wheregoes.com Open in urlscan Pro
2606:4700:3035::ac43:b70e Public Scan

ns31533571.ip-162-19-138.eu

Software

nginx/1.23.4 /

Resource Hash

b5f7925976aee47e576911bd49cb4b99df89f2e47254fb257a7f435e7d335a1d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:22 GMT
content-encoding: gzip
an-x-request-uuid: 7a947509-7e98-43ca-9486-bb25490a1f28
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
192 B 98ms
56ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=7.54.0&cb=7068591198&lsavail=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://wheregoes.com
date: Sat, 04 Nov 2023 03:17:22 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 adreq Show response
ads.servenobid.com/ 98 B
420 B 109ms
35ms XHR
application/json 54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=7871
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 314c310cb579bc2f5543ad8b9148f7ae616637d6d58f486eb72fc244bdd058f7

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 9 KB
5 KB 656ms
264ms XHR
application/json 63.251.14.14
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS: 14.14.251.63.unassigned.ord.singlehop.net
Software: /
Resource Hash: 8fca382d8f0d628d8068b222b8bdae34af75938f14468fe34e2665a63de91dc2

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 04 Nov 2023 03:17:22 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Transfer-Encoding: chunked
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1sea1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
410 B 29ms
8ms XHR
application/json 51.75.86.98
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.75.86.98 , France, ASN16276 (OVH, FR),

Reverse DNS

ip98.ip-51-75-86.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://wheregoes.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 29 KB
29 KB 133ms
112ms XHR
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 3ad375ddd8e8fea54d1c9fe2e0cdc0adb16f9121b26f72dab07dd4b0ee7e9dfd

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:21 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 96
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 04 Nov 2023 03:17:22 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 433 B
773 B 361ms
249ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=6aba413e-4b7e-4017-9a1f-9ed28c7bb280&l_pb_bid_id=422f41f7c37600f&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=6aba413e-4b7e-4017-9a1f-9ed28c7bb280&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&slots=1&rand=0.35827953605743135
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9d8b057b64632d3cafdfc382d9182cf5ff45bc295a0b3f1da22f4e3c429d52dc

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 433
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 411 B
922 B 205ms
93ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=6dea9594-94b4-4564-b7ca-107941dd247f&l_pb_bid_id=43ba1f1698a9feb&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=6dea9594-94b4-4564-b7ca-107941dd247f&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&slots=1&rand=0.6457172070647246
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 7e8a8a6b973ec087a75b2a722cd42d7dbfffb4b2d18bcd3dc1e0b5063a4f2331

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 411
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 442 B
782 B 218ms
106ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=9d6729cd-2ae7-4529-9067-fbc5de3b00e1&l_pb_bid_id=44c02400aaf556e&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=9d6729cd-2ae7-4529-9067-fbc5de3b00e1&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&slots=1&rand=0.983004095651008
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 5886a435adf9b42449fb59326148dfb1c1ae8d3fdd0bcdc8883124afcac98d2e

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 442
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 52ms
24ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx
etag: W/"653b5c0e-a9a7"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Nov 2023 03:17:22 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 29ms
6ms Script
text/javascript 65.9.66.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:49:12 GMT
content-encoding: gzip
via: 1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 77273
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: ncqjFl4yRutnhOugjJy1OxXZh2wzhnlveLw-bfySfzfcX8Ril_prrQ==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 42ms
7ms Script
text/javascript 2600:9000:2250:2e00:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:2e00:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Fri, 03 Nov 2023 08:28:15 GMT
Via: 1.1 b3bfeb8eb7405a05775de8861a4d117c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P2
Age: 79348
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: vTLws0t0anOg_WEPyT-sO2O_Gd32lpn9b7Oo7taJTCfKlrgVgnw_6A==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 28ms
7ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 18:17:52 GMT
content-encoding: gzip
age: 896370
x-guploader-uploadid: ADPycdsxLlKLCVb5W3Djj1V0MEZiayMLPqEhV9H3fgXZaELS3ccW0PQo2-GKz1rWI_UNhL9w3-cScigVqDHesSZuOcxycA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Wed, 23 Oct 2024 18:17:52 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 143 KB
31 KB 33ms
18ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fab57543f51269755c854c09e1a361e6a3c04ae97b28b483ae00f13de630e9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 24 Oct 2023 08:11:43 GMT
server: cloudflare
x-amz-request-id: JWJDAN1XR6GATQDQ
age: 3384
etag: W/"8a9ad568d94062c0186983f6aac0be50"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8209b41d3c0a3a60-FRA
x-amz-id-2: Ef+zRSY5m1l5O/qNEP9qXrov5kpci+PWBE+duOZn8RfWRfK8fxpzs/23mChcD+sxFKSVyfSeJCnE1vDWU3gxhg==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 28ms
12ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 33194
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230091-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BYxBOskFGHVgtaWJhOETG6dNt1P0BGii6w%2BmxNDf4W9Yr9NclkpgaXTOa1zVhmiju5hg%2FZ098zmwH%2FnMX%2Fa645U%2FpFJXdwDL95835yJMrwbTtIISf%2FwgOP4195TpMNHI9Y80DBgiIMfzv6BFAXk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8209b41d3ae86909-FRA

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&rid=esp&cc=1

85 B
203 B

120ms
118ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&rid=esp&cc=1
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 8cead9783c150de9c6c5e89b3fc45614f7f0039600944b0cd33220dbc6d6b191

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-PyLol5TkGi/snULHAGCTWZ986VM"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Sat, 04 Nov 2023 03:17:22 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://wheregoes.com
location: /esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
331 B 111ms
30ms XHR
application/json 34.249.63.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.63.196 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-63-196.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2648e1e256559f4644c7055b9ae1c5416a560cf9f488b720a28f5d465f99aea1

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:22 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache
x-server: 10.45.20.2
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
229 B 36ms
8ms XHR
text/plain 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://wheregoes.com
date: Sat, 04 Nov 2023 03:17:21 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame D84F 15 KB
6 KB 45ms
13ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 04 Nov 2023 03:17:21 GMT
server: Kestrel
server-processing-duration-in-ticks: 291909
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/ Frame D84F
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=rVnrjHxTWTVKZmhnOFUvUWdUMVpCeVI0QXpNMkIvOTlGR3dBWDJnekdWOWlRNCtvUSs5N3RZcUtCV3NVMEVaZ3R2M2Z6MWJKa256U1FnNGFnd1pGdEw2aG5GQlg4Tm1rTlUzZTgvckNsd0RQVkZSa0RRVW1qVmhYZElPZV...

428 B
654 B

15ms
15ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=rVnrjHxTWTVKZmhnOFUvUWdUMVpCeVI0QXpNMkIvOTlGR3dBWDJnekdWOWlRNCtvUSs5N3RZcUtCV3NVMEVaZ3R2M2Z6MWJKa256U1FnNGFnd1pGdEw2aG5GQlg4Tm1rTlUzZTgvckNsd0RQVkZSa0RRVW1qVmhYZElPZVZQcXBCY3B6Zy9LN01ETllQVDgwdmZaUnNRTEdsZ1pKS2twdmsrZks3VHl6VHJEb2s1Nm55ZmpleGVXeVp6T25oa0k0dXdEbnV0T0grVGpqYm5YNldmRE8wK1NYSCs3MzA2Nk8rZmpJVDlKbW1zeVdoUGxZNyt1dGQxSW9NRUJKQ040WkRZL1JtSEVBYmFnWVlMaUZqM0p0Q3dqallVQTdvUHVZakRNbm1UT3hKY2JIRlhlTT18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

9415136fa1a57f90b51f2bc37909e2c09c3639def77a5b29b218ad2e378eecf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:21 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1672576
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:21 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=rVnrjHxTWTVKZmhnOFUvUWdUMVpCeVI0QXpNMkIvOTlGR3dBWDJnekdWOWlRNCtvUSs5N3RZcUtCV3NVMEVaZ3R2M2Z6MWJKa256U1FnNGFnd1pGdEw2aG5GQlg4Tm1rTlUzZTgvckNsd0RQVkZSa0RRVW1qVmhYZElPZVZQcXBCY3B6Zy9LN01ETllQVDgwdmZaUnNRTEdsZ1pKS2twdmsrZks3VHl6VHJEb2s1Nm55ZmpleGVXeVp6T25oa0k0dXdEbnV0T0grVGpqYm5YNldmRE8wK1NYSCs3MzA2Nk8rZmpJVDlKbW1zeVdoUGxZNyt1dGQxSW9NRUJKQ040WkRZL1JtSEVBYmFnWVlMaUZqM0p0Q3dqallVQTdvUHVZakRNbm1UT3hKY2JIRlhlTT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 255650
content-length: 0
expires: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 979C 0
167 B 43ms
17ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Sat, 04 Nov 2023 03:17:22 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 96 KB
17 KB 62ms
62ms Fetch
text/plain 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1394095844482027&correlator=3150995167448764&eid=44807410&output=ldjh&gdfp_req=1&vrg=202310310101&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=728x90%7C970x90%2C300x250%2C300x250%7C120x600%7C160x600%7C300x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1699067842786&lmt=1699067842&adxs=436%2C1091%2C1091&adys=440%2C666%2C950&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&vis=1&psz=960x267%7C300x952%7C300x952&msz=960x90%7C300x250%7C300x600&fws=516%2C0%2C512&ohw=960%2C0%2C0&ga_vid=2026436825.1699067843&ga_sid=1699067843&ga_hid=1172298373&ga_fc=false&dlt=1699067840956&idt=1090&prev_scp=optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size%3D728x90%26hb_pb%3D0.01%26hb_creative%3DS0300080711068000728009099999900%26hb_adid%3D46b9a4a24498b58%26hb_bidder%3Dmedianet%26_bd%3Dbid%26_pl%3D0.01%26hb_size_medianet%3D728x90%26hb_pb_medianet%3D0.01%26hb_adid_medianet%3D46b9a4a24498b58%26hb_bidder_medianet%3Dmedianet%26hb_size_appnexus%3D728x90%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D48c8d5caee06355%26hb_bidder_appnexus%3Dappnexus%7Coptimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%7Coptimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size%3D300x250%26hb_pb%3D0.26%26hb_creative%3D409_59839%26hb_adid%3D50b19e6f4dc1001%26hb_bidder%3Dsovrn%26_bd%3Dbid%26_pl%3D0.26%26hb_size_medianet%3D160x600%26hb_pb_medianet%3D0.01%26hb_adid_medianet%3D4706722def7fab2%26hb_bidder_medianet%3Dmedianet%26hb_size_sovrn%3D300x250%26hb_pb_sovrn%3D0.26%26hb_adid_sovrn%3D50b19e6f4dc1001%26hb_bidder_sovrn%3Dsovrn&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&adks=1696759606%2C2861055222%2C3809685794&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6bae72ff3a4bfb3920b38ed0cb62f26c50218ef2e783793bec535dd86f6dd1ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17457
x-xss-protection: 0
google-lineitem-id: 5936457971,5320060794,5936458034
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138383349304,138305489837,138383350381
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
13 KB 52ms
31ms XHR
application/json 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202310310101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1b2e7c56e6a398ee5400ed7cb83974ee018b38fb1e57d5f4aa6f1d94dd18710

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12672
x-xss-protection: 0

GET
H2 200 container.html Show response
f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C714 6 KB
3 KB 48ms
14ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 04 Nov 2023 03:17:22 GMT
expires: Sun, 03 Nov 2024 03:17:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 42ms
21ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 04 Nov 2023 03:17:22 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EBCE 0
0 46ms
45ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstTrlH0y5VARtORfiqAuXvir8FBfp8tX4OwS1AWLHqZ09gbmJky-Wx6_wn4iVe-Qh7ota4RTZ5gqZHadNIrH65ZDChCZBIcPwF1FRibQgpYsJesovpWmyoUaHvsu3hKLGy7Pkon7ruEmXYH0EhG5Z6mf2AYNy70OWo0hMBffJ3N64xaTguLtHuEj6U1zT1ummxB0CZA3tHWRYctb-qgEVYSeEIa1bQNGY9tlm86a2OsBUvtxU8wr2vztHsZj9bBqpNYLJtu7zmbNSIdqtYL1246cEwoIiq3AKiycDBDghoKKFeALt9oncwG8VqjerLyuqTcQwr5jIC35ZJ4vqiVds-fapmnmguC9mrl&sai=AMfl-YRazSsnaZ4z9BbM-BJPZcPJZfubfn0mGJiBm9iqs7CK5ZJlRadT9fNcxfK7e0HFan4PJ6lMzyC_-Vrb3eNVpQBDk9vlSb8mqim8nhg4xAE4LMfjvLHwMivaJl_Eb6WjWC1sGAffXCWuT34lXTU&sig=Cg0ArKJSzNd0SiOVWF1tEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 04 Nov 2023 03:17:22 GMT

GET
H/1.1 200
OK prebid-universal-creative.js Show response
cdn4.buysellads.net/pub/ Frame EBCE 26 KB
9 KB 24ms
24ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn4.buysellads.net/pub/prebid-universal-creative.js?1.13.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: eaf67431972d3e9d0888a562c64f1e353894aa5fd5c38afaad32003404c2f467

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:22 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Oct 2023 15:14:17 GMT
Server: AmazonS3
x-amz-request-id: K5PABSNYHECPJNPF
ETag: "1434442cdb6e9dc726253cc948d8c50d"
x-amz-server-side-encryption: AES256
X-HW: 1699067842.cds207.lo4.hn,1699067842.cds287.lo4.c
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8909
x-amz-id-2: 38Tq3Z4F78GAKGz4VDCh2ZKdNziQZXLadZEiN2ZY/V8g3ex3vYgVBd/tcp0HWN0Sbbjy3L/Dc7c=

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EBCE 189 KB
60 KB 1895ms
1874ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60699
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698838693892887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Nov 2023 03:17:24 GMT

GET
H2 200 container.html Show response
f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 19F0 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 04 Nov 2023 03:17:22 GMT
expires: Sun, 03 Nov 2024 03:17:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7205 0
0 44ms
44ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuoXOO8SaZVgB3OMK97QGlBsppUzWojJ2Xut-lLnpir9JHKZMDBR4W53P8Qec1p07WrU6GF3Cah_pxn18Ei1bZ3LtDrz7aTKV7_HpevhNyS0gWt7mDjQIjRkpD_shlnW3mjTvp3-D9JXksytS6RI_F3WRZaJPYFyFHeLB4mMx_Y4ccV8pwqnqnRIPzHPBREv9HuGkRWm4ehAP6mLH_qfnE6Cerw1lYySbX4GWSrXIMrWzvLXdNdSgB365FjhjWHyM-oAvEtyoN7byB6i40gWwi-Ap86snzcqMNneBZMoqaXSykTMCLLyPhWCnVeRONoTckR1aHl79hMSLqj8A1DdWdKvs70kpOaklBKCddQZuc&sai=AMfl-YR6f4wGv8-hmW670rbdh6LiOvcrnkeaBnJfn2LllvbLT18otD0cxyAjSnvzovsvABpvskkytO_qH1vBxEg4O4GplLSrE05IcZ4BVErnWYHxrfiyNHiUhmyVt3-IdHMMJY7fMvAkyv1AJZn-eRo&sig=Cg0ArKJSzJdsCXEHUVqXEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 04 Nov 2023 03:17:22 GMT

GET
H/1.1 200
OK prebid-universal-creative.js Show response
cdn4.buysellads.net/pub/ Frame 7205 26 KB
9 KB 32ms
24ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn4.buysellads.net/pub/prebid-universal-creative.js?1.13.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: eaf67431972d3e9d0888a562c64f1e353894aa5fd5c38afaad32003404c2f467

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:22 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Oct 2023 15:14:17 GMT
Server: AmazonS3
x-amz-request-id: K5PABSNYHECPJNPF
ETag: "1434442cdb6e9dc726253cc948d8c50d"
x-amz-server-side-encryption: AES256
X-HW: 1699067842.cds207.lo4.hn,1699067842.cds287.lo4.c
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8909
x-amz-id-2: 38Tq3Z4F78GAKGz4VDCh2ZKdNziQZXLadZEiN2ZY/V8g3ex3vYgVBd/tcp0HWN0Sbbjy3L/Dc7c=

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7205 189 KB
59 KB 1893ms
1888ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60699
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698838693892887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Nov 2023 03:17:24 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 19F0 24 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 11:32:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 229480
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 31 Oct 2024 11:32:42 GMT

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 19F0 8 KB
4 KB 8ms
7ms Script
application/javascript 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1481931694&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%2526sai%253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%2526sig%253DCg0ArKJSzGT4LrEpgnsZEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

97282e6b0cd82ea2936f88ebaf392fbbfcde9fbbf36045edb005ae5edd4730e7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:22 GMT
content-encoding: gzip
an-x-request-uuid: 4781eb66-0385-424c-ab5b-bb10f4a8ddc9
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 19F0 189 KB
59 KB 1879ms
1879ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60699
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698838693892887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Nov 2023 03:17:24 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2B8E 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 49042
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 13:40:00 GMT
expires: Sat, 02 Nov 2024 13:40:00 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame BF36 829 B
1 KB 38ms
16ms Document
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7397042475868f1a380131c6975803cc375796d4745bcc7342ddd846893535ef

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JMkcJB3xtEOkLEQ1fSY5hw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-JMkcJB3xtEOkLEQ1fSY5hw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 04 Nov 2023 03:17:22 GMT
expires: Sat, 04 Nov 2023 03:17:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame EE7E 94 KB
36 KB 65ms
24ms Script
text/javascript 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

2ceee16adb5118f4d4c3434acc8f147a4ec88685eda1199693f4505257460176

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-mnt-h: 21-g4dd
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 04 Nov 2023 03:17:22 GMT
server: Apache
etag: "bdebb6ae0cbb5d9b216dc0d21e91bfce"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
x-mnt-w: 22-s1v0
timing-allow-origin: *
content-length: 36386
expires: Sat, 04 Nov 2023 03:22:22 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame EE7E 35 B
296 B 85ms
19ms Image
image/gif 23.216.77.21
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=3ec8adeb6e05a40a307ab37b5459ba5d&algo=unison12&bdp=0.0300&bidfp=0.0000&capd=0&cc=DE&cid=8CU18831I&crid=950152417&ct=frankfurt%20am%20main&dc=eu_be&dfpbd=0.0144&dn=wheregoes.com&iwb=1&ogcbdp=0.0200&other_bids=0.02&other_prv=459&pbshr=100.0000&prdp=0.0144&requrl=wheregoes.com%2Ftrace%2F20235212457%2F&sat=0&sc=HE&sc_pvid=459&send_erpm=true&server=1&size=728x90&strg=harmony&totalTime=1895550&ugd=4&ver=9.6.3&cliIP=764254208&time_stamp=2023-11-04%2003%3A17%3A22&seat=BID_API&itype=prebid&req_id=010a697c-7569-4c1b-ba5b-e9f972154d79&dfp_bucket=0.0&level_base=0&bdp_bucket=0.05&app_type=prod&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F119.0.6045.105%20Safari%2F537.36&br_ver=119.0.6045.105&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&model_key=generic_prebid_1-cid_3&ogerpm=0.0300&ogerpm_used=false&rawbid=0.0200&totalTimeBucket=1&as_cache=1&sub_bidder=196&current_day=6.0&current_hour=3&cut=52&floor_bucket=0.00&model_version=202311022024_generic_prebid_1-cid_3&erpm_bucket=0.05&mul_ratio=0.0000&dmm_m4=0.0000&ogerpm_wd_bkt=0-1&visibility=1&viewability=0.4800&stid=bsa-zone_1641228026595-4_123456&pvid_seat=459_BID_API&ckfl=0&mnckfl=0&sd=-1&predicted_wr=11.1896&bdp_wider_bucket=1&splid=bsa-zone_1641228026595-4_123456&dim10=false&dmm_m9=0.0000&log_less=false&cut_bkt=50&advurl=generalsearch.net%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=1&url_l1=trace&url_l2=20235212457&clisp=rtb-common-64568487bd-twxx7.BE&dmm_m1=2023-11-04%2003%3A17%3A22.210237659&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=1600x1200&ss_d1=1600&ss_d2=1200&dmm_m22=0.0300&adtyp=0&gpid_format=DEFAULT&gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&gpid_sent=true&pst=EMS&bcrid=S0300080711068000728009099999900&erpm_mult=1.000000&zone=b&rc=1&sfm_key=mowx_System_459&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=3&wsip=mowx-79df6c4b94-wqqqt&rel_cut_bkt=50&djvm=9.5.8&optimal_cut=0.0&cut_cluster=0.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.216.77.21 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-77-21.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:23 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 04 Nov 2023 03:17:23 GMT

GET
H2 200 release-20230927-130-adperformance.js Show response
warp.media.net/rtb/resources/ Frame EBCE 72 KB
25 KB 54ms
16ms Script
application/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20230927-130-adperformance.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1dbd18c0aa6071222d773de0ac1cde277406e857cf0b9c88cbf2035480857bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Sat, 04 Nov 2023 03:17:22 GMT
x-guploader-uploadid: ADPycdteTsH7r2HBpGdu3UnuNAdoXUACFYCgr6hYQRRjKB0Rxa8zCB3PL7QZhXRdyUrJ4FwBNTgpvrqxaV9jYRHPHz-sLRCD81Q1
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25148
server: UploadServer
etag: "1eb27acd7f471c38284a9857c37daa7f"
vary: Accept-Encoding
x-goog-hash: md5=HrJ6zX9HHDgoSphXw32qfw==, crc32c=3FtsVQ==
content-type: application/javascript
x-goog-generation: 1697195146284262
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Sat, 04 Nov 2023 04:17:22 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 84ms
18ms Image
image/gif 23.216.77.21
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=010a697c-7569-4c1b-ba5b-e9f972154d79&cid=8CU18831I&crid=673699537&adunit_count=1&dn=wheregoes.com&requrl=https://wheregoes.com/trace/20235212457/&istop=true&event=client_bid_won&value=0.014&rd=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.216.77.21 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-77-21.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:23 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 04 Nov 2023 03:17:23 GMT

GET
H2 200 log
hblg.media.net/ Frame EBCE 35 B
191 B 45ms
10ms Image
image/gif 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELAQCAAABAAAAAgAAAAAAAAEABgAAQIABAAgAMNAATjc0MzcyNDIwMjI0MTEwXzEzNDk3ODMwOTFfOTUwMTUyNDE3NDU5MUAzZWM4YWRlYjZlMDVhNDBhMzA3YWIzN2I1NDU5YmE1ZJYHexSuR-F6lD9QaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjM1MjEyNDU3LwRERRp3aGVyZWdvZXMuY29tEjhDVTE4ODMxSQgMNzI4eDkwCjAuMDE0CmV1X2JlDFBSRUJJRAZhZG0AAAAAAAAASECQuq6F82ICMQAAAAAAAPC_PHJ0Yi1jb21tb24tNjQ1Njg0ODdiZC10d3h4Ny5CRUBTMDMwMDA4MDcxMTA2ODAwMDcyODAwOTA5OTk5OTkwMAIQYzJiY2MyZDECYgI&cpr=0.030738661189876115

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:22 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 04 Nov 2023 03:17:22 GMT

GET
H2 200 clog
hblg.media.net/ Frame EBCE 35 B
191 B 84ms
49ms Image
image/gif 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=5833&logid=awlog&lper=1&itypeid=3&itype=PREBID&cc=DE&cid=8CU18831I&reqid=010a697c-7569-4c1b-ba5b-e9f972154d79&vid=010a697c-7569-4c1b-ba5b-e9f972154d79&dn=wheregoes.com&rawDn=wheregoes.com&requrl_dn=wheregoes.com&pid=8PRW23HG5&ugd=4&fleet=common&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&cliIPType=v4&coppa_status=N&coppa_applied=N&coppa_enf=true&lmt_enf=true&dnt_enf=false&geo_source=2&sc=HE&ct=frankfurt+am+main&zip=60326&pubid=pub-8CU18831I&tgtval=pub-8CU18831I&csip=rtb-common-64568487bd-twxx7.BE&dtc=eu_be&zone=b&sd=-1&ptype=23&tmax=2500&xtmax=350&gdpr=1&gsi=0&gpp_present=false&csex=0&app=0&sat=0&screeninfo=1600x1200&asn=9009&sckfl=0&sckfl2=0&usp_status=0&usp_enf=1&mspa_enforced=false&pexid=PREBID-8CU18831I&geoll=false&is_ortb=false&s_city=Frankfurt&commit_id=c2bcc2d1&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-11-03+00%3A00%3A00&pbasrc=0&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&second_call=false&ipcc=DE&is_msnnative_src=false&proxy=envoy&rtttime=95&req_tid_present=false&pvid=459&prvAccId=849523371&prvApiId=8CUWMQE3H&adj0=0.0&adj1=0.0&adj2=0.0&pst=0&crid=950152417&prspt=headerBid&prvReqId=74372420224110_1349783091_9501524174591&size=728x90&chnl=HARMONY&bdp=0.020&bid_uuid=046321465faf1d83c18dba5fa8efda60&cbdp=0.014&og_cbdp=0.020&ogbdp=0.02&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&advUrl=https%3A%2F%2Fgeneralsearch.net&dfpBd=0.014&dsrc=-2&dp=0&dbf=1&epc=849523371&s=1&snm=SUCCESS&pcrid=8CUWMQE3H-849523371-44-8&tpbTkn=false&exid=217&bidflr=0.000&pbidflr=0.000&opbidflr=0.000&spbf=0&viewability=48&sbdrid=196&bdata=sd2%3Dnull%7Eiurl_l%3D20%7Eogerpm%3D0.03%7Evis_sd%3D90%7Erf_cnt%3D1%7Edc2%3D1%7Escd%3Dhe%7Ev_asn%3D9009%7Evl2r_sd%3D2023110321%7Eiurl_b%3D9170.11%7Eurl_tkc%3D0%7Estd%3Dbsa-zone_1641228026595-4_123456%7Elast%3D%7Evis_url_b%3D0.72%7Eip%3DPIJqM%7Efbb%3D0%7Evis_url_l%3D30%7Eriipua%3D0%2C0%7Eet%3D16%7Erc%3D1%7Erps_sd%3D2023110320%7Evis_b%3D801.6%7Eurl_b%3D0.11%7Evl2r_url_b%3D0%7Evl2r_url_vi%3D1E-16%7Eurl_tvi%3D0%7Eurl_l%3D20%7Egcat%3D-1%7Ebb%3D196%7Evv%3D0%7El2r_b%3D1000%7Eerpm%3D0.03%7Evl2r_url_kc%3D0E0%7Evl2r_up_l%3D20%7Ebm%3D1%7Ea3p_b%3D0.65%2C49.48%7Esid%3D4699db585c64000b4b70b68e17dde28e%7Esd%3D-1%7Euid%3D22d5GqPcexShUBD5Y6%7Ebtd%3D3079717639086253627624107760863643492082470851774999129480853838267258865662751186159936771596616077312%7Evwu%3D-1%7Ed2p_l%3D30%7E3pcf%3D1000%7Euim%3D0%7Evw_med%3D0.48%7Edmm_strg%3Dharmony%7Evl2r_up_b%3D0%7Ed2p_b%3D0.96%7Eogd2p_b%3D0.91%7Evurl_b%3D0.2%7Ess%3D1600x1200%7Ecc%3DDE%7Euiw%3D-1%7Ece%3D0%7Erps_b%3D49.48%7Evurl_l%3D20%7ECI%3D3041%7Ekb_uc%3D-2%7Ents%3D1%7Ekb_ccks%3D-2%7Ect%3Dfrankfurt+am+main%7Ebss_KTW%3DNA%2CNA%7Ebasis2%3D196%7Ebasis1%3D196%7EisRef%3D0%7Eivurl_b%3D5%7Eisif%3D0%7Ebid%3D0.02%7Edc%3D7%7Evl2r_b%3D0.65%7Eivurl_l%3D20%7Ecbdp%3D0.014%7Esd%3D-1%7Eitype_id%3D3%7Eseller_tag_id%3Dbsa-zone_1641228026595-4_123456%7Esupply_tag_id%3Dbsa-zone_1641228026595-4_123456%7Epos%3D1%7Eref_cnt%3D1%7EcarrierId%3D0%7Eogbid%3D0.020%7Ebflr%3D0.000%7Edtc%3Deu_be%7Edmm_erpm%3Dfalse%7Edmm%3Dharmony%7Ebdpcapd%3D0%7Edalg%3Dunison12%7Esobp%3D%7Ehtml%3D1%7Edcut%3D50%7Edogb%3D0-1%7Eibc%3D1%7Ensz%3D1%7Etgs%3D728x90%7Ebsb%3D0%7Ebsp%3D0%7Etmx%3D294&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cclt%3D3%7Ctpi%3D1%7Cfl_rl%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100%7Ctpi%3D1&mnrf=0&ortbseat=BID_API&brsrclk=0&bidrestime=1699067842184&fpuReq=1&bfs=103&acsn=1&ybnca_erpm=0.03&dmm_erpm=true&dmm_ogerpm=false&bcrid=S0300080711068000728009099999900&strg=HARMONY&stagid=bsa-zone_1641228026595-4_123456&vls=0&scrid=S0300080711068000728009099999900&mang=1&pvdTmax=294&fpusp=false&ae=false&epcexp=false&moau=true&ucrid_ver=2&omid=0&mnet_static_share=0.0&apTags%3C%3E=75&dt=O&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_page_url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&mx_sbp=-10.0&mx_sua_cvg=0000000&mx_tid_sent=false&mx_epbc=8CUWMQE3H&mx_SPRIG=0&mx_bsBucket=0&mx_ssProfile=0&mx_lr=0&mx_TAS=1&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=None&mx_uid_sent=0&mx_bsBucketRa=0&mx_sid=8CU18831I&mx_SC=0&mx_lr_seg_deal=0&mx_aqcpl_crid=0&mx_nsz=1&mx_GCID=0&mx_maq_call=false&mx_aurt=0&mx_bsBucketKtwRl=0&mx_divid=bsa-zone_1641228026595-4_123456&mx_tgs=728x90&mx_bsProfileRa=0&mx_IAB2=0&mx_gpid_format=DEFAULT&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=1&mx_gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=0&mx_ssBucket=0&mx_TAF=3&mx_gpid_sent=true&mx_commit_id=4521ab46fd&mx_exp_tokens%3C%3E=IPBLOCK_DM%3AGCS%23%23launch-wrng-exp%3ADEFAULT%23%23launchexp%3Atoken2%23%23NedCkfl%3ADEFAULT%23%23BssTgtMig%3ADEFAULT&native_ver=1.1&acid=3ec8adeb6e05a40a307ab37b5459ba5d&rtime=0.0&wsip=mowx-79df6c4b94-wqqqt&ltime=61.0&act=headerBid&abs=0%7C0%7Cnxblock%3D-1%7Cxtmax%3D350%7Cbrr%3D0&adtypes=0&impId=35aa7bcb58f9c&reftime=15000&reftype=0&dsid=bsa-zone_1641228026595-4_123456&gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&mowxReqId=3ec8adeb6e05a40a307ab37b5459ba5d_3&req_size=970x90%7C728x90&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=1&adpos=1&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=1&skadidfl=0&dfpDiv=bsa-zone_1641228026595-4_123456&feedback_id=6aba413e-4b7e-4017-9a1f-9ed28c7bb280&supplyTagId=950152417&pub_pbslot=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&mnrfc=1&viewability_vendor=MEDIA.NET+EXCHANGE&viewability_mnet=48&v_mkey=gen-vblt_prebid_test_2_1&v_mver=202311031711_gen-vblt_prebid_test_2&v_alg=gen-vblt_prebid_all&vcmplrt=-1.0&imp_tid_present=true&debug_ts=2023-11-04+03%3A17%3A22&__expireat=1699068442461&mview=1&lo_pvid=%5B459%5D&lo_dp=0&lo_bdp=0.020&lo_cbdp=0.014&actltime=86&rme=adm&utime=709&sf=0&cpr=0.22030320998494934

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:23 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 04 Nov 2023 03:17:23 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 19F0 0
0 44ms
44ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstF6c603pUa5RH7gzarS6Rkdknk7cmY-4IxdfpljKDqFuktd0qPVkYDxmJlFLiJAyr1BQCCkiiycGQKRdWjJdS2IPNsY83WMTn1gQoyOVEKhbcgac_tjEBGQu7EOPbgF9nYELnUf4wHHF5Vjw9NIuLGo3uo8S7clCud0KJZNvUTuhwWtBzAhrc3Scjy-JchMKgTp1GC0BtDSbF21UZs43FkJ4VGSZZvuTWtiYFMIK_7l_Pr5pB7C9iXDH_1fhUS8OnttvRAsN8wV05HGyFsN7lBPzWqXj3ncSQstqmZJ0LKiupkvNFrykAqQSwBsVTHDNTzLDoy5JXDk-WEgwxnPItbvZVxOQ&sai=AMfl-YRrDf3wYIfdhPS94_XQuu-0qAf-zIUb0lqOC0h5HxPhVUh7lfqZfNqYfquXb7RLFqyYaY9otgQMUfWH9tdYstFeW-BKQT63wE3WH7oWxyULPHQgGvaV2ntnlvYj2uOK1lgOAnt566QaBPuhpv0&sig=Cg0ArKJSzOyi93l2Ll5AEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sync Show response
gum.criteo.com/ Frame 19F0 51 B
293 B 20ms
19ms Script
text/javascript 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1481931694&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%2526sai%253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%2526sig%253DCg0ArKJSzGT4LrEpgnsZEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:22 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 4625382
expires: 60

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 19F0 9 KB
5 KB 161ms
160ms Script
application/javascript 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1699067842&bdh=o5SfQ19d4y691WGsEJktUqu0S1E.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Ff35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1481931694&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%2526sai%253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%2526sig%253DCg0ArKJSzGT4LrEpgnsZEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3337ed58e58524ab3f27fcd3997bc4ff831c62632ffb79ac8e24f0b66383e9e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
content-encoding: gzip
x-creative-id: 347914397
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
pragma: no-cache
an-x-request-uuid: 8ccc573b-c22d-4b31-802f-f7d32c134b20
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 blacklist_script.js Show response
tagan.adlightning.com/iponweb/ Frame 7205 34 KB
16 KB 33ms
8ms Script
application/javascript 18.66.147.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/iponweb/blacklist_script.js
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-69.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c938473d2d5c579d26b7f2a279443e17f2f3b0cfb88bd439c4508f7ec59b8735

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: R6XCz1pWwlSrANGj8Ai6rt1yAl.uZthO
content-encoding: gzip
via: 1.1 e65c822edea04e16936bdb4537763dd4.cloudfront.net (CloudFront)
date: Sat, 04 Nov 2023 03:07:15 GMT
x-amz-cf-pop: FRA60-P4
age: 608
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 15759
x-amz-meta-git_commit: 34df212
last-modified: Fri, 03 Nov 2023 23:47:52 GMT
server: AmazonS3
etag: "b439bf7f4e092a92a8ba9189864d24da"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: ySgki24_7cOQnESYLdwzXmD7n5hxU5gpBi9dT13-zsIGIsgvGXNg7w==

GET
H2 200 blocking_script.js Show response
tagan.adlightning.com/iponweb/ Frame 7205 77 KB
29 KB 35ms
11ms Script
application/javascript 18.66.147.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/iponweb/blocking_script.js
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-69.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4e605cb14d1186749fb40b1904926ed58ca469c5667aabae7dd685c6754a497a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: x.J2PYwnuh0edEBhim1y6vf92C_nFpLr
content-encoding: gzip
via: 1.1 e65c822edea04e16936bdb4537763dd4.cloudfront.net (CloudFront)
date: Fri, 03 Nov 2023 06:14:21 GMT
x-amz-cf-pop: FRA60-P4
age: 75782
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 29521
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:23:31 GMT
server: AmazonS3
etag: "bdbd686f79c27e384c7f3ec565c21d6b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: HRuWyWwZcC6rftJqwyFE1-hf_yFmauVT7vPdtK5_qtBT0gVImz0AoA==

GET
H/1.1 200
OK /
ghent-gce-or.bidswitch.net/imp/0.3361/BSWhttps_A_B_Busw.sportradarserving.com_Bnotify_By0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl__39ILO__H24aUpCtab1CLOs__1bR0rNCsc__164ohjkV9trW9AFR... Frame 7205 43 B
748 B 875ms
206ms Image
image/gif 35.212.198.217
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ghent-gce-or.bidswitch.net/imp/0.3361/BSWhttps_A_B_Busw.sportradarserving.com_Bnotify_By0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl__39ILO__H24aUpCtab1CLOs__1bR0rNCsc__164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs__AOq29d2M3HJ1G7f__34jwlTKB-r6YwRSUc__yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9__ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV__v1bksnMhygNprdQPjvJ__uZEvw4s37cns4dGAU7rSP539y9T__sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI__6C2VzZ__LF4xpigo4UZ3rR__sZZUYUOty5x__Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75__SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5__pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7__if6Q__e__s3ydNCYsPw2AcAMY6__ul3t__z0zmQ__TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz__X9q3__GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf__RWHXhNsqX__H__U6y4Vvxu8hNG1LiXQG8__H-qojGBwLqpSjqOJDyJGn__XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1_B_I_WAUCTION__PRICE_X_B/x9XsygESqWL5pOj4aUkN8-F6psYKkMLm7ER-wXxCysoe09f3KDfmkYXwKCOls5nj81_fB62KfJaivseKdMOZRsw6ySzkfbjEJa1ZMjS5E8Y2cKqT_oI0ZokibXT3ynqawMXOmLodg8g1jAU6umMRVT_PSc5AvHa47VizhKdGamz-5GDYJbkDpbB9fdTbjD06SpvYwEK0yN77P5KExMIisSCsrnEHCDCkn_QzubS5x7Amr4KMPwo3IuMFHq-o5nfbiDkcUss-IkDS-Gv1RxviC3O0swrwNvrFEpLNSegdB_nrd8FdUuEZnV7REvHZr5-PVGTtJLICFx9Lu1YoYVm8aRnnVwJnqMU1qrtroAYAyzwYoGM4C27QPPRDWC9QDmkkp56hw5H04oNr5VpimDMCRxco8Q-wLTMEcW4lAyEoDQS06JXBeXfuENZnE66nL_EkNByCjmXzy8iqLPTmCHVQCGxmiUvHHmQkDqmz_QdlLjjOI-8NDQWYwtgCSuHvbSEQYW9vKsksB5jq5mTyEMbn6QjB_3JzuyGWSDPFTG1ERPzSnz6tVDE8aGcC3VRcqcplBRBpsRQOhKqoG_LEi29XRjDgW__uWwvgtauVTXLvPkP-VSI0wLHXDO-z6dBvYROVr3IZum75AzTNsLsM8a2ZM5fMCQ0GP0iDbANF4d1p8fBlmQrQP05mxLcEuZUsRuOZ7IqHCjxoLSQyFl-cwYhnJe-EOiHIexT4uTn7piC553_PvmS5mb1lajdXX_Bf9VKrW5vl4TNh1cntKS5bcSSfU9GBcsF4Wm5QGCnf6FC4nHBFYZNv_hJw_OLqdwXrbeya2D61TqRTJZYtw2mFcRfTp1jOVNYbhZUosaN2lqam-2rOOdD5htPIIgQS3xAcWSaoIjdwEbHbvFyGXH-C2aXznOd1RrIaXKWXA_e92_EjdmmKl0FiN7HvRK6KyZU58npHBPt2Aiabls6rNKBqqnxJ_0AbpGDFqU7DA_xt4G6iRQxgPXVZ7DaMYIOWjtrcFVh7e5B5s3X_lILpzyqtjmMqqCbiVRJ7o9ZcMy6O0OM-WUHA50uoUG60uitzNDeND39tj3hLcxZ6WCKrxQ0Lk4DOX7PDDbLvsVZwNKDlV3pu68orvAJ1nOPnZJtPQ4wWDRVwbscQN6BpaZGQ5DvQvKq9B2uhXbD0C0shzzecQL5UQQ9NpJXwK7WPB4B8V3_8K0rjrXf8-mqvWNcnuHRXmlCvFyl01icLb6wntGM_O9B1m70Hf3pThr1FvHfMq6XzyKWJf7uXmEUPWM3KLZc1mo8gys6o6ANcakaIqSeqOIH1ye4yh9_wGii1XifeoBkjC3-my-YxHP_ziOA7i2h-/
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.212.198.217 The Dalles, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 217.198.212.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:23 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK sync
us-west-sync.bidswitch.net/ Frame 7205 43 B
235 B 576ms
204ms Image
image/gif 35.212.133.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-west-sync.bidswitch.net/sync?ssp=fmx&dsp_id=409&imp=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.212.133.238 The Dalles, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 238.133.212.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:23 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 204
No Content t.dhj Show response
pxdrop.lijit.com/1/d/ Frame 7205 0
199 B 55ms
7ms Script
text/plain 2.17.100.211
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxdrop.lijit.com/1/d/t.dhj?dmn=wheregoes.com&pn=%2Ftrace%2F20235212457%2F&pubid=buysellads&v0=54916
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-211.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:22 GMT
Cache-Control: private, max-age=3600
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Expires: Sat, 04 Nov 2023 04:17:22 GMT

GET
H/1.1 200
OK impression
vap1sea1.lijit.com/rtb/ Frame 7205 43 B
552 B 615ms
215ms Image
image/gif 63.251.14.14
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vap1sea1.lijit.com/rtb/impression?i_data=ZKpFzJEVjflsS8EWelYlZnIBt6FTWKtyKR8dtnIOolOcB64dyCx9sg5kMFz4oLFhYrqqZ7j0LOBLF_JlFZjTBnkG7Nrr3T55mt2Sa3We68PykTdL3ApSuu3KFDmQqSm_VgWcqOV1NNxcfhhdPF_BsjMgMO4wE3tFeBR75gumGRXncqp2ou08A6MJWqEZW4NVO2nan4VdBtHGI6guYmNf_daVqsf2LvR_5wdDeWDaPalX0_vmQ1naBXZVkxkN4gedkG1x9XhS_YHNC4NQqRsKb68X34Lmedizoqp0PqwbicuOhIinCtEVEP4rHvHAE-VJ9bE6D4ji4QQwliDYNYVVvRqZiuEGSLI4PcmNIRk~&bannerid=40971&campaignid=1769&endpoint=PREBID&prebid=prebid_prebid_7.54.0&rtb_tid=dfc8570b-8485-4e87-9953-1bfdc7fd1de0&rpid=26&seatid=409&zoneid=995488&tid=a_995488_f9a3f94fe29a434ea69fc6362aa80d30
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS: 14.14.251.63.unassigned.ord.singlehop.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:23 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1sea1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame 2B8E 38 KB
15 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 13:40:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49041
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 13:40:01 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame BF36 0
0 41ms
40ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202310310101&jk=1394095844482027&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2

200

/ Show response
usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdK... Frame DC1C
Redirect Chain

https://usw.sportradarserving.com/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJA...
https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cF...

9 KB
5 KB

249ms
247ms

Document
text/html

35.212.242.235
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.242.235 The Dalles, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 235.242.212.35.bc.googleusercontent.com
Software: /
Resource Hash: a3f68cb731c8cf026d92fec1fbab20fd874bbbb296171df3b0ff41f7309c79e4

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 3240
content-type: text/html; charset=UTF-8
date: Sat, 04 Nov 2023 03:17:23 GMT
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sat, 04 Nov 2023 03:17:23 GMT
location: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
via: 1.1 google

GET
H/1.1 200
OK sovrn_standalone_beacon.js Show response
ap.lijit.com/www/sovrn_beacon_standalone/ Frame 7205 9 KB
4 KB 191ms
191ms Script
text/javascript 63.251.14.14
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/www/sovrn_beacon_standalone/sovrn_standalone_beacon.js?iid=8128488
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/iponweb/blocking_script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS: 14.14.251.63.unassigned.ord.singlehop.net
Software: nginx /
Resource Hash: b4208c430fb204fc4903653c1c36f9832e2c3bfb742a6828e96878e328d8e26e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Jul 2023 16:20:24 GMT
Server: nginx
ETag: W/"64c7df48-22bf"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Methods: GET
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1sea1
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires: Sat, 04 Nov 2023 04:17:23 GMT

GET
H2 200 SAFEFRAME.html Show response
contextual.media.net/sr/2722522032/ Frame 10F3 70 KB
28 KB 304ms
304ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2270&&kkdd=un%7CH%7C*9nA&(R=J~ddz~*aE5~9~!9J9a~&QKuD=J&sLu.=z&0K(=JJz!&wL0B=n!z*&0RK=a834kUr!x&0u0K=kiyC~i4fF5!7fdK*-mKi!Q%3D%3D&0DRK=aEd95!!*J&LRtB=*5aFdz&00=Yr&L0=xr&01Ps=xjGkvec&uRK=a)v8ndJ~n&wuRK=2)~p53~&1wwuL=J&DDD=wtGT1n0XTndxu)u6aZU7cXs0*D0vZ-52EMy*5Er3r(kN!X3MpsDcLcNbMc08NS9l&AhD_=1wwuL%3A%2F%2Fh1BDBQ-BLH0-s&BAhD_=h**rU%3A667hZnZMsZUHesc&PLB=9&Xh=J&gQK=E&.KwJ=a83Jaa!Ji&.Kw5=d9zJ95EJ*&SK.w.=LK5%3DPgXXqRgDXlX%3D5zq-QBDus%3DzHz!q(RLlLK%3DdzqD_l0Pw%3DJqK05%3DJqL0K%3D1Bq(l.LP%3Ddzzdq(X5DlLK%3D5z5!JJz!5JqRgDXlS%3DdJ*zHJJqgDXlwA0%3DzqLwK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qX.Lw%3Dq(RLlgDXlS%3DzH*5qRu%3D)iZykq_SS%3Dzq(RLlgDXlX%3D!zqDRRug.%3Dz%2CzqBw%3DJ~qD0%3DJqDuLlLK%3D5z5!JJz!5zq(RLlS%3DazJH~qgDXlS%3DzHJJq(X5DlgDXlS%3Dzq(X5DlgDXl(R%3DJrTJ~qgDXlw(R%3DzqgDXlX%3D5zqQ0.w%3DTJqSS%3DJd~q((%3DzqX5DlS%3DJzzzqBDus%3DzHz!q(X5DlgDXlA0%3Dzrzq(X5DlgulX%3D5zqSs%3DJq.!ulS%3DzH~9%2CEdHEaqLRK%3DE~ddKS9a90~EzzzSES*zS~aBJ*KKB5aBqLK%3DTJqgRK%3D55K9py)0BF6137Y9c~qSwK%3D!z*d*J*~!dza~59!~5*~5EJz**~za~!~E!Ed5za5E*za9J**EdddJ5dEaza9!a!a5~*59aa~9~~5*9JJa~J9dd!~**J9d~~J~z**!J5q(hg%3DTJqK5ulX%3D!zq!u0_%3DJzzzqgRs%3Dzq(hlsBK%3DzHEaqKsslLwDQ%3D1.Ds-PMq(X5DlgulS%3DzqK5ulS%3DzHd~q-QK5ulS%3DzHdJq(gDXlS%3DzH5qLL%3DJ~zzFJ5zzq00%3DYrqgRh%3DTJq0B%3DzqDuLlS%3DEdHEaq(gDXlX%3D5zq8i%3D!zEJqASlg0%3DT5qPwL%3DJqASl00AL%3DT5q0w%3D_D.PA_gDw%20.s%20s.RPqSLLlV24%3Dej%2CejqS.LRL5%3DJd~qS.LRLJ%3DJd~qRLGB_%3DzqR(gDXlS%3D9qRLR_%3DzqSRK%3DzHz5qK0%3D*q(X5DlS%3DzH~9qR(gDXlX%3D5zq0SKu%3DzHzJEqLK%3DTJqRwMuBlRK%3D!qLBXXBDlw.QlRK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qLguuXMlw.QlRK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qu-L%3DJqDB_l0Pw%3DJq0.DDRBDiK%3Dzq-QSRK%3DzHz5zqS_XD%3DzHzzzqKw0%3DBglSBqKsslBDus%3D_.XLBqKss%3D1.Ds-PMqSKu0.uK%3DzqK.XQ%3DgPRL-PJ5qL-Su%3Dq1wsX%3DJqK0gw%3D9zqK-QS%3DzTJqRS0%3DJqPLt%3DJqwQL%3D*5aFdzqSLS%3DzqSLu%3DzqwsF%3D5dE&Pw(=z&sss=gN-Le_iYyrA%3D&Rh=*5a&RPi_D=J&SKDiK=E9d&SRK=!EaJ!d&AwwXB=2D.0B%20GBLgXwL%20%7C%2041BDBp-BL&s0_=~95J!&MKLuD=J&S.B=7E..BEyeeQ&A.wuDB=J&A.wSRK=TJz!&0.K-s.RP=wtGT1n0XTnaVwvnEZm-R8V1aw0!jutg!ubaRuzBE)tr%3D&MuXu=J&RLRK=9&uQRK=uJdda9EJ**Ew5z5!JJzEz!J*&LLXK=%7B%22LLRu%22%3A%22E9HJEJHJ95Hz%22%2C%22LL00%22%3A%22Yr%22%2C%22LLL0%22%3A%22xr%22%2C%22LL0wM%22%3A%22_D.PA_gDw%20.s%20s.RP%22%7D&1wsXLD0=J&sflct=2096410&ure=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

75704eddb5fafdcfafcc21d96eec1312a81bf568806eaf4649f50099890681d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 28902
content-type: text/html
date: Sat, 04 Nov 2023 03:17:23 GMT
expires: Sat, 04 Nov 2023 03:17:23 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
timing-allow-origin: *
vary: Accept-Encoding
x-sc-h: 22-d2kv

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 914C 16 KB
6 KB 20ms
20ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&ckdel=1&cs=2&cv=31&cid=8CUWMQE3H&https=1&itype=CM

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

7d151cfe123bf6c07749f5cf0c6f42709b46d0035bb3c18bf4a0574053856596

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=108736
content-encoding: gzip
content-length: 5951
content-type: text/html; charset=UTF-8
date: Sat, 04 Nov 2023 03:17:23 GMT
expires: Sun, 05 Nov 2023 09:29:39 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 bping.php
lg3.media.net/ Frame EE7E 35 B
176 B 72ms
20ms Image
image/gif 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=2077&&vgd_cdv=1103&vgd_cage=1&vgd_tsce=L307&vgd_mcf=65213&gdpr=1&mspa=0&prid=8PRVCXX19&cid=8CUWMQE3H&crid=849523371&vi=1699067842656351586&ugd=4&lf=6&kwrf=https%3A%2F%2Fwheregoes.com&cc=DE&sc=HE&lper=100&wsip=170785191&r=1699067843180&rrr=tzR-hLcl-L9HpPpS8JQBYlmc7rcOJo2T4yq724EUEvMX3lUyGmrYsYXVyYcCXb5_&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9A~e8QMQOvi9~LkMNz7vu~ONfvu~QNOvwJ~eM1Qzvi99i~ejfLMQOvf9fAuu9Afu~8xLjMGviuh9.uu~xLjM7UNv9~Q7OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~j1Q7v~e8QMxLjMGv9.hf~8Ev0V6%20c~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vuF~LNvu~LEQMQOvf9fAuu9Af9~e8QMGvW9u.F~xLjMGv9.uu~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9A~ejfLMxLjMUNv949~ejfLMxEMjvf9~GYvu~1AEMGv9.FX%2CHi.HW~Q8OvHFiiOGXWXNFH999GHGh9GFWJuhOOJfWJ~QOvou~x8OvffOXZ%200NJ-bwPRrX3F~G7OvA9hihuhFAi9WFfXAFfhFfHu9hhF9WFAFHAHif9WfHh9WXuhhHiiiufiHW9WXAWAWfFhfXWWFXFFfhXuuWFuXiiAFhhuXiFFuF9hhAuf~eBxvou~OfEMjvA9~AENkvu999~x8Yv9~eBMYJOv9.HW~OYYMQ7Lyvw1LYmz5~ejfLMxEMGv9~OfEMGv9.iF~myOfEMGv9.iu~exLjMGv9.f~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvHi.HW~exLjMjvf9~%3DVvA9Hu~UGMxNvof~z7Qvu~UGMNNUQvof~N7vkL1zUkxL7n1YnY18z~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvX~8Q8kv9~G8Ov9.9f~ONvh~ejfLMGv9.FX~8exLjMjvf9~NGOEv9.9uH~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~EmQvu~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9f9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8Qmzuf~QmGEv~w7Yjvu~ONx7vX9~OmyGv9ou~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfiH&ssld=%7B%22QQ8E%22%3A%22HX.uHu.uXf.9%22%2C%22QQNN%22%3A%22r4%22%2C%22QQQN%22%3A%22q4%22%2C%22QQN75%22%3A%22kL1zUkxL7n1YnY18z%22%7D&vgd_bid=348139&vgd_ydspr=1&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1699067842162740469&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=950152417&vgd_pgid=p1998541774t202311040317&vgd_pgids=1&vgd_uspa=0&hvsid=00001699067843178007642542088298&gdpr=1&mspa=0&vgd_l2type=scs_newfl&vgd_end=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

server-13-32-121-66.fra60.r.cloudfront.net

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sat, 04 Nov 2023 03:17:23 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 04 Nov 2023 03:17:23 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 19F0 18 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1699067842&bdh=o5SfQ19d4y691WGsEJktUqu0S1E.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Ff35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1481931694&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%2526sai%253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%2526sig%253DCg0ArKJSzGT4LrEpgnsZEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 02:43:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2056
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 04 Nov 2023 03:43:07 GMT

GET
H2 200 apn
beacon.sojern.com/imp/ Frame 19F0 42 B
208 B 55ms
15ms Image
image/gif 107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.sojern.com/imp/apn?auc=7015247356217304908&cr=347914397&seg=&st=0&bp=0.02371&pp=0.020993&aaid=&idfa=&ord=995609740
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1699067842&bdh=o5SfQ19d4y691WGsEJktUqu0S1E.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Ff35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1481931694&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%2526sai%253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%2526sig%253DCg0ArKJSzGT4LrEpgnsZEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 ca Show response
choices.truste.com/ Frame 19F0 2 KB
2 KB 129ms
99ms Script
text/javascript 13.32.121.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=995609740&sz=300x250&js=st_dapp

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.121.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 adc51edbb4dc468fb382e40b115a2f62.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: FRA60-P1
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 918
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: 5gv9PEynERI6g-wUtk6nCyb1H1V_1yJYfJYRdvrkt_9iYtU6visplg==
expires: Sat, 04 Nov 2023 04:17:23 GMT

GET
H2 200 it
fra1-ib.adnxs.com/ Frame 19F0 0
645 B 13ms
7ms Image
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLRD_Q7BtEHAAADANYABQEIwu-WqgYQzM7SttXJyq1hGI7b3eml0PzOBCo2CQv4qNMVf5U_EUxxEx22V40_GQAAAOBRuL4_IVssoKsIkpA_KZ5GWipvR5g_MQAAAEDheoQ_MOOC9Ag4ykFA6j9IAlCdgfOlAViY1VJgAGiR92t4s4cGgAEBigEDVVNEkgEDVVNEmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAa4FaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlY2xpY2submV0JTJGcGNzJTJGY2xpY2slMjUzRnhhaSUyNTNEQUtBT2pzdl9ZM3dSMmtXTF9CQ1lfQ3F3YjRFQkdkTTZDYmxWTjlub0loNVpOTXBocWpfZzYzNXlGNi1aSDl4ckhfQnZIZWE4ZjE0QWFkbjZJU0NKTmdlM1BZZnAwNHBYc1JCR3pubDJGNzZTTERKRGxjeng5UVNsdktLZm9MY2JCdDZ4S1N1T0xqNHJ6TmdnbnpoSzBZQks2NVphdFM0MjFxbHJhTjFmWW9ONTJlMkNYb0tjNzdEWFBMbVZOeEJkZVdmc3A3MFd5eUhwaV84UmN0S3UwTDh0SjhWdGR5SnhHMGMzYmxUUUpGTjFVOGNUSHNVaXdxa2JCVUk4YW92emMxZHdVZzlMUmZNYWZLZXhkYnRBTlotQmROWVhaTl9ZOFFVZkJ2UHZDZmZYQU4wMG41Q0dUVVRQeUZjbDRSQ1otbjFwMkNROFY2NElRR1RuM2htQ1pMZm9hWGdJOUElMjUyNnNhaSUyNTNEQU1mbC1ZUy1wOXQwZlA3dmhSeDd5SHlGcl81bUZZaUxYTGpjRUNJWnBIb2xCNFFXaTQtU2ZBSVV6MnQ4RmR2NFpuZGJlZDN1bzV2b2ZhM2R2ZURmN1EyN01WZ2RKeGRQV1J1TTNTbjhmckJPTE5MVUtMQ0VmcEd1ajNWa1hrNmRDejNIME1mbld0dG1QSk1tb0E5WEJmQSUyNTI2c2lnJTI1M0RDZzBBcktKU3pHVDRMckVwZ25zWkVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQCKAlN1ZignYScsIDI5Mzg3OTUsIDApO3VmKCdpJywgNDgyMzI5OSwgMCk7dWYoJ2cnLCAxMjcyNDYzOSwgMCk7dWYoJ3InLCAzNDc5MTQzOTcsIDApO5ICjQQhYjExVm5BalkyZE1WRUoyQjg2VUJHQUFnbU5WU01BQTRBRUFBU09vX1VPT0M5QWhZQUdEdUJHZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JNNV9GT3NCR21EX0JBVE9meFRyQVJwZ195UUVBQUFBQUFBRHdQOWtCQUFBQUFBQUE4RF9nQVlPeXBnTDFBZncxd2p5WUFnQ2dBZ0cxQWdBQUFBQzlBZ0FBQUFEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHNkF3bEdVa0V4T2pZMU9UUGdBX0pFZ0FTSTE4VUVpQVNGbDhzRWtBUUJtQVFCd1FRQUFBQUFBQUFBQU1rRUFBQUFBQUFBQUFEWUJBRHhCQUFBQUFBQUFBQUFpQVhCTTZrRkFBQUFBQUFBOEQteEJRQUFBQUFBQUFBQXdRVTBNek16TXpQRFA4a0ZBQUFBNFBRNnhEX1JCUUFBQUFBQUFBQUEyUVVBQUFBQUFBRHdQLUFGd3hMd0JaX1RpQWI0QmF1dnN3R0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJnQUFBQUFBQUFBQXFBWUVzZ1lrQ1FBQUFBQUFBQUFBRVFBQUFBQUFBQUFBR1FBQUFBQUFBQUFBSVFBQUFBQUFBQUFBdUFZS2dRZzBNek16TXpQRFB3Li6aApkBIUd4R3R5UWpZMmRNVkVKMkI4NlVCR0pqVlVpQUFLQUF4QUFBQUFBQUFBQUE2Q1VaU1FURTZOalU1TTBEeVJFa0FBQUFBQUFEd1AxRUFBQUFBQUFBQUFGa0FBQUFBQUFBQUFHRUFBQUFBQUFBQUFHawmOAQEESEUBBgkBEEhnQWlRERBERHdQdy4u2AIA4AKf8D_qAhZoocDwizovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAPYBMgDANgDxdTyAeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA00NS4xNDEuMTUyLjc1qAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA0gQOODE3MCNGUkExOjY1OTPaBAIIAeAEAPAExZcgiAUBmAUAoAX_EQEYAcAFAMkFAAUBFPA_0gUJCQULQAAAANgFAeAFAfAF2p0f-gUEAW4okAYAmAYAuAYAwQYBITAAAPA_0AboKdoGFgoQCREZAXAQABgA4AYB8gYCCACABwGIBwCgBwHIB7OHBtIHDRVkASYI2gcGAV3AGADgBwDqBwIIAPAH0uADiggCEACVCAAAgD-YCAHACADSCA4IgYKEiJCgwIABEAAYAA..&s=82dd097d574b2ec298decae2c90795501add80d9

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:23 GMT
an-x-request-uuid: 64d7d799-dac8-46f6-976f-c252562ca954
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/239/ Frame 19F0 80 KB
27 KB 303ms
200ms Script
application/x-javascript 184.30.16.183
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/239/trk.js
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1699067842&bdh=o5SfQ19d4y691WGsEJktUqu0S1E.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Ff35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1481931694&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%2526sai%253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%2526sig%253DCg0ArKJSzGT4LrEpgnsZEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.16.183 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-16-183.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a9c49f9f526c232731b2ff9aa3e31b686b8b339bdd246bbf74f804c802f9755d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:23 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jul 2023 11:56:12 GMT
Server: AkamaiNetStorage
ETag: "615fd4ad24a409f4de5416b603f042c1:1689076572.555276"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27646
Expires: Sun, 03 Nov 2024 03:17:23 GMT

GET
H2 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 19F0 59 KB
23 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 14:26:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132650
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 01 Nov 2024 14:26:33 GMT

GET
H2 200 B27432037.331381584;dc_ver=99.292;sz=300x250;u_sd=1;gdpr=0;aucid=7015247356217304908;crid=347914397;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%2... Show response
ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/ Frame 19F0 77 KB
32 KB 83ms
48ms Script
text/javascript 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B27432037.331381584;dc_ver=99.292;sz=300x250;u_sd=1;gdpr=0;aucid=7015247356217304908;crid=347914397;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=545847862;ord=pvenh8;click=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKaAfCZmgAAAAMAxBkFAQjC75aqBhDMztK21cnKrWEYjtvd6aXQ_M4EIOOC9AgoykEw6j84AkCdgfOlAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAGzhwaIAQGQAQKYAQWgAQKpAQv4qNMVf5U_sQFMcRMdtleNP7kBAAAA4FG4vj_BAVssoKsIkpA_yQGeRloqb0eYP9gBAOABAA..%2Fs%3Da5d897061eb5bb2eff0046c8cad196dcccd73688%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521GxGtyQjY2dMVEJ2B86UBGJjVUiAAKAAxAAAAAAAAAAA6CUZSQTE6NjU5M0DyREkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DODE3MCNGUkExOjY1OTM%3D%2Fbn%3D99251%2Fclickenc%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Fpcs%252Fclick%25253Fxai%25253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%252526sai%25253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%252526sig%25253DCg0ArKJSzGT4LrEpgnsZEAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fwheregoes.com%2F$0;xdt=1;crlt=SNnnXUVxk.;gcsr=m;stc=1;chaa=1;sttr=35;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f6.1e100.net

Software

cafe /

Resource Hash

f5cdc56e4334b1b60fd477cad40c72c5b402cf28d33ddef0cf13ee2b548da00d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32689
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 2B8E 0
10 B 7ms
6ms Image
text/plain 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?jeqpBQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 19F0 111 KB
39 KB 32ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
Origin: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 02:22:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3301
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 Nov 2023 02:22:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/elements/html/ Frame 19F0 11 KB
4 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B27432037.331381584;dc_ver=99.292;sz=300x250;u_sd=1;gdpr=0;aucid=7015247356217304908;crid=347914397;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=545847862;ord=pvenh8;click=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKaAfCZmgAAAAMAxBkFAQjC75aqBhDMztK21cnKrWEYjtvd6aXQ_M4EIOOC9AgoykEw6j84AkCdgfOlAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAGzhwaIAQGQAQKYAQWgAQKpAQv4qNMVf5U_sQFMcRMdtleNP7kBAAAA4FG4vj_BAVssoKsIkpA_yQGeRloqb0eYP9gBAOABAA..%2Fs%3Da5d897061eb5bb2eff0046c8cad196dcccd73688%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521GxGtyQjY2dMVEJ2B86UBGJjVUiAAKAAxAAAAAAAAAAA6CUZSQTE6NjU5M0DyREkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DODE3MCNGUkExOjY1OTM%3D%2Fbn%3D99251%2Fclickenc%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Fpcs%252Fclick%25253Fxai%25253DAKAOjsv_Y3wR2kWL_BCY_Cqwb4EBGdM6CblVN9noIh5ZNMphqj_g635yF6-ZH9xrH_BvHea8f14Aadn6ISCJNge3PYfp04pXsRBGznl2F76SLDJDlczx9QSlvKKfoLcbBt6xKSuOLj4rzNggnzhK0YBK65ZatS421qlraN1fYoN52e2CXoKc77DXPLmVNxBdeWfsp70WyyHpi_8RctKu0L8tJ8VtdyJxG0c3blTQJFN1U8cTHsUiwqkbBUI8aovzc1dwUg9LRfMafKexdbtANZ-BdNYXZN_Y8QUfBvPvCffXAN00n5CGTUTPyFcl4RCZ-n1p2CQ8V64IQGTn3hmCZLfoaXgI9A%252526sai%25253DAMfl-YS-p9t0fP7vhRx7yHyFr_5mFYiLXLjcECIZpHolB4QWi4-SfAIUz2t8Fdv4Zndbed3uo5vofa3dveDf7Q27MVgdJxdPWRuM3Sn8frBOLNLUKLCEfpGuj3VkXk6dCz3H0MfnWttmPJMmoA9XBfA%252526sig%25253DCg0ArKJSzGT4LrEpgnsZEAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fwheregoes.com%2F$0;xdt=1;crlt=SNnnXUVxk.;gcsr=m;stc=1;chaa=1;sttr=35;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 19:21:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28529
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 17 Nov 2023 19:21:54 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 19F0 41 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46764
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Nov 2024 14:17:59 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 19F0 27 KB
10 KB 132ms
102ms Script
text/javascript 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?sz=300x250&c=995609740&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=995609740&sz=300x250&js=st_dapp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.100 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-121-66.fra60.r.cloudfront.net

Software

nginx /

Resource Hash

76dd4985b0bab51e691df2d86aeb001fc70bc16bce8eb511b71bae6578096220

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: FRA56-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: Nv5v35r9tJ-8DYