
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=12088300089271904444994012515008&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=12088300089271904444994012515008&actionid=879111&produktid=ratenkredit&dt_url=

0
200 B

58ms
57ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=12088300089271904444994012515008&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 21 Nov 2023 04:00:46 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40027
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B070_91EFC182:01BB_655CC61E_67CBF0D:1E87A
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=12088300089271904444994012515008&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame B32A 43 B
666 B 240ms
66ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=12088300089271904444994012515008&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B07A_91EFC182:01BB_655CC61E_683F94D:1A42A
x-iplb-instance: 40028
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame B32A 43 B
704 B 131ms
109ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=12088300089271904444994012515008&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6C61 1 KB
643 B 16ms
15ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 05AA 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 692e409c3bf5aa78d656466254bee9f98c9d92e80d6de64ab2eb99d2eff759ef

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 3528 5 KB
682 B 36ms
36ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=82345500110683204445002012515021&a=e0a83d03

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:36:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3528 17 KB
17 KB 35ms
12ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=82345500110683204445002012515021&a=e0a83d03
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: da1d80b4c263ddfdd7e3ddabd768ac29ba74f0970b8da0ea7bf90a9d1d6b71ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3528 16 KB
16 KB 35ms
13ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=82345500110683204445002012515021&a=e0a83d03
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0d3e2ab1c22c68189ca4a981919785af2d9f8129f90a4bc3ff5071d24a32c9d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3528 14 KB
14 KB 37ms
13ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/image-1200x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=82345500110683204445002012515021&a=e0a83d03
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e1f44708e987d6930d664b9b50976fd76f4ddac735e7ae62dc50e85e9a6401fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13918
Vary: Accept-Encoding
Content-Type: image/png

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
279 B 123ms
123ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zuZjNj8kLcC06hUOnhPh2t8dPWuV5oXzyT9NlEY%2F609umQqlhsU7Rm3zS6uYPAPj5cdaFQp1SXtRGqdRSi30g9Vg8wn0rzOhf6ul6FBkMAgMmgTCoFpmRu3Bj43Lwg3X2dKxtvSErn0Rfv6nspI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cde0884b9bdd-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 199ms
199ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cddf3e2a9bdd-FRA
date: Tue, 21 Nov 2023 15:00:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gnVi3kLkxvYb5quZNIDcBGSlxlMgp%2Bu6tUg%2FwUypc9xA8HUqux%2BFlQDwf4fRvp6K5tRbNq0DVvaX6dO0QDB1uaIq8QuRWjZW1KoEjJKWdxB8cl6GfSGyxBiuZptbfJSQTZZGL2%2F4i8awWGxJhTk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 64BB
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=69514600099249304444550012515016&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=69514600099249304444550012515016&actionid=879111&produktid=ratenkredit&dt_url=

0
629 B

32ms
29ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=69514600099249304444550012515016&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=438720507b&subid=&uid=73ac9936a2835c85&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC_jk1HcZcZYPbBYrE7gP83YpQpuW9oGmFlZynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9AmhCrg5ydvuu3STA5ebEwj1j_Fo-FljZwuKk1cyxk8mJ5WOE03y56hD9jDsChUkoLH-CKeWVZZF1jtR5M2zM1EGWSbBk83qklIuVzlRNNLBfJ6UB9TmuXDT0mF9HOnA8bhObSoeA40vLsUrGZtZE_D_i_i_UXGAN8TqyOF7DQ_CiXSdGB03PCgMfnNulrnjq3pVmmXdD5ejGLa6ixkG39lsz_gYvHLgIm3mfWMtIXOxfw8uhS55PXT2BHde7puW-I2wDWciireK9HSOzfS5-yH3wjqKG3Bp3Gqo-HqmD8GtzV7T0eAmDuPy-MY41yA5bcb6Yf5GT8hQ1tK0yycbBrHhKglPOjiP8luYq4qAV39XhhU5OvABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi81ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3C_LhFwqrmbHselRmdQoRrZ37HNg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A2mgrZX27FgwCT_RRcixKqD5RBZpT40m6G_CntiGlR-5tXmRQQ7yOo-wEdHNEq9WSFgRX_mUEqaPGwp3IJ79jKFoafP2XEwtnDW6v15gSgxJ6VrsEFTY6q8pNnePlCGfG4_wFWN0k_0ct8vsJaIGrMev3GfIPD-IDCJ0CjqOAIQFs1GJ8%26cry%3D1%26dbm_d%3DAKAmf-Dt_VPjxeyMUz4rIR-bHH1mtgdn1uRWYgC5ufbToRPLVCWr0RAcpwU6i-Slg0YE9odVeABzTEDHN9tCwBUv_soQfZXpORQPk3WMVQFT7WoIIRFTrIP0iDfgXojNZcw7aZo8s9dP7-YuKCYfxd8h_TOkk6xm8-BcVlbtLIedvcqxCmhnHxzKIhvW7JZYjwxZ71g0lVrjYXtMyx73zzute-qj8b3cISD8E2DMbSY2B8CVfiidW_wPR8iM-RQ-4RkZ6Z9edp_-YsA7kQySHtZlsR_YuLs266uNeB1uDkB8dADMiB3HKuObB8Zw5G0QMr14ulcyF-JP-B_ZMw8d4bXYd8_uiB7ACIZUQAow4khAMn7zEwgxqkqTcut1P7iJv1cVT-5KS91OOK15tFnBkLhcBloWDxfVefgTJ6t9t8mIUcSbGGEPURCkQi7MlJE7OIM82N6cpHGl8rGkQSPEGvn0XeX0VOcPRgp344HDN0qGPltsdBQhNmEm4uZwO2B81N5GU0W9w79T_o8AaV-WgailL4Hc4jrxyiKgANudGkWiBlfgVwydXQ96aqHqYhu4KWEL8U-R4_9l4MNUfY7ZG5Vzwn8jUcnfoQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7714023737365&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:46 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:46 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=69514600099249304444550012515016&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: B2A2D183:B06A_91EFC182:01BB_655CC61E_6842FD7:1A42B

GET
H2 200 / Show response
adv.office-partner.de/ Frame 9701 930 B
922 B 7ms
7ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=438720507b&subid=&uid=73ac9936a2835c85&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC_jk1HcZcZYPbBYrE7gP83YpQpuW9oGmFlZynyQ_wLhABIIb3hiZgleKmgrAHyAEJqQKmuBAPHlyyPqgDAcgDmwSqBJYCT9AmhCrg5ydvuu3STA5ebEwj1j_Fo-FljZwuKk1cyxk8mJ5WOE03y56hD9jDsChUkoLH-CKeWVZZF1jtR5M2zM1EGWSbBk83qklIuVzlRNNLBfJ6UB9TmuXDT0mF9HOnA8bhObSoeA40vLsUrGZtZE_D_i_i_UXGAN8TqyOF7DQ_CiXSdGB03PCgMfnNulrnjq3pVmmXdD5ejGLa6ixkG39lsz_gYvHLgIm3mfWMtIXOxfw8uhS55PXT2BHde7puW-I2wDWciireK9HSOzfS5-yH3wjqKG3Bp3Gqo-HqmD8GtzV7T0eAmDuPy-MY41yA5bcb6Yf5GT8hQ1tK0yycbBrHhKglPOjiP8luYq4qAV39XhhU5OvABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwi81ePvrdWCAxUKonsKHfyuAgqwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB%26sig%3DAOD64_3C_LhFwqrmbHselRmdQoRrZ37HNg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A2mgrZX27FgwCT_RRcixKqD5RBZpT40m6G_CntiGlR-5tXmRQQ7yOo-wEdHNEq9WSFgRX_mUEqaPGwp3IJ79jKFoafP2XEwtnDW6v15gSgxJ6VrsEFTY6q8pNnePlCGfG4_wFWN0k_0ct8vsJaIGrMev3GfIPD-IDCJ0CjqOAIQFs1GJ8%26cry%3D1%26dbm_d%3DAKAmf-Dt_VPjxeyMUz4rIR-bHH1mtgdn1uRWYgC5ufbToRPLVCWr0RAcpwU6i-Slg0YE9odVeABzTEDHN9tCwBUv_soQfZXpORQPk3WMVQFT7WoIIRFTrIP0iDfgXojNZcw7aZo8s9dP7-YuKCYfxd8h_TOkk6xm8-BcVlbtLIedvcqxCmhnHxzKIhvW7JZYjwxZ71g0lVrjYXtMyx73zzute-qj8b3cISD8E2DMbSY2B8CVfiidW_wPR8iM-RQ-4RkZ6Z9edp_-YsA7kQySHtZlsR_YuLs266uNeB1uDkB8dADMiB3HKuObB8Zw5G0QMr14ulcyF-JP-B_ZMw8d4bXYd8_uiB7ACIZUQAow4khAMn7zEwgxqkqTcut1P7iJv1cVT-5KS91OOK15tFnBkLhcBloWDxfVefgTJ6t9t8mIUcSbGGEPURCkQi7MlJE7OIM82N6cpHGl8rGkQSPEGvn0XeX0VOcPRgp344HDN0qGPltsdBQhNmEm4uZwO2B81N5GU0W9w79T_o8AaV-WgailL4Hc4jrxyiKgANudGkWiBlfgVwydXQ96aqHqYhu4KWEL8U-R4_9l4MNUfY7ZG5Vzwn8jUcnfoQ%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7714023737365&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:46 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:46 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame EE76
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=69514600099249304444550012515016&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=69514600099249304444550012515016&actionid=879111&produktid=ratenkredit&dt_url=

0
36 B

31ms
30ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=69514600099249304444550012515016&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:45 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 21 Nov 2023 04:00:46 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40027
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B06C_91EFC182:01BB_655CC61E_67CBF18:1E87A
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=69514600099249304444550012515016&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame EE76 43 B
666 B 141ms
66ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=69514600099249304444550012515016&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B070_91EFC182:01BB_655CC61E_67CBF1D:1E87A
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame EE76 43 B
704 B 116ms
116ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=69514600099249304444550012515016&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame B33D 174 KB
62 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2b4cc52536e20695a5e3d40666465d174f2323db405dc959bdf5575de67146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63903
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 6200 174 KB
62 KB 64ms
63ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2b4cc52536e20695a5e3d40666465d174f2323db405dc959bdf5575de67146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63903
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 732D 174 KB
62 KB 89ms
89ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2b4cc52536e20695a5e3d40666465d174f2323db405dc959bdf5575de67146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63903
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 6C61
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmTqRoPoP6epJcdyVZxWG_Kls8gHoXqVxkkhLZ-eftGzeK1BHADJyK4LD8PVZKpOmu0CA2RxAoGUxr3Ro1ZbAzJfKJJ7jCXK&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmTqRoPoP6epJcdyVZxWG_Kls8gHoXqVxkkhLZ-eftGzeK1BHADJyK4LD8PVZKpOmu0CA2RxAoGUxr3Ro1ZbAzJfKJJ7jCX...

43 B
465 B

186ms
166ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmTqRoPoP6epJcdyVZxWG_Kls8gHoXqVxkkhLZ-eftGzeK1BHADJyK4LD8PVZKpOmu0CA2RxAoGUxr3Ro1ZbAzJfKJJ7jCXK&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTqRoPoP6epJcdyVZxWG_Kls8gHoXqVxkkhLZ-eftGzeK1BHADJyK4LD8PVZKpOmu0CA2RxAoGUxr3Ro1ZbAzJfKJJ7jCXK%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cde1883fbbce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 926
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmTqRoPoP6epJcdyVZxWG_Kls8gHoXqVxkkhLZ-eftGzeK1BHADJyK4LD8PVZKpOmu0CA2RxAoGUxr3Ro1ZbAzJfKJJ7jCXK&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTqRoPoP6epJcdyVZxWG_Kls8gHoXqVxkkhLZ-eftGzeK1BHADJyK4LD8PVZKpOmu0CA2RxAoGUxr3Ro1ZbAzJfKJJ7jCXK%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cde01e4dbbce-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6C61
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH3hduNiSukvdbq7AW3XKzM&google_cver=1&google_push=AXcoOmQDT8srwGBRwvz46xGar4zp1cP2nF0iQ9SxdCzDuT_-kWu_V618c7OIzW5k1blEHwywunu0zynxJa5Pkt--gMzPOoB...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQDT8srwGBRwvz46xGar4zp1cP2nF0iQ9SxdCzDuT_-kWu_V618c7OIzW5k1blEHwywunu0zynxJa5Pkt--gMzPOoBzZKch&google_hm=eS1BbXdyRXhGRTJwRUJ6N3...

170 B
188 B

25ms
24ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQDT8srwGBRwvz46xGar4zp1cP2nF0iQ9SxdCzDuT_-kWu_V618c7OIzW5k1blEHwywunu0zynxJa5Pkt--gMzPOoBzZKch&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQDT8srwGBRwvz46xGar4zp1cP2nF0iQ9SxdCzDuT_-kWu_V618c7OIzW5k1blEHwywunu0zynxJa5Pkt--gMzPOoBzZKch&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6C61
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMqGy60M6p_eXGGfuURu_UA&google_cver=1&google_push=AXcoOmTpUrTopjYDRBL7Rox-CF9ePa9V00U1eowjF8rKfkAUGvqFSal-2I7BEfWHgDPmr86rTmHT-QNm...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEMqGy60M6p_eXGGfuURu_UA&google_cver=1&google_push=AXcoOmTpUrTopjYDRBL7Rox-CF9ePa9V00U1eowjF8rKfkAUGvqFSal-2I7BEfWHgDPmr86rTmH...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmTpUrTopjYDRBL7Rox-CF9ePa9V00U1eowjF8rKfkAUGvqFSal-2I7BEfWHgDPmr86rTmHT-Q...

170 B
188 B

25ms
24ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmTpUrTopjYDRBL7Rox-CF9ePa9V00U1eowjF8rKfkAUGvqFSal-2I7BEfWHgDPmr86rTmHT-QNm-MlbmkQ7uRkVwQM6CGgV

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmTpUrTopjYDRBL7Rox-CF9ePa9V00U1eowjF8rKfkAUGvqFSal-2I7BEfWHgDPmr86rTmHT-QNm-MlbmkQ7uRkVwQM6CGgV
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 6C61 43 B
245 B 64ms
22ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH3uwK5nHx8iO3mYwRAGGdo&google_cver=1&google_push=AXcoOmTZMMCIcFBhpsITgomVwf1neKdrHM6VJivzPyGdIg49FdhaRrpQySxQ2WKqp-5QsqvB2JYKr8-kYmqIrSo1fYkbLTYMli-k
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6C61
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJWS44H1Qi7bIzWeyfiJK04&google_cver=1&google_push=AXcoOmQt9HMcos7RAB3soTVEojahexTrMFdJX68hMhHCE7gqy4IEUKsQVT4EcO1h4RQw1hPGXg-DmEXTPM1LVHj...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmQt9HMcos7RAB3soTVEojahexTrMFdJX68hMhHCE7gqy4IEUKsQVT4EcO1h4RQw1hPGXg-DmEXTPM1LVH...

170 B
188 B

27ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmQt9HMcos7RAB3soTVEojahexTrMFdJX68hMhHCE7gqy4IEUKsQVT4EcO1h4RQw1hPGXg-DmEXTPM1LVHjDRO8MtImMAr5b

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmQt9HMcos7RAB3soTVEojahexTrMFdJX68hMhHCE7gqy4IEUKsQVT4EcO1h4RQw1hPGXg-DmEXTPM1LVHjDRO8MtImMAr5b
Date: Tue, 21 Nov 2023 15:00:47 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6C61
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAa6ygZgWoof6SWqNIVA928&google_cver=1&google_push=AXcoOmTWgVA4sZYO3Cu7coGtBWi-ktTfaRRD_X7rUwxR4HWjE7zUsfAzRhLHl7Xe36F-MpouL32...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLMkYtMjAtSURTMg==&google_push=AXcoOmTWgVA4sZYO3Cu7coGtBWi-ktTfaRRD_X7rUwxR4HWjE7zUsfAzRhLHl7Xe36F-MpouL32kpbxwNKSisCzFeguUxkHHxH1E

170 B
188 B

27ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLMkYtMjAtSURTMg==&google_push=AXcoOmTWgVA4sZYO3Cu7coGtBWi-ktTfaRRD_X7rUwxR4HWjE7zUsfAzRhLHl7Xe36F-MpouL32kpbxwNKSisCzFeguUxkHHxH1E

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLMkYtMjAtSURTMg==&google_push=AXcoOmTWgVA4sZYO3Cu7coGtBWi-ktTfaRRD_X7rUwxR4HWjE7zUsfAzRhLHl7Xe36F-MpouL32kpbxwNKSisCzFeguUxkHHxH1E
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b71bced807741b20dd93dce6c2d26405
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6C61
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmSIjNXL0BfyM_xnceUTrVQh9GLWpttrx...

170 B
188 B

28ms
27ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmSIjNXL0BfyM_xnceUTrVQh9GLWpttrx8Pap8yYtIlah20Kd2g8NOdJ8jsk49NtM99WsNEYfCH6qwlNurkwAU7I-4l6WjhP

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1VLiI0DJk8j24PdWGl6%2BPbODE9o772iSEP7YPVK8BCdvXyGGOBsxpeXSfmHzCJz5uQw2MK3EP1O8hOI4pvsOXA6sVjVby6D3WPbcLnjxmAHPhhdvaomDxHC%2BTrye7dyOaHvwbv9iI4u5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmSIjNXL0BfyM_xnceUTrVQh9GLWpttrx8Pap8yYtIlah20Kd2g8NOdJ8jsk49NtM99WsNEYfCH6qwlNurkwAU7I-4l6WjhP
cache-control: no-cache
cf-ray: 8299cddfed0e9018-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6C61 0
12 B 27ms
25ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IwPmzB8OldoxW6mJDO5sKr0sN6b5sEVYJo51tAuuvTSrzJw9csVBWqifg1VxJ3QgUt8sb-

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dc_pre=CIjVwPCt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656
adservice.google.com/ddm/fls/z/ Frame 3893 42 B
401 B 97ms
53ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CIjVwPCt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIjVwPCt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3116423145004.2656?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 9701 174 KB
62 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2b4cc52536e20695a5e3d40666465d174f2323db405dc959bdf5575de67146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63903
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H/1.1 200
OK viewability Show response
hal900021.redintelligence.net/ Frame 3528 0
150 B 42ms
12ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/viewability?s=82345500110683204445002012515021&a=437425c7&vb=m
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=82345500110683204445002012515021&a=e0a83d03
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/request_content.php?s=82345500110683204445002012515021&a=e0a83d03
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 05AA 53 KB
19 KB 73ms
12ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=82345500110683204445002012515021&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:22 GMT
content-encoding: gzip
via: 1.1 c9ca35e5541827c5873bfdb59f015b20.cloudfront.net (CloudFront)
last-modified: Wed, 15 Nov 2023 16:51:15 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32666
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: Hl8GMsgDin1MXqHvACnO1iBPAizjZ60fl35Zjes6qdwPRwv-qtcbow==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 05AA 85 B
437 B 57ms
6ms Image
image/gif 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1700579146&Signature=T2UC7Vkm480-iifnywW8YgcAziY8aI-vcZsI1jA9o62RopZ8QXDxdCKIL8Yr~X-khPIG4K96xqbLFtR1AthjfyoS4iNnRaSkhuc7JERfrgPGcTluemsQNQAGo8xp3PBTNKa1SqNVEiEm2tfNh363h6zkJ6jBlgomZv2RHs3pcmbkhRdqEFW2BotvulD1Ni9rDczp-C1u67ta5k~P31zw3X-X9s7gvN6c-mLcfx~pbzxFa9h12pUXBFdqN7OAl0npYpTgN5E0VcsR0QayGEgZOktxPMoIuffAjLanFkNl1FIF2cM~b1JlOzUWJYlfyw3V8H0i2XBnl08OsF9aRC72dw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 10:57:54 GMT
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 14573
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: JWj4zXfVewDXDaVRsAEA9VVH3SayDsX04STarOIt_1Y7KMLAao9ATQ==

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 3528 14 KB
15 KB 19ms
18ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900021.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 324627
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 20:50:19 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 3528 15 KB
15 KB 17ms
17ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900021.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 367069
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 09:02:57 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CC1 0
20 B 52ms
49ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BcVAyHcZcZZStOfau1PIPmfiv0A8AAAAAOAHgBAI&bg=!qaqlquXNAAZxrfrxUa07ADQBe5WfOOhEGxq1s89dO56enF8c3HDZddjLlDKGMRyvaBIoYaU4lMwWKJI-14JjKurZ3A1kAgAAAaNSAAAAA2gBBwoAF_aILkLRG-HhnU2ejbUzSDvFhldMXggomQMDgZAblHwEwWE3izrwTRFy8xDuVX09JtxzDVXwMpElsBV8SBkJuFLtMCb2FO7YeoY1wx7pLUt9Pp5ivmy2TaNhSG00lsYDdublUTukyjlqWFB7xRRyHcmyxgrrYsiJ4fU40GEtH5CBUP3m9Dt6u5kwYpMPncek4b5-Fz3uM16oKCNrt2tRE6rREkB_bqQWmQqotnPc9MMmZeWQqCfS5_fKFTjgASvLEz6JT_k9zKUP1UXLAoOe-uEIZBcimTQrfKy95PCY1PrE_EXYs_zRX1aEzkMOijwu7GGNKEMdmdQpzHyRg7IH0ARdJJd1EISB5ca_28meEEQ204c-sSr0zqmVmPoPUoyRgZlBV-iTb80lJmRzkUsiMMIIF0NKnokRTiTDUUVyJOdW_nwaBqOPA9mOQ73K3gkNZhh2aaAWHMXqZCJrXFfVDV322cNRbfijPmjHY1MY_COU6xI3jQuNzSGTCa-1o9pXbPxEmrh-0kGIs0Hiq6_twjSZBStvZpImK9nGcu9FN6PB7sU6D6PpZtjZRZmyzsW8eiH3b9t1lmF15eA5lRbFK7nz3v0g2gMvoHK3TwuinHJmeth0R5-2gSvpPAAu5GF1l3gTHsWr-45J1Tmd9KGR_ISGUelcC70kB-UdIvielJHGJqYO1ObqL8-9tWMHllta8wfLVbjiwFeDOgr9EP1uzqqVhSyHGMU3DGzXYWylfQ1Jy6AukItjpJbb1hGKHeBexKqL_5Dd2yF92AGoFMTe3TZ7cHaq9cwWirP_BlEDYi3HCTxLxhHVnuAUZg2JXrC1TVV8YSMfWUrXkguXltRa5-I7MB0_-Nc40XkGASK6_p9endflJczeW2Ja7evCLl7gunpiQyUbddIfCd5Lh13XLd35x9oFPP0mqHX7uRgy23uhHK3ex21FsG0zBBJPpmqjbJxbPjpbrATkNWtKkjJ9z4IzqyaXHZZUNwkXb13yb7Epd8rtWWpAkwNcbkn5Fk5eLkg0cnUE5vvXMqcymeRfZNSyIN8-khuAHf2FxOTN

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7D3F 0
20 B 53ms
53ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BckhvHsZcZZFR2orU8g_o6ZOwDwAAAAA4AeAEAg&bg=!0dKl0p3NAAZxrfrxUa07ADQBe5WfOLtlCMyEL8ySRxLQWipMDEDT2O6p7j7vYkW1grtyLmfxogfIvFf5lYcLeMRW3TJyAgAAAYxSAAAAA2gBB5kDD7wlnjm1FuTsnrqdgnePhceVbYGPU0-LKnzG1VVHlkmKeUVcLjEwIAfwTGY2zV_k_0VvEud5dqSgTzZv8rYshloFeAVXlpTfpp5z296DsXCy-OkzYu3xA4vbhUiUutymK2UivL8X9sEPkMAUxCWkvzBkFaSAKE7tWO_K2ApgCIMaEpYwEw52fZuSfDF1A3siqU680du8vNYe0z4Syixra2NKGNYtl1kXe8rm3hSI5xRXnAbSMIwNuw0awkT_FQh8xdBr5_T7J7id4gAmhTOTPuGfg4mSry6WchL3Zkvz9_O5GiD0J4nKSfX6-MUOEMA8XvQW5Xw_owR1ipEuoVbZmf9HkJm9FZOIcKNzttcFXtWn0FspxILOwMEUOZr4BoX960tBVIRq2sEV2R0QPsBKWJxO6SauBCcYttKQBaX73JLwSztRSby9_nAYY0RBqPboq-b-eS3r6FGGdBhneNzdNW0Mh9grRgbOEYC1-pLociZLkVuvPbrGIKzEHNUh59vBQu3AjkKOm997LHY3_7OK5beNSc22VgRsmO2swBlxBXCkJQAWZo4Hjqq4g_qr-vOeSi4fKWQfrA7Oid7hssQil1mLWBKQ-As_4GFA4S5Gafyma__xCVhrGsHi0tLr7a2llG6xtDmtdOWqgHI87Xpn95qEunqp4hDUIEi76ztClubc1022lQclKeSi7LgtN-Zb1HjyvkYWJmGwrL0XssNVY52F8_e7ENN-vNbSydMkXWDXEytj3yV_E51_jrSHxpqz_WyRa9jNmWojLmpKQs7-60nD1r6Khy1QHRDbabvorVL8kWuBK8G087809FrakGk3tXD-xgd4jw8CVF83oQjqjmsO3ni2jwu0W60OZTb1U20WdfGsFeq-iZqIBZBrongMiu-JvBWE3QNUMWgpbiWfpfUlcENGt5iHzECpgzs6Zjg471JqTnguMK5u4Hnr-LW-M6n52_7b-AAFcfXVYCwmlGRJaEtrfvqqy4atFEOJdCMEkx8NWJM_w7xZL9BhdTstY6qY0B8G53PMIeSUtPWQ5w

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame B33D 273 KB
91 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

971be0d9f761adcc260f56e7312322748383aae44263d37bf172e27e043b13c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92854
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E85F 0
20 B 51ms
50ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B0F1UHcZcZfLJO4rC7gO3tbDoCQAAAAA4AeAEAg&bg=!fH-lfzDNAAZxrfrxUa07ADQBe5WfOJI3h7XwDqnLHrhQ0oVR0EPq33Z6xeyqx00N4ccIoOY5HqYf3Fr0Q2lJ7UQjz-VrAgAAAW5SAAAABGgBB5kDBSr-LPucivHQ74yszZncN8yX83ThC4IsFHKGIw69OwgpMOUTvDLmUkuvUk9sMM8Eiljyd8VkAFThTFY_Rb-IAvayIbuX1pExgdkLBxrYD1gXaQf-j4Kj9eUVcOaRp7E8-tI3KtuBsoDwxHudtQ1O0DAY8AAk6lXFAZmd40Wonkrf5bKXaZJJcQZNhb14KiuFgNEe9gjXkvSWD5Rv3VM_LVK77_apRU8oB36SeQGtAB70Nub61CgkBXpA05PkYPFSIbRPEYtbdFvd_tZ-oLkC3jPA5AINA1XuDtK1T5f5kGID_K5qak22NpZ4gnFT1r4IWr42AyaMVjh1kcuUMjR6hr0L_1I-i4HCMx8Ke50yoBdMF3i9UVfpIuugrf5CG5ac7UwqzUUFc_drusfaK3yOogQcWkGnROoK62qNbUEJ3H7CBFtHp84P0vORt7clP3V06TEi2PNcwz-qxhOzZN9va08gvs1cv8YBrDGr30tgR4ltUoUdkZQRGXmVf5_Fwq9WgoYrDC8EFnogCX-nwLz6rPn2JFlfJBxBHa3OP4TpS7ZUwsso73BYrS4SZaKjpGoik4o2EasWBmkaPVbW4uM6MZ6FhYL8NdAG6Bpode5LIl8K4VrnPDCnCbLGY-TCnW-x47_MmRBoxOR2kw5kFpq0a349PdT30woN3PHZxf0JTpMwfVfZWfarWs8fraIY06C3dn-Ry_9ixJsB0gg9-NmSzJn_jDSG5CjEQiOoOBg4F7pkVFJ-KzSDmpoDzWzpWJX8aKBFOuaJthOdFIUGZ_kRNfzz41ERrLC36GGoVXowyzhQZs-MczKTVlcHw75Jx72GBGekd0NlDpbwcDaHOSgKB_0WYYw2ILHC07zj7GFMpr0zqAAwcAY6oh9NVSph0v8o16CK0dNE-uvXLxHF8-9HB-eEjwLa8oV_WDKpv26sh1_XsX2ULQH9QFY0XNZaxz_hCUprX5zXdVdkwvE6JSSihS_OnrGUbXsiyB5FlplzNIRLus-FAtqZAKZyLLTUZzaHfTUpb-k1

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 6200 273 KB
91 KB 29ms
28ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06514f2abf9645ed16b8c751078db535d817c2908af435bb613181a20147e962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92855
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3E1B 0
20 B 51ms
50ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B1bplHsZcZZiHAfiB1PIProuyuAIAAAAAOAHgBAI&bg=!CgmlCUbNAAZxrfrxUa07ADQBe5WfOEfahp9WuiiGRoxcFvrW9R7bIasr7hAmoTsjbdviZxAzeDUQJdcky8F1PJjwo9ymAgAAAa9SAAAAA2gBBwoAAcaZAwnsLzL2DCk76oMyIo2aPNF1WCJqupGOzU-AXvGocZoV_IIxe6u5HLcyD1Fgn2lvp4CZIKS3roECCGrdivBfUjVlvi0veSEDOBJE6Lz7E-ymeVsgLZsmqUtb7PgnkMVSiBawedR2wUq-B4a30bFHpdAqPmx_PjkgDA42eskuEZxZaC-UjPqQmltKwkg85t5YwEwH2Q0FAWwNjvE9KIsVFJRuVmCdrQEcQx0v9PVNR5ogqYh2d-woEqL6lZZkBYHk-1mX8oovFOUix9o7pIjXwZ1OKINGgEyuZTAXwhyXou4ZWfnRrpw8Q6yU1tge7hR1ty4rHcl2s5i2PE0WABaefWv1n8zGqJmYoK3MLWQPIlB_KuO15P0V08L1IE0v7PK0idyldvhWclhASJz0srBoTj3ejGHxhn2z5R6UFzS2YXu_iKW6tqpTZgsrLmmdoNm2YfIAYNAdZmmMtiJwrRi7AHG1MNpgmfEBZN-etvZ0d0dg-ySCVaojoBi9mit7ZyU9bQT_hsB4Nb9vqF3ezfbB5-wx7ylkY1OzIdnmhOtZIOokgjajl7IE7f2eGb2BYXP3JGNZLo5QlNFzutKSZA9HIQMbRalUlKl4ezsCQOmpNcGGvwXG4mKngNmb3zBKzCiYS0Dqg9L7-uOtjYD_43vilCozLpib5Hcq-GngJK_BUbuWFwjSjW6RWphFDlPfr4pYVvU6wCPfj2F6EplSgLX5lBgSIUYYa6XctAXBzw62h4l6C_wBhvHOACyikThdvS-od10xn6gRwkHV_BCGJ9g-agOAhIfEtEqb7W5PB32O11JQj3GqpKmmenAwp3KlL0VZ-bTM7LRpqdFtANieqnoFfTWo-dm5waMmDOg0Qe2U_5PBXmFJ0Lr4wipJt2ui8V6f_1R38JwZHSnBEvjH4mtGLxN7KSu1K3BrHbRybC4LE1fFlfRDXWUavQoOkJ0k6z4txLi1K7qvx3lAXqNs1CPfrpEy4wE4ZFgjw1YastVauT5vyM-33OMbYl_Hx5I752driYEIuvFxx0eZz3M

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 732D 273 KB
91 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

971be0d9f761adcc260f56e7312322748383aae44263d37bf172e27e043b13c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92854
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 9701 273 KB
91 KB 42ms
40ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

daf0348e4b54d1713837e2a5ba58ebeba9044701e5d8fe41c154dc9f8ffb84f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92853
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame B32A 2 KB
2 KB 79ms
78ms Script
text/html 18.130.85.236
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=12088300089271904444994012515008&nw=1
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.85.236 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-130-85-236.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 21e600dc756ead91b7e0634c95a3c42c6b9ca8b6a3e0dfb20385fca0cd051f0d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Tue, 21 Nov 2023 15:00:46 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:46 GMT

GET
H3

200

activityi;dc_pre=CKiD0_Ct1YIDFeXJOwIdyhMKYw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628 Show response
5994599.fls.doubleclick.net/ Frame 5520
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CKiD0_Ct1YIDFeXJOwIdyhMKYw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628?

391 B
240 B

60ms
59ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CKiD0_Ct1YIDFeXJOwIdyhMKYw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628?

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ff1ad7afdcc31c5e5d45a9991da507d8c69f567214dfb3a33b97d277607a343

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Tue, 21 Nov 2023 15:00:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CKiD0_Ct1YIDFeXJOwIdyhMKYw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90008.redintelligence.net/ Frame 9A96 7 KB
2 KB 37ms
13ms Document
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d163c96fd47bd36add52d41cf08bbd2631a8164f0a3f63c31a2e56b246738cd1

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2109
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:46 GMT
Expires: Tue, 21 Nov 2023 15:00:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 69B8 1 KB
643 B 13ms
13ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame B32A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9709cc1da66da1e3857f4e7eda1a1efa0d39f468ab34968a2bfc46812dd440a0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 link.html Show response
track.webgains.com/ Frame EE76 2 KB
2 KB 107ms
106ms Script
text/html 18.130.85.236
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=69514600099249304444550012515016&nw=1
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.85.236 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-130-85-236.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 8d00fcff2c31bcd473f849eb3c7c77a0acc186f002388188f49808dc9f067c69

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Tue, 21 Nov 2023 15:00:46 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:46 GMT

GET
H3

200

activityi;dc_pre=CMmM1fCt1YIDFR_kOwIdnKwDOA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254 Show response
5994599.fls.doubleclick.net/ Frame E624
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CMmM1fCt1YIDFR_kOwIdnKwDOA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254?

392 B
239 B

60ms
60ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CMmM1fCt1YIDFR_kOwIdnKwDOA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254?

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b24cf4ff2241f219157aa2fd65e2fda5eaf127ce52f824e885a94b3f6a37d5d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 216
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Tue, 21 Nov 2023 15:00:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMmM1fCt1YIDFR_kOwIdnKwDOA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900016.redintelligence.net/ Frame 3E05 7 KB
2 KB 37ms
12ms Document
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 38d51bfe94341af10ae7da5131dc12e38f2418f3e7ee60fa8412bc2e85a73c9e

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2096
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:46 GMT
Expires: Tue, 21 Nov 2023 15:00:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 88F3 1 KB
643 B 14ms
13ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EE76 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef4faae7b8e4bd5c8940eba58b74e9270b8ff272f0c5bfa503b641f3908d367f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 link.html Show response
track.webgains.com/ Frame D408 2 KB
2 KB 74ms
74ms Script
text/html 18.130.85.236
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=78315200094716204444994012515003&nw=1
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.85.236 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-130-85-236.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: e2f4ce06b83ae1c8fae5c0b41383e297fbf4ca5978fd5cd1e05843c0cf0e4db5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Tue, 21 Nov 2023 15:00:46 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:46 GMT

GET
H3

200

activityi;dc_pre=CLmB1_Ct1YIDFa1gxgodwncDzA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641 Show response
5994599.fls.doubleclick.net/ Frame 2917
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmB1_Ct1YIDFa1gxgodwncDzA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641?

391 B
239 B

63ms
63ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmB1_Ct1YIDFa1gxgodwncDzA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641?

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3f9fade42f1754a3bd2d407e13fcb03ffe9a4065e6213b22206d3e6d378ac39

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 216
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Tue, 21 Nov 2023 15:00:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmB1_Ct1YIDFa1gxgodwncDzA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90003.redintelligence.net/ Frame 7D97 7 KB
2 KB 35ms
12ms Document
text/html 138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90003.redintelligence.net/request_content.php?s=78315200094716204444994012515003&a=a8f8741e
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.117 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 970ecba9a9a5475803df592f52e447f54fc1b69eeed8bc231cdd4bf0da2ca26c

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2112
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:46 GMT
Expires: Tue, 21 Nov 2023 15:00:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3846 1 KB
643 B 15ms
13ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D408 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1892624469a47e7ee7b870c882bc8159e90a62440795029d7cfc6b39ff89995b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 9A96 5 KB
682 B 35ms
33ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 14:02:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9A96 17 KB
17 KB 37ms
13ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: da1d80b4c263ddfdd7e3ddabd768ac29ba74f0970b8da0ea7bf90a9d1d6b71ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9A96 16 KB
16 KB 39ms
15ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0d3e2ab1c22c68189ca4a981919785af2d9f8129f90a4bc3ff5071d24a32c9d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9A96 14 KB
14 KB 35ms
12ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/image-1200x627.jpg
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e1f44708e987d6930d664b9b50976fd76f4ddac735e7ae62dc50e85e9a6401fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13918
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 3E05 2 KB
434 B 34ms
33ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 14:44:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3E05 17 KB
17 KB 42ms
14ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: da1d80b4c263ddfdd7e3ddabd768ac29ba74f0970b8da0ea7bf90a9d1d6b71ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3E05 16 KB
16 KB 42ms
14ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0d3e2ab1c22c68189ca4a981919785af2d9f8129f90a4bc3ff5071d24a32c9d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3E05 14 KB
14 KB 37ms
14ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/image-1200x627.jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e1f44708e987d6930d664b9b50976fd76f4ddac735e7ae62dc50e85e9a6401fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13918
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 7D97 5 KB
682 B 34ms
33ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90003.redintelligence.net
URL: https://hal90003.redintelligence.net/request_content.php?s=78315200094716204444994012515003&a=a8f8741e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90003.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:12:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:47 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 7D97 17 KB
17 KB 40ms
13ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90003.redintelligence.net
URL: https://hal90003.redintelligence.net/request_content.php?s=78315200094716204444994012515003&a=a8f8741e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: da1d80b4c263ddfdd7e3ddabd768ac29ba74f0970b8da0ea7bf90a9d1d6b71ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90003.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 7D97 16 KB
16 KB 40ms
13ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90003.redintelligence.net
URL: https://hal90003.redintelligence.net/request_content.php?s=78315200094716204444994012515003&a=a8f8741e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0d3e2ab1c22c68189ca4a981919785af2d9f8129f90a4bc3ff5071d24a32c9d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90003.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 7D97 14 KB
14 KB 46ms
12ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/image-1200x627.jpg
Requested by: Host: hal90003.redintelligence.net
URL: https://hal90003.redintelligence.net/request_content.php?s=78315200094716204444994012515003&a=a8f8741e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e1f44708e987d6930d664b9b50976fd76f4ddac735e7ae62dc50e85e9a6401fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90003.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13918
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 dc_pre=CKiD0_Ct1YIDFeXJOwIdyhMKYw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628
adservice.google.com/ddm/fls/z/ Frame 5520 42 B
107 B 52ms
52ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKiD0_Ct1YIDFeXJOwIdyhMKYw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CKiD0_Ct1YIDFeXJOwIdyhMKYw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1512078337587.628?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 2712 42 B
64 B 58ms
58ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuLb9wy6_EkUhKBc5d5Cf25OCkRGyhOIW0qDrdzpMfH6dJGV7idHIUGeaq6D9evLMEOu3x94NQG5-0s2mTIe-qEOKC8wvdOPkQRv4hlB1p8e4NArasJeeb2AU-xz7Mjml4hAsYnLJCA1pfx&sai=AMfl-YTU3PAEHxyHvQT_M9ZuOZpM37imaF0vEOuGoGC7E2Qi2kimmmz4NSsd2dpbRCq0qAGX99mfogSK1G9A52QtJ7q28IF2AxADv_5Dru2g6DB-nFu4-9whgwdx2z4eWbPLVYu_zZRtY0-s53J-m37D&sig=Cg0ArKJSzHdqRp5xnmKlEAE&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&id=ampim&o=315,310&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1043&mtos=0,0,0,1043,1043&tos=0,0,0,1043,0&tfs=333&tls=1376&g=100&h=100&tt=1376&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 69B8 35 B
362 B 18ms
11ms Image
image/gif 2620:116:800d:21:5ed4:8d5d:fed7:f5ef
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELuU39aFp8Y-GBpoTzYNW4A&google_cver=1&google_push=AXcoOmQzlN-EdU8LrkT0KIR_fNkZo4shDf32ZntZKc6kv3fPnqHJ4iqDujfN0hx4fxfpTNMY-QyHW3w82cASM3T-fd8sJMrh1iaV

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5ed4:8d5d:fed7:f5ef , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame 69B8 43 B
415 B 184ms
177ms Image
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmRLM4AJe6EWRdi14YGbHN6xLRFy_bLM_XH3r8tjFhOB-BjSlaut47wntp_SkQ9mfQzKn7a-YHRO9QTaLl6ZFcGI7EE8IIF4&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRLM4AJe6EWRdi14YGbHN6xLRFy_bLM_XH3r8tjFhOB-BjSlaut47wntp_SkQ9mfQzKn7a-YHRO9QTaLl6ZFcGI7EE8IIF4%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cde24944bbce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 69B8
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMqGy60M6p_eXGGfuURu_UA&google_cver=1&google_push=AXcoOmTZsCqSpRRc7EnfsP-abSktE8s1gBkNxcAeHljljk6nF3xPWc1UmzdFRpdfo1lQMF0kAypWknoT...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmTZsCqSpRRc7EnfsP-abSktE8s1gBkNxcAeHljljk6nF3xPWc1UmzdFRpdfo1lQMF0kAypWkn...

170 B
188 B

25ms
24ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmTZsCqSpRRc7EnfsP-abSktE8s1gBkNxcAeHljljk6nF3xPWc1UmzdFRpdfo1lQMF0kAypWknoTRMMSTRFx8RE-IrE5veIz

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmTZsCqSpRRc7EnfsP-abSktE8s1gBkNxcAeHljljk6nF3xPWc1UmzdFRpdfo1lQMF0kAypWknoTRMMSTRFx8RE-IrE5veIz
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 69B8 43 B
103 B 25ms
19ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH3uwK5nHx8iO3mYwRAGGdo&google_cver=1&google_push=AXcoOmQdlxSvq-XOQoQF9jiP5BlvrH34_mi--hOcodyeiy2MaEXYv21rwEWQVPfb_IoR8ruAtneGmH8FZSDOE5MNXpXRkw9fmPw
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 69B8
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJWS44H1Qi7bIzWeyfiJK04&google_cver=1&google_push=AXcoOmSRMB0sTqHG1uifPAG_LVs_T2cN5xQeT3-uvmGRhT8Y033bnPN1xvNNPfsuc-V8q_QN7_5NqOdioH7Kd7o...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmSRMB0sTqHG1uifPAG_LVs_T2cN5xQeT3-uvmGRhT8Y033bnPN1xvNNPfsuc-V8q_QN7_5NqOdioH7Kd7...

170 B
188 B

25ms
24ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmSRMB0sTqHG1uifPAG_LVs_T2cN5xQeT3-uvmGRhT8Y033bnPN1xvNNPfsuc-V8q_QN7_5NqOdioH7Kd7oBOZkZK2c3U540

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmSRMB0sTqHG1uifPAG_LVs_T2cN5xQeT3-uvmGRhT8Y033bnPN1xvNNPfsuc-V8q_QN7_5NqOdioH7Kd7oBOZkZK2c3U540
Date: Tue, 21 Nov 2023 15:00:47 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 69B8
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAa6ygZgWoof6SWqNIVA928&google_cver=1&google_push=AXcoOmR_YGbrDW9xT8Zgz-SZgEdCT6rpFKZM8QSuWerXWoaP-ENPJrYNYO6tyic1DjSPgswM9DU...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLQlYtMi1FN0pV&google_push=AXcoOmR_YGbrDW9xT8Zgz-SZgEdCT6rpFKZM8QSuWerXWoaP-ENPJrYNYO6tyic1DjSPgswM9DUa_8q98QraWDqvH2fEs5qeZgCA

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLQlYtMi1FN0pV&google_push=AXcoOmR_YGbrDW9xT8Zgz-SZgEdCT6rpFKZM8QSuWerXWoaP-ENPJrYNYO6tyic1DjSPgswM9DUa_8q98QraWDqvH2fEs5qeZgCA

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLQlYtMi1FN0pV&google_push=AXcoOmR_YGbrDW9xT8Zgz-SZgEdCT6rpFKZM8QSuWerXWoaP-ENPJrYNYO6tyic1DjSPgswM9DUa_8q98QraWDqvH2fEs5qeZgCA
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b71bced807741b20dd93dce6c2d26405
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 69B8
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmQ6lUpJAkJ07EIrOuchp9Ypl6h6vi9pr...

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmQ6lUpJAkJ07EIrOuchp9Ypl6h6vi9prNxcZugvZffnHUdrylaS9V5KLu1NVVzs81pbQ7NKoMD8-KoXyoUo4cr7M5Ihk5vx

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Djpnl5cRlzY85zsT%2FjErd1wdwSPw%2FZY6UEZEnq64rULu5gpyurj6JCzr%2FamyKEILcKmVVsoiF0ie7CpSCELSw0Q0%2BlaMElprBZ24BPVA3%2BQcwm4VqddoyUrFYTWZyChw4t00y82l6KKr0w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmQ6lUpJAkJ07EIrOuchp9Ypl6h6vi9prNxcZugvZffnHUdrylaS9V5KLu1NVVzs81pbQ7NKoMD8-KoXyoUo4cr7M5Ihk5vx
cache-control: no-cache
cf-ray: 8299cde2480c1e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 69B8 0
12 B 25ms
22ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ISa9-1fHoP_thNeQ74I7wF8ywfPGHUjxmo9BF82mhJa3EdjGRELPJQa63WYBmAjpIcTL4U

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dc_pre=CMmM1fCt1YIDFR_kOwIdnKwDOA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254
adservice.google.com/ddm/fls/z/ Frame E624 42 B
107 B 59ms
56ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMmM1fCt1YIDFR_kOwIdnKwDOA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMmM1fCt1YIDFR_kOwIdnKwDOA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2002608913539.5254?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pre=CLmB1_Ct1YIDFa1gxgodwncDzA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641
adservice.google.com/ddm/fls/z/ Frame 2917 42 B
63 B 64ms
63ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLmB1_Ct1YIDFa1gxgodwncDzA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmB1_Ct1YIDFa1gxgodwncDzA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4878086156995.641?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88F3
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELuU39aFp8Y-GBpoTzYNW4A&google_cver=1&google_push=AXcoOmQ6QKhRlwebeQknG5dZOSpy7SZ-vm0VHRSVXlpU3KA78OY9RczDI6...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQ6QKhRlwebeQknG5dZOSpy7SZ-vm0VHRSVXlpU3KA78OY9RczDI6otobzOyoVx8UoQ85CzKN1C3KIbNLtsRsv2HvBQziylzw&google_hm=X7NoGNhe7v...

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQ6QKhRlwebeQknG5dZOSpy7SZ-vm0VHRSVXlpU3KA78OY9RczDI6otobzOyoVx8UoQ85CzKN1C3KIbNLtsRsv2HvBQziylzw&google_hm=X7NoGNhe7v9vDibKhEgDAA

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQ6QKhRlwebeQknG5dZOSpy7SZ-vm0VHRSVXlpU3KA78OY9RczDI6otobzOyoVx8UoQ85CzKN1C3KIbNLtsRsv2HvBQziylzw&google_hm=X7NoGNhe7v9vDibKhEgDAA
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame 88F3 43 B
598 B 170ms
167ms Image
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmS2a4E5vLLg9YogYeSlPWXnWO7wBtcIZp8gwSosK7H8b1F4KfCmwWq-gl79JLSjO67QMOu7Oa1PSjHDCwgGMr64IioCBvYW&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmS2a4E5vLLg9YogYeSlPWXnWO7wBtcIZp8gwSosK7H8b1F4KfCmwWq-gl79JLSjO67QMOu7Oa1PSjHDCwgGMr64IioCBvYW%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cde28993bbf2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88F3
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH3hduNiSukvdbq7AW3XKzM&google_cver=1&google_push=AXcoOmTw7SAgdA-jSoxKWiZb9lrNOh2nZNF6MiqXNUbq3cfochtpv8aE7fX9yb1_gr9Mmt66mw8Alm5rIBhK73GLnfTCvDi...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTw7SAgdA-jSoxKWiZb9lrNOh2nZNF6MiqXNUbq3cfochtpv8aE7fX9yb1_gr9Mmt66mw8Alm5rIBhK73GLnfTCvDiiNCA5vw&google_hm=eS1BbXdyRXhGRTJwRUJ6...

170 B
188 B

34ms
33ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTw7SAgdA-jSoxKWiZb9lrNOh2nZNF6MiqXNUbq3cfochtpv8aE7fX9yb1_gr9Mmt66mw8Alm5rIBhK73GLnfTCvDiiNCA5vw&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTw7SAgdA-jSoxKWiZb9lrNOh2nZNF6MiqXNUbq3cfochtpv8aE7fX9yb1_gr9Mmt66mw8Alm5rIBhK73GLnfTCvDiiNCA5vw&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B
content-length: 0

GET
H3 200 dds
rtb.openx.net/sync/ Frame 88F3 43 B
58 B 25ms
22ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH3uwK5nHx8iO3mYwRAGGdo&google_cver=1&google_push=AXcoOmTsVL3gofvMtLXwHsqf7kQS6g1gq2cuw8UIwpJ1aLRY7xu2RqQN55Gb6D01VhNtTXM7VyKDR2pidlp0fh0C5RBWAQTDFtOO
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88F3
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJWS44H1Qi7bIzWeyfiJK04&google_cver=1&google_push=AXcoOmS_ngGRXn9AUJC1rujE6ljblrHKxD-WMAnCytsmfeuQhAQr9Elj0jwH7MYENy1ozvjX7I0eBygd9uo8td-...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmS_ngGRXn9AUJC1rujE6ljblrHKxD-WMAnCytsmfeuQhAQr9Elj0jwH7MYENy1ozvjX7I0eBygd9uo8td...

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmS_ngGRXn9AUJC1rujE6ljblrHKxD-WMAnCytsmfeuQhAQr9Elj0jwH7MYENy1ozvjX7I0eBygd9uo8td-KVGdLVYeecAtdAQ

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmS_ngGRXn9AUJC1rujE6ljblrHKxD-WMAnCytsmfeuQhAQr9Elj0jwH7MYENy1ozvjX7I0eBygd9uo8td-KVGdLVYeecAtdAQ
Date: Tue, 21 Nov 2023 15:00:47 GMT
Connection: keep-alive
Content-Length: 244
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88F3
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAa6ygZgWoof6SWqNIVA928&google_cver=1&google_push=AXcoOmT7kn5LiXoszNDVFXGEtGvDchOAl4W3Tsp7uukgwCxBTtzkf206H8mwC_e-8bRLOVHGkLo...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLQ1otTy0yT0hZ&google_push=AXcoOmT7kn5LiXoszNDVFXGEtGvDchOAl4W3Tsp7uukgwCxBTtzkf206H8mwC_e-8bRLOVHGkLoWhxRJMVS9rWdhREZ0Gg5ZJUJ2bg

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLQ1otTy0yT0hZ&google_push=AXcoOmT7kn5LiXoszNDVFXGEtGvDchOAl4W3Tsp7uukgwCxBTtzkf206H8mwC_e-8bRLOVHGkLoWhxRJMVS9rWdhREZ0Gg5ZJUJ2bg

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLQ1otTy0yT0hZ&google_push=AXcoOmT7kn5LiXoszNDVFXGEtGvDchOAl4W3Tsp7uukgwCxBTtzkf206H8mwC_e-8bRLOVHGkLoWhxRJMVS9rWdhREZ0Gg5ZJUJ2bg
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b71bced807741b20dd93dce6c2d26405
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88F3
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmTD9SmrRT_3bYVV43ReBsloni5RNf54k...

170 B
188 B

37ms
37ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmTD9SmrRT_3bYVV43ReBsloni5RNf54kKO-FidHRX8VX90LNxZqxjir2tkNLlTVJDt1lr16a4GDJpKZBWePQaMbtSNLrBysRA

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=79e4Sa21VOVB8cfiNamTUiFyVSF4uK56%2BZl5yReqRAd9sW1opaSvZX94DB%2Fk12t%2B7F0rSMVhgGhDHW%2B2n4lVka48LiJJ52rXXOyWN9JvxAOXkqhtx11UdCm7ZTQl5TByjtPyg4LIvqpCvw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmTD9SmrRT_3bYVV43ReBsloni5RNf54kKO-FidHRX8VX90LNxZqxjir2tkNLlTVJDt1lr16a4GDJpKZBWePQaMbtSNLrBysRA
cache-control: no-cache
cf-ray: 8299cde288981e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 88F3 0
12 B 29ms
21ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LdEbGnzQKLT753xGatXVep7Q-tf2rM0QtfX4-iX5pxiOS0icyYD2Gb8ihTupOpNtBDGjzN

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame B32A 53 KB
19 KB 22ms
16ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=12088300089271904444994012515008&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:22 GMT
content-encoding: gzip
via: 1.1 c9ca35e5541827c5873bfdb59f015b20.cloudfront.net (CloudFront)
last-modified: Wed, 15 Nov 2023 16:51:15 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32667
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: S-Xu6hqqKalWXizKzZ-Lho8AjHN9AUPrg3OPByU5xqV5GH5MTKUSTw==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame B32A 3 KB
3 KB 19ms
12ms Image
image/png 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1700579146&Signature=ZPe4uGPf0rW31Hsh13Ix~QalATHVA4BNeC-WewSea9glwoMJEW-L9OGnpxQ1Ot~M4lfzLoSI3yaHwdDQKV321Cstu-nydwyZ3tI20bBbfnBOH~DU3rWLfN7t8VmH3YCqcXB6eFFSduA9zfaFQ1Ta~H9etGYLAvnYBdlZYDF15p0nrAGKbanGHqegjPm9yMZpt9DJqnrM6KuKt9BsiDx~Wf9mO-hGpsgBtuAsVQdLiKwCEH2EqsZzVmbIEVnXkVaw3t-32anR-0KNbfiUanDErMrm59EmdRx0nqm8kX-dX3jpaYbd9pNR-kx73l0I6TDmy9zc3aUXtSnFOlXSAb3I5A__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 07:14:28 GMT
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 27980
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: 3KCtWHdf68RJbNNkMTnaQprgmVV8tZ8TIFPaDyMxx-ABRnUnPQ2tNw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3846
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELuU39aFp8Y-GBpoTzYNW4A&google_cver=1&google_push=AXcoOmQ0d75bvFB25IsMQBNpT_-vXjLZmdcoEBSosVuKRQjkKyy16GiuUs...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQ0d75bvFB25IsMQBNpT_-vXjLZmdcoEBSosVuKRQjkKyy16GiuUsVBx-cpJ8uc3G1xGERZ4vJFSB9Eb_SNnD4dJ9L04Gf3&google_hm=X7NoGNhe7v9v...

170 B
188 B

30ms
29ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQ0d75bvFB25IsMQBNpT_-vXjLZmdcoEBSosVuKRQjkKyy16GiuUsVBx-cpJ8uc3G1xGERZ4vJFSB9Eb_SNnD4dJ9L04Gf3&google_hm=X7NoGNhe7v9vDibKhEgDAA

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQ0d75bvFB25IsMQBNpT_-vXjLZmdcoEBSosVuKRQjkKyy16GiuUsVBx-cpJ8uc3G1xGERZ4vJFSB9Eb_SNnD4dJ9L04Gf3&google_hm=X7NoGNhe7v9vDibKhEgDAA
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame 3846 43 B
571 B 284ms
281ms Image
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmS8V0TtgGYpfSAiP9D6UJvO48wScTxeL9_eMy26ZiBhyvsds9Vb4JOot78RxldLNUYvo4FlTvn0aJOuvFuKdfMT3m6Q0SRh&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmS8V0TtgGYpfSAiP9D6UJvO48wScTxeL9_eMy26ZiBhyvsds9Vb4JOot78RxldLNUYvo4FlTvn0aJOuvFuKdfMT3m6Q0SRh%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cde2b9dfbbf2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3846
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH3hduNiSukvdbq7AW3XKzM&google_cver=1&google_push=AXcoOmSjQAuRuky02kRL4K2TezEH6lWARlyJnXLUzhOlRntoK5dfZC6TRE43bU5iiy5IUn9bXXTb0bUeUPWycTKxT7bSCAn...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSjQAuRuky02kRL4K2TezEH6lWARlyJnXLUzhOlRntoK5dfZC6TRE43bU5iiy5IUn9bXXTb0bUeUPWycTKxT7bSCAn4h6IM&google_hm=eS1BbXdyRXhGRTJwRUJ6N3...

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSjQAuRuky02kRL4K2TezEH6lWARlyJnXLUzhOlRntoK5dfZC6TRE43bU5iiy5IUn9bXXTb0bUeUPWycTKxT7bSCAn4h6IM&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSjQAuRuky02kRL4K2TezEH6lWARlyJnXLUzhOlRntoK5dfZC6TRE43bU5iiy5IUn9bXXTb0bUeUPWycTKxT7bSCAn4h6IM&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3846
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMqGy60M6p_eXGGfuURu_UA&google_cver=1&google_push=AXcoOmSyaa0gVc4yf600SPjymKOugML8-CG_W9nSYlKf0-iwLlSOTGaMxcx-JhpQahBQ8t3_wgRlZI1f...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmSyaa0gVc4yf600SPjymKOugML8-CG_W9nSYlKf0-iwLlSOTGaMxcx-JhpQahBQ8t3_wgRlZI...

170 B
188 B

29ms
28ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmSyaa0gVc4yf600SPjymKOugML8-CG_W9nSYlKf0-iwLlSOTGaMxcx-JhpQahBQ8t3_wgRlZI1f_5B9CfRSNf76TPC9jltP

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk5MjgyOTk1MTUwNDQ0NzcyOQ&google_push=AXcoOmSyaa0gVc4yf600SPjymKOugML8-CG_W9nSYlKf0-iwLlSOTGaMxcx-JhpQahBQ8t3_wgRlZI1f_5B9CfRSNf76TPC9jltP
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 200 dds
rtb.openx.net/sync/ Frame 3846 43 B
58 B 28ms
24ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH3uwK5nHx8iO3mYwRAGGdo&google_cver=1&google_push=AXcoOmSDFw_ntnMsnpsIveUijjC0-V75gncxVeqTh6apnqwAT60OJHTrjx-s6LxNZ04Zi7qKO1eLRkXASlTJbQksqhicJdoEKrrV
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3846
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJWS44H1Qi7bIzWeyfiJK04&google_cver=1&google_push=AXcoOmSoXQlcst8BghO8QGh2csTC-UkgBpKsWMNNleENPCu9pQUEpt7w1bShCz76GxGhu9fR-UN8LLgUdHEb2Jh...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmSoXQlcst8BghO8QGh2csTC-UkgBpKsWMNNleENPCu9pQUEpt7w1bShCz76GxGhu9fR-UN8LLgUdHEb2J...

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmSoXQlcst8BghO8QGh2csTC-UkgBpKsWMNNleENPCu9pQUEpt7w1bShCz76GxGhu9fR-UN8LLgUdHEb2Jh1DScxcs9Li0sQ

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmSoXQlcst8BghO8QGh2csTC-UkgBpKsWMNNleENPCu9pQUEpt7w1bShCz76GxGhu9fR-UN8LLgUdHEb2Jh1DScxcs9Li0sQ
Date: Tue, 21 Nov 2023 15:00:47 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3846
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAa6ygZgWoof6SWqNIVA928&google_cver=1&google_push=AXcoOmTsWzdsmsvCxqQCocEsTGrHTy6mYVbyqiFAv-8FW2Z-aotmEl9p1DNq5UCOh-cuJZxb37f...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLRTQtQS02VVdD&google_push=AXcoOmTsWzdsmsvCxqQCocEsTGrHTy6mYVbyqiFAv-8FW2Z-aotmEl9p1DNq5UCOh-cuJZxb37fzRWvPnOHophjJWWLz4UwxX6at

170 B
188 B

29ms
28ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLRTQtQS02VVdD&google_push=AXcoOmTsWzdsmsvCxqQCocEsTGrHTy6mYVbyqiFAv-8FW2Z-aotmEl9p1DNq5UCOh-cuJZxb37fzRWvPnOHophjJWWLz4UwxX6at

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FLRTQtQS02VVdD&google_push=AXcoOmTsWzdsmsvCxqQCocEsTGrHTy6mYVbyqiFAv-8FW2Z-aotmEl9p1DNq5UCOh-cuJZxb37fzRWvPnOHophjJWWLz4UwxX6at
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b71bced807741b20dd93dce6c2d26405
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3846 0
12 B 28ms
25ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LKogM0-uKfFuIsyabaR5QcU1rduFP9MKaUR2YNRFPG9r074zSnv3wPDgRalGU39lWuT5JY

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal90008.redintelligence.net/ Frame 9A96 0
150 B 38ms
13ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/viewability?s=12088300089271904444994012515008&a=1a7e178f&vb=m
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal900016.redintelligence.net/ Frame 3E05 0
150 B 40ms
13ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/viewability?s=69514600099249304444550012515016&a=81b60c5e&vb=m
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame EE76 53 KB
19 KB 17ms
12ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=69514600099249304444550012515016&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:22 GMT
content-encoding: gzip
via: 1.1 c9ca35e5541827c5873bfdb59f015b20.cloudfront.net (CloudFront)
last-modified: Wed, 15 Nov 2023 16:51:15 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32667
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: UL_hC-8jeIQJvyyX7xNko5fd8hF7dWvCTUELzvC-j0sjowrszq_wMQ==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame EE76 85 B
436 B 17ms
13ms Image
image/gif 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1700579146&Signature=T2UC7Vkm480-iifnywW8YgcAziY8aI-vcZsI1jA9o62RopZ8QXDxdCKIL8Yr~X-khPIG4K96xqbLFtR1AthjfyoS4iNnRaSkhuc7JERfrgPGcTluemsQNQAGo8xp3PBTNKa1SqNVEiEm2tfNh363h6zkJ6jBlgomZv2RHs3pcmbkhRdqEFW2BotvulD1Ni9rDczp-C1u67ta5k~P31zw3X-X9s7gvN6c-mLcfx~pbzxFa9h12pUXBFdqN7OAl0npYpTgN5E0VcsR0QayGEgZOktxPMoIuffAjLanFkNl1FIF2cM~b1JlOzUWJYlfyw3V8H0i2XBnl08OsF9aRC72dw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=69514600099249304444550012515016&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 10:57:54 GMT
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 14574
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: 0WXpGBOIc9s5ICv-E0NJruUkNQ4kXBIhyi320bB0u_rPdm8DMtmiaQ==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame D408 53 KB
19 KB 18ms
15ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=78315200094716204444994012515003&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:22 GMT
content-encoding: gzip
via: 1.1 c9ca35e5541827c5873bfdb59f015b20.cloudfront.net (CloudFront)
last-modified: Wed, 15 Nov 2023 16:51:15 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32667
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: mNt7PowHVGMY9iSVeUsrFC9NMt1hMp03OlSTfkwHV0EAMiCE9C1NPA==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame D408 3 KB
3 KB 17ms
14ms Image
image/png 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1700579146&Signature=ZPe4uGPf0rW31Hsh13Ix~QalATHVA4BNeC-WewSea9glwoMJEW-L9OGnpxQ1Ot~M4lfzLoSI3yaHwdDQKV321Cstu-nydwyZ3tI20bBbfnBOH~DU3rWLfN7t8VmH3YCqcXB6eFFSduA9zfaFQ1Ta~H9etGYLAvnYBdlZYDF15p0nrAGKbanGHqegjPm9yMZpt9DJqnrM6KuKt9BsiDx~Wf9mO-hGpsgBtuAsVQdLiKwCEH2EqsZzVmbIEVnXkVaw3t-32anR-0KNbfiUanDErMrm59EmdRx0nqm8kX-dX3jpaYbd9pNR-kx73l0I6TDmy9zc3aUXtSnFOlXSAb3I5A__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=78315200094716204444994012515003&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 07:14:28 GMT
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 27980
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: q3yXnL0asYFEASPIthy5chqk-XG1Gbn-DK5Vrr-t-8xfyyI-5KERmA==

GET
H/1.1 200
OK viewability Show response
hal90003.redintelligence.net/ Frame 7D97 0
150 B 37ms
13ms Script
text/html 138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90003.redintelligence.net/viewability?s=78315200094716204444994012515003&a=3c9fc1e9&vb=m
Requested by: Host: hal90003.redintelligence.net
URL: https://hal90003.redintelligence.net/request_content.php?s=78315200094716204444994012515003&a=a8f8741e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.117 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90003.redintelligence.net/request_content.php?s=78315200094716204444994012515003&a=a8f8741e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 9A96 14 KB
15 KB 17ms
17ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90008.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 324628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 20:50:19 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 9A96 15 KB
15 KB 18ms
17ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90008.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 367070
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 09:02:57 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 7D97 14 KB
15 KB 15ms
15ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90003.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 324628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 20:50:19 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 7D97 15 KB
15 KB 15ms
15ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90003.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 367070
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 09:02:57 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 93ms
63ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231109&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610dd69130a2aaa81dba4660c875cdb6680652c43e23afd8b6ba649efba6ac42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12521
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A499 15 KB
6 KB 21ms
21ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
server: Kestrel
server-processing-duration-in-ticks: 4410681
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 75ms
74ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 21 Nov 2023 15:00:47 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame A499
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=simcast.com&sn=ChromeSyncframe&so=3&topUrl=simcast.com&bundle=MUen4F9FcDlYV2hhS09FN2luUDNxV1ZWZTJhYjZzS29ZaGVrZU5OTVo2NDVSczQxd1hCNiUyRklC...
https://mug.criteo.com/sid?cpp=cpjWH3xlV0tFRThIb0RHNy9VOGs4THFmMjFuRnZ2aEZieklweXZPWHMzMkdZVUt5WU5vN25VUVp5YVVpdTY1dVBrQXIweUUzaGlnaGxDWWw5QTY2YUxEWEZPMG96SVNnaWpQWEl6NlV6cDZNdm1SelZmSERsL0ZkMFBzYV...

423 B
648 B

21ms
20ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=cpjWH3xlV0tFRThIb0RHNy9VOGs4THFmMjFuRnZ2aEZieklweXZPWHMzMkdZVUt5WU5vN25VUVp5YVVpdTY1dVBrQXIweUUzaGlnaGxDWWw5QTY2YUxEWEZPMG96SVNnaWpQWEl6NlV6cDZNdm1SelZmSERsL0ZkMFBzYVpVa25lZnQ2Q3hscTRwcGh0OXR2UGhFekZBRHp5TExGZDBlRFdEaG9hM3V6RlJCeEVWUHNBcGpBTjZqVlpWWWJPanNsRi9MS3M3dUh2MGxBdzF2cDU2dU1OdjdHc2lBNEE5dnhCM1JFbnkyTkR3R2F3R0JGNUVSZ29LMjhQaXAwYVJUOS9DSFMrelp3d3p3d000WHpocTVtTEF0cGthQT09fA&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

14380756458a77e5aca875d198a88816198bcade66813fead2089e2708036c74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 909154
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=cpjWH3xlV0tFRThIb0RHNy9VOGs4THFmMjFuRnZ2aEZieklweXZPWHMzMkdZVUt5WU5vN25VUVp5YVVpdTY1dVBrQXIweUUzaGlnaGxDWWw5QTY2YUxEWEZPMG96SVNnaWpQWEl6NlV6cDZNdm1SelZmSERsL0ZkMFBzYVpVa25lZnQ2Q3hscTRwcGh0OXR2UGhFekZBRHp5TExGZDBlRFdEaG9hM3V6RlJCeEVWUHNBcGpBTjZqVlpWWWJPanNsRi9MS3M3dUh2MGxBdzF2cDU2dU1OdjdHc2lBNEE5dnhCM1JFbnkyTkR3R2F3R0JGNUVSZ29LMjhQaXAwYVJUOS9DSFMrelp3d3p3d000WHpocTVtTEF0cGthQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 330921
content-length: 0
expires: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C53A 13 KB
5 KB 27ms
21ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1435
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 14:36:52 GMT
expires: Wed, 20 Nov 2024 14:36:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A8CE 829 B
560 B 32ms
28ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1060bbefb4197f46e9ec7b24023585019edb4682b19f598c89676cfeb6eed1c6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-G27VDlOwFf7F-OHoMZwqsg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-G27VDlOwFf7F-OHoMZwqsg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Tue, 21 Nov 2023 15:00:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame C53A 39 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1435
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A8CE 0
0 47ms
46ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231109&jk=2217604590396765&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame E85B 281 B
555 B 43ms
7ms Document
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 21 Nov 2023 15:00:47 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E85B 46 KB
13 KB 9ms
8ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4c7dea702fcc7f49a0c9896c80e2c246c179e05c9c59785b003598b5e1a3a9d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 21 Nov 2023 02:00:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=39648
Connection: keep-alive
Content-Length: 13229
Expires: Wed, 22 Nov 2023 02:01:35 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame E85B 7 B
380 B 41ms
11ms XHR
application/json 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: f5982f4f9cc79eb2b489dda8b92e3144
Expires: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 110ms
109ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cde699309bdd-FRA
date: Tue, 21 Nov 2023 15:00:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bcs6%2FzQ%2FkfHQS9M8tSaUXwgsj69%2FPXnkB1i%2B1tIfYUvuvSw%2Fj2QEObXXOAyxdxxyMA%2BIW0rbT%2FP8OdqhRNJ%2BVz4zUjvvuYW0c19BJMvNz4Z7ICgHfznnYBpMe2Zg0AwNL8uDr718M1gQzkg5Qzw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 105ms
105ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cde699399bdd-FRA
date: Tue, 21 Nov 2023 15:00:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AnSTF30lAHjz2HLbySXNXSclifHtI8gAJC04aTRoqfVZM6mv%2FyRJuR9JltSjJ9OV7UDTX2nFM7LeHugMZayy41ARDLzvK2ZDxXlxj9vDBVKuJ9JTBBiJMrTs6LOd%2F5sGPI1%2FfIcqjO%2BB0uqhOHw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
258 B 115ms
113ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mrx4ViVIZmXhnrrEy%2FwcU1kPMos4MRrnZai95jJBszmF700kmgm5OH%2Fy9DnEIUheDZyXdSbjoGzpdsjbzfs1znBSMyUMR9q4Hw52y6IdmUZ3Po5u58HFNle597zmGQcixzBpTk67gu8Ey3q%2FmHU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cde74a229bdd-FRA
content-length: 0

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
267 B 111ms
111ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W0gqqPYw6GV4Ko4WEpEDBdlnqIScqLHTKkSkGvqU%2B5Io7%2FKEz44SyLrq%2FItOBVHRWLzGWoRYyNhbpQTZMLrEEtGF10m%2BAcETh%2FCY4yM95%2BhUkl63ui42Jgs%2FLxig1Us%2FA2tyqvsaFbuVTcJNZbQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cde74a239bdd-FRA
content-length: 0

GET
H2 200 inserts.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 127 KB
43 KB 25ms
25ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/inserts.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 462478cd501b11de6f111719b46b8c46375ffeba611413f99b1844814a19eec8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 162
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4hppBvDgXdWLNBG9N4JK7WstCsLuZviXrwt37hPfXFAV3r%2Bh42pKL3p4jA%2FQ1ZjA2ewT3ZfeYUD3LjSPAmu9lMHoPPKNeKkmJvMJO%2F6Ht3aK4RlZg2Aq4dCE1kzAS7YT8AOPLVIecO4Enmn%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cde69c8b3737-FRA

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 95ms
24ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:47 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 05AA 16 B
209 B 72ms
68ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame C53A 0
10 B 13ms
13ms Image
text/plain 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?KqP2Ug
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK viewability Show response
hal90008.redintelligence.net/ Frame 9A96 0
150 B 42ms
14ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/viewability?s=12088300089271904444994012515008&a=1a7e178f&vb=v
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/request_content.php?s=12088300089271904444994012515008&a=33ee7217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B32A 42 B
64 B 54ms
52ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstcflMRjp2rD8NsYEEIV5LNWmJKW00zO9oHhMAGu7TZA-ZwFWNR54730hDjmz5ifdXk55FaX9SyQ-eWMA-LpP5DkKesZWFF5SpSUCFYUzv4oPiCuW1_pYhUy2zM7zfzoVs&sai=AMfl-YROiyLEpT3ixzHBlQvBqs8CRk4De2ZjdteDvIix0i1wPaEE2nGD63rbzt2Bpaqty2LF4S7SSmcNwjXYbcoHWahSa-2QYlWczFEGx18MkcNPmsDkXG06HY6jzuiv1XGo-8ea2C0rATbLsXZGtfGa&sig=Cg0ArKJSzHvxJzTzmJNQEAE&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&id=lidar2&mcvt=1273&p=655,1232,935,1568&mtos=1273,1273,1273,1273,1273&tos=1273,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4205689792&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700578845636&rpt=1241&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EE76 42 B
64 B 53ms
53ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvh6cjpBbWS6a9rmXVebc9dtHjyUg3bDoc7uxfXIh6TEPCtbHsmixUya2QcMMli9C1Kb0A8ahQpk40TiTF2UO71Y2unwjRb-uJ5OL46cEwPzOHfWxrJxJ4kfZaBxvDnrW8&sai=AMfl-YR3v3k1gUrWp3lSRwmIVeAocCxaRqi3vZ8RKlYx15A0Vqc263khni-SRS_FL7bbJjaFjm-jukj3k-PItW3VeaqTxYQN5SS7tpnlCM8k9HYFFHXgLri262-9-JnOkvZsnXM-ps_3p2xeWkHcguiP&sig=Cg0ArKJSzKXTP-TA6fTzEAE&cid=CAQSTgDICaaNW-bCNJI_hHGhkWxvEZpX0s2SOYZvntZqXPnM6cj0u2IdYiMFUHLorX2G_nCTDpYA5sLOqfz8JLcYuYeAQ5jm2b2-cjsSUsLFuRgB&id=lidar2&mcvt=1275&p=1110,436,1200,1164&mtos=1275,1275,1275,1275,1275&tos=1275,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3850137031&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700578845643&rpt=1269&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05AA 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=817290403295&version=m202309260101&ct=77&x=1&cor=5792267097212196000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame B32A 16 B
209 B 1223ms
1222ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame EE76 16 B
209 B 76ms
76ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK viewability Show response
hal900016.redintelligence.net/ Frame 3E05 0
150 B 38ms
13ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/viewability?s=69514600099249304444550012515016&a=81b60c5e&vb=v
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/request_content.php?s=69514600099249304444550012515016&a=fbf922ba
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B32A 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6075966465544&version=m202309260101&ct=77&x=1&cor=14078881567066325000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EE76 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2062271855436&version=m202309260101&ct=77&x=1&cor=2222850762562158300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 22ms
22ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 24ms
22ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame D408 16 B
209 B 2303ms
2294ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 152ms
151ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D408 0
20 B 53ms
52ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1164303885056&version=m202309260101&ct=77&x=1&cor=14960327330844477000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 p-64ee7c76.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 5 KB
2 KB 43ms
43ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-64ee7c76.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: fc671afb0fb4f987fdba2d42d1712fa4fbddb7f593d6b9ef3a08bf62cfe8ebaa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 163
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=at0eEUJosBvYbN%2FWH%2BXJ7Cjkx0HwhUyk8Ogi9xOFUx%2FFgEqDcsSPzRTyrxbJZXCp%2BPcKaT3%2B5ODLb21zl%2BTOPNn0bCElTEBFB2rlfsokTdMRMp71SYEKUhyuiaXpUo2nZ5Hx4qEEaoaNM3jf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdead9783737-FRA

GET
H2 200 p-519aaece.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 18 KB
7 KB 22ms
22ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-519aaece.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 7de421f5fc292856d86cd03dba3ad6bab58657ea6c554221445a834e5fa09649

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 162
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SDTqH6MBC3fbTedDPe4Mwe%2B96M6JJyYYFTrvzujDsevJUgEGdSJ5pt7nQbJngQRt3XJ%2BJWVjQYeRcBxZmmGni6I6PXjVyMY2NLMIH5wD181jwiY1BzQnsaXNX%2BLBqG3IGpafAz3AnAFT8pol"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdeb1a183737-FRA

GET
H2 200 p-6de0ca0d.system.entry.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 56 KB
13 KB 412ms
402ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-6de0ca0d.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 712be1d0391b49ad1764f0a469f88012719b49d17d195f2a8482c7c73d556fa2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NMUnQ%2BE53H2VGNEfKBrwrM%2FBNKv79gzWEFamrYjGJXoIdBOz7dWy6o4MunwEDYVwZmxSDrYNJ5h2PW30TXXNe4a6fFyRWZHz6fdTMSuBvpwvk7pIsA6BiydXMYskAGAX3N%2FWwsHeWUnBBKRE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdeb5a6b3737-FRA

GET
H2 200 p-75fe082c.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 113 KB
40 KB 29ms
29ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-75fe082c.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 27957e60720cb638a200617a862829f7de781662b0872d8632172ee14d224364

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 162
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NRTOAk9V3cQpzEKhplzisaZHBSSMnJDw6pjVliHe0c%2BC0KEPzmiLKpIS9r2sHqGZv9E7YlSLWg6vtMAZ9hRi0jWL2KzzYj1yBhcpkOEC8AMCiWmvtPss2dzscs3mrYFlyNw2FVoUhlviq%2Bso"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdeddd9f3737-FRA

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 51ms
51ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231109&jk=2217604590396765&bg=!9vWl9brNAAZxrfrxUa07ADQBe5WfOJCEVCO1RT2IeaAFHOelVWLC67rj0E7VvoWxoTeE_02BDteLEo6F9-V2o4OD0WE_AgAAAxdSAAAABGgBBwoAqz8zZCeBkwwXCxqc9q4BAV8ZjV4g-bzbZHFgUoBhzyOcHhJsY8ATzXAbIqKN-id7Acxl9cAAIX1PFb_JGLXunKUSZWqObSjVVmVWY-JJC8mMhMliY87ev2-1LqSFPJttvV6vuXQ_zLTa037w90hp-wqmOpvqgKqtQg8kERlIe6ggGuBtRWIfhjeEmM-HFXzSw7HbICt8vr4r80YgM6AESfILt040Dl5Bu3nRX5kCxdHBP4hRBJ3cYEVOdF0b4HpvnhTw7prDw8GQSSeWpxWW45J7eC7yZOAMxh7Nu7bkUnL0DrdPsEDFDMfu-F0X-erCEwRFGJ7xV2OEfkn6ztLJ1MTQmHkMP9zdIMiwercC2hSC7ad67xrUeSagVw3M2LN1Nkm0pePu5VljsdyBCiLHxR-NlymWqJSz6ZiBtZFvY7hYEeTyuzbb1O4MiSxPKJKlRC98V_8PCvJdxGRUB-yaBiEi7luksJhoqPtpm4EmPIyp9SlorzlwtvHpU77XY7dy91sSQG1OXKqj6X15Iz_ffyaqmTQPxTawAt9etP1bfCx1YYW9JiyUrJ9oCt1SDS10aNiPLAaa-m7gc_KJ_dZT7Gqbppktb4pUPIM1MCkd7KzMDjdEzEwK3eWqkb9WCLyv6gtu8lZZ8ubSRyjznUfb6jezXm1sp4G1p4Ej9PEbJBr9hUi8r7sI2INvWWxTbft3Zi58pO-FHLsYiXY8vQbuon7tijGRUNfcmW5iORNLL20SwBbzLlcjuTZ68JthaRCqL6b0yMmbrjndqhTKkT1JfOzy2ckt5-2XT69yr17WlswhUs0sXunDfXWDRQgiguS_YLrrx_dfppAv3Gh6TRneoxoOLM3UWYLfEhKw4oknNjaalWNg3W9yrMsuIKn-DbZqLTMyC7IFOXPdDCqf-fB3nyPRYpB7UyUiGIBOHsTIuT0TzudVlgqXXOJRgRJNQPoiQZgyeclgnvZxKm0Jz383jbo1sMlBvp_s9wikXWk26WFBUtRcHgJNrPQ2mGuVTEdQwyFgXRVYruDcOI5WxCgN3fOrdMNmz_KW8N7myaR0te4Qpc9jJCYAoWHfmOkUcO5oWpCFHGqN6zGMluYEwlQdqa2AqBlSayUw0lWa-QjNs_xL6DXdC6qdtgCMeNskcAf4w7FfQnR9BHz7pJR6apJ9vYY6st0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 204ms
203ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdee3af69bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kgs6vRxd7x1N%2FmIwYAwQrJGS9%2BgsFGhFVsrk4U74P5GbYsBrVj%2BPFwyz0a9nirQdYeqSDODlW5PzeSsLpBDpudk0SAi11fud1cTveS2L5rLRU3EGStgt1wwKCw%2BOp08FzYksfnEk45YRIHnWNUo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 107ms
106ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4NiJJgzdWnsdFn7RGtU%2F88oBwjTmL%2BggcOGQNl8Zp9oPssDzkPLxQKJdR6txMwtFYTxU3FQoQWDs31ADwhM6rfLQgcKUqJlSEdTRu15VvMjv7y3Y%2FPD483e1PVdAocUNiTjruhlnZVRyqGm5Tlw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdef7cb79bdd-FRA
content-length: 0

GET
H2 200 Generic-BugFlip.png
tags.qortex.ai/assets/inserts/shared/common_images/ 407 B
702 B 211ms
210ms Image
image/png 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/Generic-BugFlip.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 92ef728984670149848a09c8a589b1ca470fe602065dee127c26a0dcab2115a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IEOrOr9Qjh99q4cfIL18eOEAdtULI3Ejzncu9vhLF%2BBLF7tVs%2BYG1PqN7B1V5dBOVXr15QmxyhUlkS%2B%2FAtdfQu6KyNkhI9wa8myw%2BZIVLmMaxb4fHEruXhA%2Buriko4pqUaWPK83N2tv7hKpo"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8299cdee3e0a3737-FRA
content-length: 407

GET
H2 200 PNG_CloseButtonOutline.png
tags.qortex.ai/assets/inserts/shared/common_images/ 1 KB
1 KB 17ms
17ms Image
image/png 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonOutline.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 430cc3198a26a9b7438c95aeb5ff9ae90437059a690cdd1287c57070f52d2982

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 54
x-powered-by: Express
content-length: 1080
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
server: cloudflare
etag: W/"119"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q7A0%2FHFo3v5tRgHjwGGcklYb0ID3dZyPYKhPZ5tclfo56VlXqV%2FyxmrcagclNZaPEby60BjVAUc%2Fwe6awZjOAfMWWKYdGR%2B%2BnlwsrtL90pcWaTncq8VCeZqlP4ZOlzR%2BaDzkuXjZIMRPQX7c"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8299cdee3e0c3737-FRA

GET
H2 200 PNG_CloseButtonBackground.png
tags.qortex.ai/assets/inserts/shared/common_images/ 554 B
846 B 20ms
20ms Image
image/png 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonBackground.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9e399906113e82fdca498a58d00013adda68308481605fcae2d488772559425f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 116
x-powered-by: Express
content-length: 554
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
server: cloudflare
etag: W/"119"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vqr3mn6%2FiiZFbEed6q%2FQdsTYC7HBg%2BeE%2FnnK4jrOwrU8gu%2FnF%2B5F1fVx8mKpZn5bteArbHzk1U0lf7qN%2F2IFAp0z9f5m2UKUDtB0fgCi52WHsMufvoj9nwb6CGapVCbn%2BzXYxMcGy7W0TjA8"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8299cdee3e0e3737-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 113ms
112ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf03dbb9bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q9tPn8eQfoqobLwL2Z0ru0izKRh8t1rt4qxLuoWwVHyDgkOVoVX4EGhoSL0KGmwpmT8Uv44%2B3gtZvSVJFJVdG0KMQVqzwFQSFNmL9QL%2F7i9LUyQOj4mI9yK08th6LM0USFVKQf8G%2BQeO5fquJVw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 109ms
108ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf05dd79bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nWpDd7npCZtywBNH%2BRqPcL4awNchvLZ%2FlQsB0Ml7rpPFTSbTiyVqP%2Bm%2B1JVVCcHWzkGRr8IlBn9M8V%2B1ViKu771nTH4ToQb3RxWHZ2uQFbXGNw870eB8oQNsBIQ19QR3J%2B2XRC4yROHOx7HbBH8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
264 B 113ms
113ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hUtmoI5Z7%2BgvhdO7BYeNbaY4RX0%2Bk2sgOHXa28Y3htb9bwRBZrbwINn9%2BxPhqx4u8FohVCf7vUJTDAEr5%2FaC1t51Lr85FemL%2FyBuzcVH3slzhjsXfexiB57uvc2ZTnlyZBCBiG9yDn%2FJFjR8DRM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf0fed79bdd-FRA
content-length: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
12 KB 322ms
322ms Fetch
text/plain 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2217604590396765&correlator=4257029276771017&eid=31079667%2C44808667%2C31079239%2C31079744%2C31079527%2C31079575&output=ldjh&gdfp_req=1&vrg=202311140101&ptt=17&impl=fifs&iu_parts=22181265%2Csmc_cx-on-stream&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=7&sfv=1-0-40&sc=1&cookie=ID%3Dd7a460e3fdbaa33e%3AT%3D1700578845%3ART%3D1700578845%3AS%3DALNI_MYEsJlqO_7Uqv_hepqsePQG7NnBCQ&gpic=UID%3D00000cd69003e661%3AT%3D1700578845%3ART%3D1700578845%3AS%3DALNI_MZHcH6TYam8p1jWLlVAli-bbm_CIQ&abxe=1&dt=1700578849325&lmt=1700578849&adxs=20&adys=655&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fm.foxwebapps.com%2F&vis=1&psz=760x-1&msz=760x-1&fws=4&ohw=760&ga_vid=1992606109.1700578844&ga_sid=1700578844&ga_hid=541329820&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRiSxZeTvzFIAFICCG8SGAoJeWFob28uY29tGJXEl5O_MUgAUgIIbxIZCgp1aWRhcGkuY29tGOXCl5O_MUgAUgIIbxIbCgxpZDUtc3luYy5jb20Y5MKXk78xSABSAghvEhwKDWNyd2RjbnRybC5uZXQY5cKXk78xSABSAghvEjsKCnB1YmNpZC5vcmcSJDUyNTE3OGY0LTNlMWYtNDZkYS05OGNlLWJhNDA2ODVjNmE1ORjiwpeTvzFIABIdCg5lc3AuY3JpdGVvLmNvbRjQwpeTvzFIAFICCGQS7gEKCHJ0YmhvdXNlEtgBd01kQWhXcFlSeGZTbWhWU2l2MXBzQXYyZFhVamFyeEN0NUR6anBCNC8zczJSY2xEL0s5VGxWRTNJNTgzTVFhS3JKWDZJcHlLTXZJd3lXNzVPS21RcUlycDVVYktZTGxLc3YxWWt1NjBqU0V1ZEY5N3dxOXRrZjBpSkkwRmhVZXduV1U5Z050MEVpeVU2aDRaNG9KUXBCMlJCYUdiWnh4bVZFQUVmajhvYm5rMFg0SnNWV3YxYXhBeHc1UXlaZGh6RVFPMXBYZ096Sml0Q0RoNlM0NitDZz09GMXFl5O_MUgAEj4KBW9wZW54EixleUpwSWpvaVp5dFBaR3Q0U0VSU1ZWY3pRVmhVVFRCdFZrOUJaejA5SW4wPRjExpeTvzFIABIbCgxsaXZlcmFtcC5jb20Y5MKXk78xSABSAghvEh0KDmxpdmVpbnRlbnQuY29tGOTCl5O_MUgAUgIIbw..&dlt=1700578842379&idt=925&ppid=525178f43e1f46da98ceba40685c6a59&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D10%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D500%26wrap_l%3D1400%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D800%26padpr%3D16%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D1000%26gc_bucket%3DH%26waae%3D1100%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D2s%26pad%3D19&adks=4080903773&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2afbef657fbfe2da63f35619fd3864620f330686b60c5f1d5a450e919673151

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12668
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
263 B 108ms
107ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g%2FL1Dw%2BU3%2FEAJytNwNwyp7j4Bud8Ysm5oqjXyzz2EdI0wIX9n88A3%2FqYNXxbxmUNabm4nRqvqR1hEhCgmtttXAv2nRwi5v9FMwc6fbBH%2BwsUtmgPZww4Zfvl9K%2BFdr2wBvNgtiZl4wMiXfN5qko%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf10eea9bdd-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 114ms
105ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf07df69bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aB%2FgvZ8z7xB71ZoP3FBPg%2Bm9FFhWBmC5ne9JkFe3w7lRCmW1qoT2vCL6T2wmKnWTEu1kTNT5am7N8qvaRrcNFtimowwowvNjcNb6SIejibrWMtDAAMM0ZCLiAP4Dr6B9YJJq9RyKy2uBFzNqsDo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 109ms
108ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SZ%2FEClyrIweTtJ6uNtZsf%2BE8achcrOayZyUMSNC9h2a3v1rrUquYLTTuFw79GwLr9IEgYMyqaFusZG2AOq4YAyXTMs2s6Aq%2BH0tLVX%2F6N6jn4trjon1x0jcZxA09nYtxXh9HAhnzITEzb9IYFxE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf11f099bdd-FRA
content-length: 0

POST
H2 204 prebid Show response
ib.adnxs.com/openrtb2/ 0
637 B 14ms
5ms Fetch 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/openrtb2/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
an-x-request-uuid: cb1bce2a-2e9b-44c9-a96a-45abe17b0ea6
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 25 B
363 B 21ms
18ms Fetch
application/json 35.157.220.244
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.220.244 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-220-244.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9711763ddef6246d6d28f6be637c00c7ead7bec55dc37d99d2b25876742a8088

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 50

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
189 B 60ms
52ms Fetch 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=139&profileId=185&av=36&wv=8.21.0&bundle=MUen4F9FcDlYV2hhS09FN2luUDNxV1ZWZTJhYjZzS29ZaGVrZU5OTVo2NDVSczQxd1hCNiUyRklCVWg0SUV3c0YxU1pLcW5qblBPelklMkJ6eGklMkY0cEdzYWgzYXA2SUVja2Q3QXlmQmUzZUwlMkZFbFAlMkI1WmZ2JTJGUFhRTURyQlR3WjFVdzAyQUd4MVRCZG51SjVnbjVCMHkzQkdnd2Z3JTJGZyUzRCUzRA&cb=41954040932

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
407 B 24ms
16ms Fetch
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://simcast.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
44 B 23ms
16ms Fetch 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

x-nbr: 1
date: Tue, 21 Nov 2023 15:00:48 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0

POST
H2 204 pb Show response
ad.360yield.com/1914/ 0
164 B 41ms
35ms Fetch 52.215.9.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/1914/pb
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.215.9.120 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-9-120.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:49 GMT
access-control-allow-credentials: true
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 2 KB
2 KB 46ms
40ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: ef8e80490452ecc6945b2f32bb6b78185f46571c316834a613a9ccad9d54035d

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 20
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:49 GMT

POST
H/1.1 200
OK / Show response
ghb1.adtelligent.com/v2/auction/ 2 KB
1 KB 304ms
100ms Fetch
application/json 2607:4f00:932::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb1.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2607:4f00:932::2 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 555196c11c649bcb5560c3a36d436be4bf26c81916811132f84e38f2272e1c75

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 748

POST
H2 204 events
bidder.criteo.com/csm/ 0
189 B 16ms
16ms Ping
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 113ms
112ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf268869bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ujcNvNbw3N64yQIHqPwqWEBod7sRmxL2rpuj9XzhgAKtMH%2FANKz%2F1xDJjaJxDlo8W6Fyb27oBsQ0oZS6wmpDW44XKhwXMvrDDZPisdDrAn0V0QERXhX6NEEw4hDUrwOkZDJSNbNabVJbiK5AuOo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 105ms
104ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CvkMBja%2Bmewuzza%2FLtnQaInZFhv68HpkPveLUfA9D45fcWEULyC9Hp%2FhPOR4j2z93Jrb1VG3ujw%2BhVUAof2bLJOw7l6D7qgyjUI1KoCbKUypEhmH9VrfJDBS3j1Hi0bwBhgK8XtiiiGF4zHHzkI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf319699bdd-FRA
content-length: 0

GET
H3 200 container.html Show response
65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame BA35 6 KB
3 KB 20ms
19ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311140101/pubads_impl.js?cb=31079744

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:45 GMT
expires: Wed, 20 Nov 2024 15:00:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
258 B 116ms
116ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xrma6Rn5l2KnHTx8aqkdcBJjVFj8TELuhisOEdsPiOqNvz4tiOhx4r3VVwqLmuHjNI867loXlveRMujlyIyEVyypl1eDw9KguPh3IXHFoLtLwIU%2FNYa4l87UpJYm8UQko9Brxay%2BU9juu%2BMp72o%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf329799bdd-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 105ms
105ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf278b09bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=URtGrnTkxZlgBOlCCJiji28ORlxKzNfX0NrwhIO6tFmvEgCkdIFaet%2B1LonSLs%2Faj68ZJCQStbnMTuMNBvTrM3sfRQz0kLQYI0B2ppU7lmH02FfB5EkO2U9dAGvxgTnQDsYc1acn%2FgJsh0JLp50%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 150ms
149ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1k4NWRKE%2BzrCNb00Za6nHRFm%2FcIkTUxG21T8kBzMutrzao9nIDic9EommOxlZKYyMEPZqbDR7sEGPaOjP8Txq0P%2Fr%2Fi1ZPtRulSvOnx4bov1C17JeiRTtfXg1b0yn74B0q5Lo7jNEbSC4ckXYc0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf339909bdd-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 111ms
109ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf288b79bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6a8uYUWWPOdokz0f5Hn746oLn6kvVRMsO4c3Icvugkyv7eOQ%2Fmf4dxDUP6eE7wtouWlwQQRO9yV4fIDBNmYG98%2B7t8tMHw%2FXgr%2B90CIApTXUNo8jlLRActhnrJ1ygCd2SIanEkjUtQaHW6NgDzU%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 111ms
110ms Preflight 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf298d29bdd-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FXYlGMvCVEI5TuXwveqg6HD76OtnxNOFfojzjujmQk2h9GzFnVjd%2Fn%2BTwPHAmbtlfD07%2BQJU4TjfZm0ZBovQHlGxofdfs8KXdUxt04xraEwC1NsFByQZdtrLb2XsY7x%2FAa2przdqb1YsxpXgfuY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
339 B 140ms
139ms XHR
text/plain 2606:4700:20::ac43:49b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Kavss7dnJHauHSif3QvGtQu8BwnQetqT6NhVgrLTzWK6N0m5VMMstWT0EfqrwaDRh8rdi2T0G7WpsnbG8Cob4WNEZFbU5p4DnsExJc%2BxgFkar1AQ7uF1BYaVBbgWk%2BTxz4h4Zm%2BxN5WRyWUfEk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf349a29bdd-FRA
content-length: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 199E 466 B
235 B 58ms
56ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHfi88DEOKAs84FGPORk_4BMAE&v=APEucNUhJIO58r1xIoDMmodquHXn-BVfs0vbqTEZz0YlGzeSt2jM2GjIn5sqV0HDjqZWlpaf0jX1VCjIzPwI1no5-csrNBXi4IUnKu5GAunrjKMLi1lRbMVkM5df-E-ahwhVQqTzBxdHdAp5Uf4fcjd9pJJvXVh5-Mc1FjAANwRaGjExV_9fVMxg4TYZRVJbUXER2qaHAg8IRFJ_xiYhn0a9AeH5wviMeg

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4D5E 89 KB
31 KB 85ms
85ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf940bd2489897434455528323cf66c4e3aecd5eea963f1d99d96acd452d6dd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31498
x-xss-protection: 0
server: cafe
etag: 4296746511219988724
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 4D5E 3 KB
1 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15731
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 4D5E 20 KB
8 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17494
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4D5E 0
0 24ms
22ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRUePmc0xC9kg_L28N_s6ZRLRdv3XZ_UkTebdNRUtGvS5PAfFz3y8rJXX72or_nOsnWqohxMw8iG2zz83QUVmtkGZgZbg
Requested by: Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4D5E 202 KB
64 KB 49ms
47ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D5E 42 B
63 B 52ms
50ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CRRyKQeXFjyS0I4AKJ2W3In2L_0cRM8-6rWbuL4iWtuhZTOhdf25YFR2p5qXKhaezGTzcaOzJe2s6qY3lN3wvbG_QZc_lvFCqcVd1d7uqeRunDTV0

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D5E 0
20 B 51ms
50ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5645082388650423642&x=1&ct=119

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

partner
sync.search.spotxchange.com/ Frame 199E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEB4xg6LVSrHff_CmEAFwwWI&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame 199E 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame 199E 0
38 B 14ms
13ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHfi88DEOKAs84FGPORk_4BMAE&v=APEucNUhJIO58r1xIoDMmodquHXn-BVfs0vbqTEZz0YlGzeSt2jM2GjIn5sqV0HDjqZWlpaf0jX1VCjIzPwI1no5-csrNBXi4IUnKu5GAunrjKMLi1lRbMVkM5df-E-ahwhVQqTzBxdHdAp5Uf4fcjd9pJJvXVh5-Mc1FjAANwRaGjExV_9fVMxg4TYZRVJbUXER2qaHAg8IRFJ_xiYhn0a9AeH5wviMeg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D5E 0
20 B 49ms
49ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2820071063427&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D5E 0
20 B 49ms
49ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2820071063427&version=m202309260101&ct=119&x=1&cor=5645082388650423000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4D5E 91 KB
38 KB 106ms
105ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-APXgXtS_5Xcl9yJanOv0C9hq-hzcaZithAedTOTGx4x6DTQ6TuthY4BcUa7a1sdktmo3KiXC0Gw0Em_3eCpP_Y1xcRL0kF8RQq2Fb1x57hIJqCUBN-EQxYUkI-mOJQSuFuuF-nPKW0Q8EC7acF0d-ycqdtOjNoLSKPHqfyNvkeyKWlyKwEd2kieG0XMwEczgsirFZa&cry=1&dbm_d=AKAmf-AU2QcFUkMDNEv-TwOpEkw4oGiwi33QrASmOPRS23L0H7B7EgouloUI66KGtOeWlp4Hovd_mMoShyVB7EnfEUdJEOvIT6277zZE7Eqn1PTZ57KawsHvpta_GaP_RFeZBdldvn9JDuBZzYEGlDlFFO_hgveCR5AHrOiMXSfn_7K2So4NZu_IKOfIDE8SGhLjWuxyAWnzy4TcI2PbS-jhcVnTH0L47RKXsnEgw16VMOAFMoVWIShrIg1zPOo4EQc5CsKLHopG7cSdYI_z81-1gi0ubTm9XPLefodZfKync9GiES8Fp9Gzz5V0E4fhPWQVzzn6Ks2OyIK01IhN-ojgvBVqILnxK_c8OTQWkXZ4LrcMxUsNI43MJYJPg9QV3FyWB60Ri8-LMoS3SfMHJoJnE4i5KtgyH2reTKKqfq-xn-Pj6EGvdMCR827ixEB3H8rlnWhpETvEZAASYs9WW3B2GrsDXSApRUcRFCUVWloMT5cPJwRI-SFl0JShAakMeiOusOTwF1oRML_RhhYF-q_LwEDkYLtoONgY20Wb6FClosdDluxWHIHc5UHkIN7chT6Hjzimtzr4HGFFX2m1HUxlJAQQZERiXCWhbN7rnIwGe16HOT8w6YmxDlZ3EdXzIHwlY2iM7XMv7fOaxaCIyitpy1uu4p2GwnRrSkEVgBBjbCv7ekCIheTFBAF1MVPbwQUVqJ-ZMHdSv4TmKNxKO3leGS9t1VGEEmYoz954hEe0MwofGJvjBT7BbilUmBh58HxPJTy2M3CNtTS4lNiiW0or4DNCHwIeQh9Ec43geKjFpWsUOoE0GyQO3idpfYUeeRZ7YHlQVvr8CAsitvBmk0YSZvEfhy71n5flVAnA8qvMEDr9TPkiAEIaz0911MFbdJODtrFtA2UKJZ851d9TAy4lu2dMB_IMoseRb4hnuTmviku3wFbX9zY4-tPF37meTV5kv3pfPXYdh0ajzosbNxPnv2mf-C3FwFUvHUsXFmB503Vb4tFwMDKWzhYhmbkE2xOwdARmOcKxInEOGXZdc08uhm__Skc4z1B6do-cYabaTKqS1vA01eE17ayaptUEv7PSEKCloGXK46ALXsaSqZ3pLJ5Vq3zykGOE04RktS75ZfLgV0eUz-rZQ6sSSduuAm96LewNq5JwZnkd4V80EpnE9QhUmrr7AKorZP-QyS_eyMudm7pdsnzs2nSEHgPzzt2cyr4phR9UywX1-ME-phnHGX6IJFGlx3JCx7VQEHQGirIOEdCdbo5WjYpSay-bwwzU0PZ3O7-GzOck4_qM5HJzyXiU0h7KM1OGGlpn8OygovWdCWQp-65XZkhOR5nSm8FEdCGGIehSRcGmMObURIriMihZjTQBV6veIljzUvPTNQWoCrdOEooT6gTaljCrotO0OQLXjVIF-z2d7g25C2Z-fsNG3YeJxKzjYiEKPLjFVuYECCDKKIYAopaApzpmAcQ8k5pck_0gJAEHFiLxxE_zeVH2EIMKgybwxSmtPUyfKaz3crR4mTes7_Ckg-FCbgYZMIKF0rO397Jibht1NxtnsedCQukkv98gxMMrlgNPBMD4Jd9gxCu9B-FVsoc3P6hVINZnw_4hphszFLETZrNtyS030mLUO0f9kOlcxhHeZeZ9ZXIOn5yngwewxiY8hOId6Pgo5ROtbkeBF6oCk1wGcHvCYQFvjwXOO204lRxaKeiwhOwedZW9DZWlIqb5E80xpIju1KEBrTMXnI-m-slzJMX6Mq7oIuM9pMbUeiopsDsUx6wLYxMlSpPbddhrSIYdTYcfaALkMwIt0_qgh2_lArctvaXV0vIzC51rdbN0vNo30M_w6-r3njJOIl4dEulDrFlBdD-uYN1B4cWDFVv6us92TdlreLwFv_gBcd8alR1KAEWWgOgZ7XDLi1i9nsPPEotgW2vizWZ11QBSu6mArzuFWrywzGymMdO-_aHm_B0t_yM5IlW6_w7-7iFBj3UrEGxKhtXzx6CwVvhC87wPTIMX6HbtOJ4VDMusUtM8Z3u9TlaBkyqfsWNMd30dTHtlapiZAC45K3Gy3sA1fMNmHMJHAHbjAj94WI4NZ3q56_TEUaEvVKFr3gJjArxLvEnCM_L8ciUltYulWI83XLRoixGxuoUP60oCKObCvYk1yXzS_YHMXYO_1GotC25D5zCsbIEvks_MU7UwrzkEQ8cGoR9mvp2dJwZ5-rIGCiimUkqG1mponO1HcFsJjc4J3xYSgypBez6dOOsEUWm5UayErtRIBOAyypIbpDycQEhg0mTtiF5EWmWGc74b3PCKLlQQHdSu1yqUrPc3LxMHmdGBxRk3l0Sg2yUQZMtSEqmvUGcZ2YT35XUa4iufZHXz_T2IWAJoeI8TOHaSo7buqOYp9ZP5eNUrMt1FCSBgq2XVJk6wHX76VSnIGoI8yE_ZulJl3KEeCsmicHlgwklUoGDrmFrjFYotV6_V_IA8dkJW5h75GRbSOaP3auw6k_f2ujh7jVPUNU5jHeiieRDENDyUaHFk4cSow_CXYW7WcC8hieZ3fAXTglM2iQV2vGoRFAcI6cC6UWmEBmMUpBztrh7zClRfJTGvrmcbJIBIYRSTFrLJu29SOtyLbu9c1ZB1wAoVhQ0NebTlxf6G44ylCN1TaogMX-onoxidD0VIoKqmEHzEkwMHd2BGSua8Lg6WreHi__2eDu7iQCEMhDQqjsMyJypOX8O7a-rc1LgX2Ue1l_Zcbgip2L48UVK-aTfsHi44xcWoZztYfEAMSdJhzWfxUf1ayPx4YcWK_44a5YiUXZJHA0tae7OXWhHXZQ2RpSoOVI41Bfh-BpTcwWDKQdhl_bfBYUJ5mQOfKrhnhhaQg21h8-w2wxnRwaEe3XxxR1_ASszSx8OuxgChQi39iTgw7ODO5MWrGYfs6jgSmury0-UZd1E7vVUaQjCu0CFEj1lsxPBq_0ux58YUHdCIY-uPjqCgeq58ePs74jMr2tVYDZ6bWQagZLv9RYHhFQ0LHVKz7FLLa6NIst7LJlfcwIj1J8KzTS0zoKQWK0wPLNBLEwotDb7OamRQZBbOVDBwUtGbD__HXY7MU9uLCzC_WxSm0B0az5Xz466iGGvQRU7YGmkACFX_8ZebEAcuyFUM0_Qoj-EHo_3RzzGSAx4NyiKnNl2_vbku03MAmftqRvZkxVHBGrvuCAxf2sgxNXC-41dbdNUcK2eabnbgP0R_jYQs2HSevritgFaVjTAIhS_UWyFatsv75hHVj539VgTBMhMt1KC6uFLlYmtDOnWg5MwG6oeS3iR9i0pUzM29kkY_Y6uxEwt385FQYNscdezfSrnLmGreWz8efjOljFI-Bj7dhB_jKGIiY077Srww41BY7KMTqleu2xJJ1MRMvGq6M5hRlneTS5bLHBFLc2lmjKMbKXLJT7Ua66wMTqwjTtHR2iTHDG6Qm8C_G5CP5UzsxSQMgtd1Fht8vOXfx3ZdfwzykRSqhySM54DOH_HcukKitFphrySfca9rzHngQy2QfJh7g9LOGUKKE24U9qLKldUnlUbpmMxKeWAoaHvKmL2we9vL0rfwUhbTtx4ta_yu7K8mJrq2vUeedob-IqbS8suUPw5d7ty6BWpInExQ0_LRWAUBpDuOtBeW2QYpHTEWHl8FgK73-9B55LmKJajKjCDe3ExjoUJegkwYT1igL2HG9PRmQHTCEtj4oSpYoVqGfWc_k_GRaFH0Vm5-_ZXGhwSBBF_yL7gLLxJkH8kH-_MzGx3H64O8uIfLjxLZ2Q5RTHoZjXke_L6_9M9zvEEKW6Yqi5X5_uDlR0Bm_zqetTl3QvN3_s2pnNQtj57R8QS4crPMD5iwI5IscZ-SYywUC_CO1hrpVPF1bdysazltMoLkjFrEiyn0eQFC5wvMBZZfp3UpL4af_T3Dydgglyv5bORkQmaK1K9R6lE6OSfzo40XomllwZ-BjdokLwapAx1qXKQWkVE9A57eO_fm7KbGgAcavEWb9LafzBumegiTD8V4O-itbnIq2PU1LZ0AEBNUUFlqQGn01_A3&cid=CAQSTgDICaaNmtiSFOjEXlNnwiMGMWf6jtMj5Wi97nPxB0ffDvc8KXZWQ1PwwxS6wRJ7jybi067IFx8LTojl3fIGREB3M2c3y-tlAJyFsYFIdBgB&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=5645082388650423000&adk=206653492&idt=90&cac=0&dtd=36

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7aa463fc8626379a976b814ce7c5597c91a1a997655a366a1ac9d0ff51b58b3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38730
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 7469n33r91q891q208nnrn900s70ro36-00002.ts Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/ 894 KB
896 KB 421ms
420ms XHR
video/mp2t 18.66.97.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/7469n33r91q891q208nnrn900s70ro36-00002.ts
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-62.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f899cab001b6b0b0e8e12d2095db58a18f4e8eb979ee2bf5ddaeab0fa446011d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
via: 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 915936
last-modified: Tue, 21 Nov 2023 14:41:53 GMT
server: AmazonS3
etag: "95cb965bb4457cbba6ce94e8369e6cfd"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: video/mp2t
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: N5LVZv595vMR1_HzxYyUAOUKHg_ZBd7nzQMfjyZ9M1KgXpYczhJkCw==

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 4D5E 111 KB
39 KB 88ms
33ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Origin: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 06:30:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30639
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 22 Nov 2023 06:30:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 4D5E 11 KB
4 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-APXgXtS_5Xcl9yJanOv0C9hq-hzcaZithAedTOTGx4x6DTQ6TuthY4BcUa7a1sdktmo3KiXC0Gw0Em_3eCpP_Y1xcRL0kF8RQq2Fb1x57hIJqCUBN-EQxYUkI-mOJQSuFuuF-nPKW0Q8EC7acF0d-ycqdtOjNoLSKPHqfyNvkeyKWlyKwEd2kieG0XMwEczgsirFZa&cry=1&dbm_d=AKAmf-AU2QcFUkMDNEv-TwOpEkw4oGiwi33QrASmOPRS23L0H7B7EgouloUI66KGtOeWlp4Hovd_mMoShyVB7EnfEUdJEOvIT6277zZE7Eqn1PTZ57KawsHvpta_GaP_RFeZBdldvn9JDuBZzYEGlDlFFO_hgveCR5AHrOiMXSfn_7K2So4NZu_IKOfIDE8SGhLjWuxyAWnzy4TcI2PbS-jhcVnTH0L47RKXsnEgw16VMOAFMoVWIShrIg1zPOo4EQc5CsKLHopG7cSdYI_z81-1gi0ubTm9XPLefodZfKync9GiES8Fp9Gzz5V0E4fhPWQVzzn6Ks2OyIK01IhN-ojgvBVqILnxK_c8OTQWkXZ4LrcMxUsNI43MJYJPg9QV3FyWB60Ri8-LMoS3SfMHJoJnE4i5KtgyH2reTKKqfq-xn-Pj6EGvdMCR827ixEB3H8rlnWhpETvEZAASYs9WW3B2GrsDXSApRUcRFCUVWloMT5cPJwRI-SFl0JShAakMeiOusOTwF1oRML_RhhYF-q_LwEDkYLtoONgY20Wb6FClosdDluxWHIHc5UHkIN7chT6Hjzimtzr4HGFFX2m1HUxlJAQQZERiXCWhbN7rnIwGe16HOT8w6YmxDlZ3EdXzIHwlY2iM7XMv7fOaxaCIyitpy1uu4p2GwnRrSkEVgBBjbCv7ekCIheTFBAF1MVPbwQUVqJ-ZMHdSv4TmKNxKO3leGS9t1VGEEmYoz954hEe0MwofGJvjBT7BbilUmBh58HxPJTy2M3CNtTS4lNiiW0or4DNCHwIeQh9Ec43geKjFpWsUOoE0GyQO3idpfYUeeRZ7YHlQVvr8CAsitvBmk0YSZvEfhy71n5flVAnA8qvMEDr9TPkiAEIaz0911MFbdJODtrFtA2UKJZ851d9TAy4lu2dMB_IMoseRb4hnuTmviku3wFbX9zY4-tPF37meTV5kv3pfPXYdh0ajzosbNxPnv2mf-C3FwFUvHUsXFmB503Vb4tFwMDKWzhYhmbkE2xOwdARmOcKxInEOGXZdc08uhm__Skc4z1B6do-cYabaTKqS1vA01eE17ayaptUEv7PSEKCloGXK46ALXsaSqZ3pLJ5Vq3zykGOE04RktS75ZfLgV0eUz-rZQ6sSSduuAm96LewNq5JwZnkd4V80EpnE9QhUmrr7AKorZP-QyS_eyMudm7pdsnzs2nSEHgPzzt2cyr4phR9UywX1-ME-phnHGX6IJFGlx3JCx7VQEHQGirIOEdCdbo5WjYpSay-bwwzU0PZ3O7-GzOck4_qM5HJzyXiU0h7KM1OGGlpn8OygovWdCWQp-65XZkhOR5nSm8FEdCGGIehSRcGmMObURIriMihZjTQBV6veIljzUvPTNQWoCrdOEooT6gTaljCrotO0OQLXjVIF-z2d7g25C2Z-fsNG3YeJxKzjYiEKPLjFVuYECCDKKIYAopaApzpmAcQ8k5pck_0gJAEHFiLxxE_zeVH2EIMKgybwxSmtPUyfKaz3crR4mTes7_Ckg-FCbgYZMIKF0rO397Jibht1NxtnsedCQukkv98gxMMrlgNPBMD4Jd9gxCu9B-FVsoc3P6hVINZnw_4hphszFLETZrNtyS030mLUO0f9kOlcxhHeZeZ9ZXIOn5yngwewxiY8hOId6Pgo5ROtbkeBF6oCk1wGcHvCYQFvjwXOO204lRxaKeiwhOwedZW9DZWlIqb5E80xpIju1KEBrTMXnI-m-slzJMX6Mq7oIuM9pMbUeiopsDsUx6wLYxMlSpPbddhrSIYdTYcfaALkMwIt0_qgh2_lArctvaXV0vIzC51rdbN0vNo30M_w6-r3njJOIl4dEulDrFlBdD-uYN1B4cWDFVv6us92TdlreLwFv_gBcd8alR1KAEWWgOgZ7XDLi1i9nsPPEotgW2vizWZ11QBSu6mArzuFWrywzGymMdO-_aHm_B0t_yM5IlW6_w7-7iFBj3UrEGxKhtXzx6CwVvhC87wPTIMX6HbtOJ4VDMusUtM8Z3u9TlaBkyqfsWNMd30dTHtlapiZAC45K3Gy3sA1fMNmHMJHAHbjAj94WI4NZ3q56_TEUaEvVKFr3gJjArxLvEnCM_L8ciUltYulWI83XLRoixGxuoUP60oCKObCvYk1yXzS_YHMXYO_1GotC25D5zCsbIEvks_MU7UwrzkEQ8cGoR9mvp2dJwZ5-rIGCiimUkqG1mponO1HcFsJjc4J3xYSgypBez6dOOsEUWm5UayErtRIBOAyypIbpDycQEhg0mTtiF5EWmWGc74b3PCKLlQQHdSu1yqUrPc3LxMHmdGBxRk3l0Sg2yUQZMtSEqmvUGcZ2YT35XUa4iufZHXz_T2IWAJoeI8TOHaSo7buqOYp9ZP5eNUrMt1FCSBgq2XVJk6wHX76VSnIGoI8yE_ZulJl3KEeCsmicHlgwklUoGDrmFrjFYotV6_V_IA8dkJW5h75GRbSOaP3auw6k_f2ujh7jVPUNU5jHeiieRDENDyUaHFk4cSow_CXYW7WcC8hieZ3fAXTglM2iQV2vGoRFAcI6cC6UWmEBmMUpBztrh7zClRfJTGvrmcbJIBIYRSTFrLJu29SOtyLbu9c1ZB1wAoVhQ0NebTlxf6G44ylCN1TaogMX-onoxidD0VIoKqmEHzEkwMHd2BGSua8Lg6WreHi__2eDu7iQCEMhDQqjsMyJypOX8O7a-rc1LgX2Ue1l_Zcbgip2L48UVK-aTfsHi44xcWoZztYfEAMSdJhzWfxUf1ayPx4YcWK_44a5YiUXZJHA0tae7OXWhHXZQ2RpSoOVI41Bfh-BpTcwWDKQdhl_bfBYUJ5mQOfKrhnhhaQg21h8-w2wxnRwaEe3XxxR1_ASszSx8OuxgChQi39iTgw7ODO5MWrGYfs6jgSmury0-UZd1E7vVUaQjCu0CFEj1lsxPBq_0ux58YUHdCIY-uPjqCgeq58ePs74jMr2tVYDZ6bWQagZLv9RYHhFQ0LHVKz7FLLa6NIst7LJlfcwIj1J8KzTS0zoKQWK0wPLNBLEwotDb7OamRQZBbOVDBwUtGbD__HXY7MU9uLCzC_WxSm0B0az5Xz466iGGvQRU7YGmkACFX_8ZebEAcuyFUM0_Qoj-EHo_3RzzGSAx4NyiKnNl2_vbku03MAmftqRvZkxVHBGrvuCAxf2sgxNXC-41dbdNUcK2eabnbgP0R_jYQs2HSevritgFaVjTAIhS_UWyFatsv75hHVj539VgTBMhMt1KC6uFLlYmtDOnWg5MwG6oeS3iR9i0pUzM29kkY_Y6uxEwt385FQYNscdezfSrnLmGreWz8efjOljFI-Bj7dhB_jKGIiY077Srww41BY7KMTqleu2xJJ1MRMvGq6M5hRlneTS5bLHBFLc2lmjKMbKXLJT7Ua66wMTqwjTtHR2iTHDG6Qm8C_G5CP5UzsxSQMgtd1Fht8vOXfx3ZdfwzykRSqhySM54DOH_HcukKitFphrySfca9rzHngQy2QfJh7g9LOGUKKE24U9qLKldUnlUbpmMxKeWAoaHvKmL2we9vL0rfwUhbTtx4ta_yu7K8mJrq2vUeedob-IqbS8suUPw5d7ty6BWpInExQ0_LRWAUBpDuOtBeW2QYpHTEWHl8FgK73-9B55LmKJajKjCDe3ExjoUJegkwYT1igL2HG9PRmQHTCEtj4oSpYoVqGfWc_k_GRaFH0Vm5-_ZXGhwSBBF_yL7gLLxJkH8kH-_MzGx3H64O8uIfLjxLZ2Q5RTHoZjXke_L6_9M9zvEEKW6Yqi5X5_uDlR0Bm_zqetTl3QvN3_s2pnNQtj57R8QS4crPMD5iwI5IscZ-SYywUC_CO1hrpVPF1bdysazltMoLkjFrEiyn0eQFC5wvMBZZfp3UpL4af_T3Dydgglyv5bORkQmaK1K9R6lE6OSfzo40XomllwZ-BjdokLwapAx1qXKQWkVE9A57eO_fm7KbGgAcavEWb9LafzBumegiTD8V4O-itbnIq2PU1LZ0AEBNUUFlqQGn01_A3&cid=CAQSTgDICaaNmtiSFOjEXlNnwiMGMWf6jtMj5Wi97nPxB0ffDvc8KXZWQ1PwwxS6wRJ7jybi067IFx8LTojl3fIGREB3M2c3y-tlAJyFsYFIdBgB&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=5645082388650423000&adk=206653492&idt=90&cac=0&dtd=36

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25317
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 07:58:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 4D5E 31 KB
12 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:40:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26417
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 07:40:32 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 4D5E 41 KB
14 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: m.foxwebapps.com
URL: http://m.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25317
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C717 1 KB
644 B 21ms
14ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62636
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4D5E 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: badabddec939bae7d8f45d24f6d083ab3c6daf56c50e7e021b7e32facdda0773

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C717
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELuU39aFp8Y-GBpoTzYNW4A&google_cver=1&google_push=AXcoOmRduhUlFkqw0izjThbWBb39YujRfnznOm8rqG-8jIOM46rpF6e1qf...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmRduhUlFkqw0izjThbWBb39YujRfnznOm8rqG-8jIOM46rpF6e1qflOXvYU06L5i0-I5B7ovhxQU0IebTnj843uItZmYHG5&google_hm=X7NoGNhe7v9v...

170 B
188 B

27ms
24ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmRduhUlFkqw0izjThbWBb39YujRfnznOm8rqG-8jIOM46rpF6e1qflOXvYU06L5i0-I5B7ovhxQU0IebTnj843uItZmYHG5&google_hm=X7NoGNhe7v9vDibKhEgDAA

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmRduhUlFkqw0izjThbWBb39YujRfnznOm8rqG-8jIOM46rpF6e1qflOXvYU06L5i0-I5B7ovhxQU0IebTnj843uItZmYHG5&google_hm=X7NoGNhe7v9vDibKhEgDAA
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame C717 43 B
568 B 208ms
206ms Image
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEPz28XhpH028QZ-mWVw5PJA&google_cver=1&google_push=AXcoOmRGmcPjkTmsCJ_UFadgxZDM1b_cpwEJgJM8qdkSE2tng1uPvTEeNalcrHqXQj3U3CL1PyGD28tNuovT8jMeoj7cVZADPII&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRGmcPjkTmsCJ_UFadgxZDM1b_cpwEJgJM8qdkSE2tng1uPvTEeNalcrHqXQj3U3CL1PyGD28tNuovT8jMeoj7cVZADPII%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cdf4ab54bbf2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C717
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH3hduNiSukvdbq7AW3XKzM&google_cver=1&google_push=AXcoOmRUTBJ7afH3iNi3XruaOAxFeFmaSkLuVpSu705gKjxqMG7KY18cMCoEYCxzqcWtzB5azRBGE4TBXY7cvktXBf7CT6Q...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRUTBJ7afH3iNi3XruaOAxFeFmaSkLuVpSu705gKjxqMG7KY18cMCoEYCxzqcWtzB5azRBGE4TBXY7cvktXBf7CT6QiCHNn&google_hm=eS1BbXdyRXhGRTJwRUJ6N3...

170 B
188 B

28ms
27ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRUTBJ7afH3iNi3XruaOAxFeFmaSkLuVpSu705gKjxqMG7KY18cMCoEYCxzqcWtzB5azRBGE4TBXY7cvktXBf7CT6QiCHNn&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRUTBJ7afH3iNi3XruaOAxFeFmaSkLuVpSu705gKjxqMG7KY18cMCoEYCxzqcWtzB5azRBGE4TBXY7cvktXBf7CT6QiCHNn&google_hm=eS1BbXdyRXhGRTJwRUJ6N3dVQVFKVHdCXzNoY0dDdVBFLn5B
content-length: 0

GET
H3 200 dds
rtb.openx.net/sync/ Frame C717 43 B
58 B 23ms
22ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH3uwK5nHx8iO3mYwRAGGdo&google_cver=1&google_push=AXcoOmQ5ntVJBxbyHBazkJk-0Umg8NXixryBCZraqLJ8rtZHDcp381JTKIDTpAT9zU1C--dws_GC44cgbXUVQ7jmGbDW66yo8U4
Requested by: Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C717
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJWS44H1Qi7bIzWeyfiJK04&google_cver=1&google_push=AXcoOmRCkBxUnHw7akI3JjIcFZP6FuWcW8GNlfGJ7JbsqHf7iJm2ndBvsWHQ5h0xRyRPnUzBaF1KwXv2ZMkMqTQ...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmRCkBxUnHw7akI3JjIcFZP6FuWcW8GNlfGJ7JbsqHf7iJm2ndBvsWHQ5h0xRyRPnUzBaF1KwXv2ZMkMqT...

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmRCkBxUnHw7akI3JjIcFZP6FuWcW8GNlfGJ7JbsqHf7iJm2ndBvsWHQ5h0xRyRPnUzBaF1KwXv2ZMkMqTQGVWquUXYq0II

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ahGjWPxAUa1kWs2TPT1hcbKi0YM&google_push=AXcoOmRCkBxUnHw7akI3JjIcFZP6FuWcW8GNlfGJ7JbsqHf7iJm2ndBvsWHQ5h0xRyRPnUzBaF1KwXv2ZMkMqTQGVWquUXYq0II
Date: Tue, 21 Nov 2023 15:00:50 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C717
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAa6ygZgWoof6SWqNIVA928&google_cver=1&google_push=AXcoOmS1165-jjcuhCh74k512KVSKr4AgThlQ7VfIdouprNXXmAL3QNE-xP0tOoMeEro0QlE2O9...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FNTEwtMjEtQ1FSQg==&google_push=AXcoOmS1165-jjcuhCh74k512KVSKr4AgThlQ7VfIdouprNXXmAL3QNE-xP0tOoMeEro0QlE2O9w4hX3hyB20NeDZtN9EJUGvz91

170 B
188 B

29ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FNTEwtMjEtQ1FSQg==&google_push=AXcoOmS1165-jjcuhCh74k512KVSKr4AgThlQ7VfIdouprNXXmAL3QNE-xP0tOoMeEro0QlE2O9w4hX3hyB20NeDZtN9EJUGvz91

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FNTEwtMjEtQ1FSQg==&google_push=AXcoOmS1165-jjcuhCh74k512KVSKr4AgThlQ7VfIdouprNXXmAL3QNE-xP0tOoMeEro0QlE2O9w4hX3hyB20NeDZtN9EJUGvz91
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b71bced807741b20dd93dce6c2d26405
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C717
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmS9GMQproVLKrwCSm5OJnZfiHl6BaIc9...

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmS9GMQproVLKrwCSm5OJnZfiHl6BaIc9lyO_pD5OQ8mHIqzK-lYHb8nBZNL93VihhtVm5Di_3x9sqQ8Nq5t5LtIbHoZF7bu

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q7n7TxJYyttUz%2B%2F1bq7W%2BVJKZfeqom%2BJmG7F4KFR66%2BmBeOgy%2BIU6jCJ5Wq78wmawpnzutTyL8Yx1QMnOkG1%2B09gXIQmz5%2FmXPqFBRSez3uuK3lGDmAUGtDoleBind7yLD4ww2tndReoMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEvBuRSSJw5-LFIT9GWhxOQ&google_hm=ZVzGHfDEca7cqQE5fhiFpgAABFQAAAAB&google_nid=index&google_push=AXcoOmS9GMQproVLKrwCSm5OJnZfiHl6BaIc9lyO_pD5OQ8mHIqzK-lYHb8nBZNL93VihhtVm5Di_3x9sqQ8Nq5t5LtIbHoZF7bu
cache-control: no-cache
cf-ray: 8299cdf4adf21e64-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C717 0
12 B 24ms
22ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LTI9dK2vIpHckIxRR5okJYS7pkX_aJ2HEtJZsXUng7nOefLAUBoCU-UfnYnRXJ88cd-fIG

Requested by

Host: 65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com
URL: https://65b033a4cbaa669c29ae19c53ab8f978.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS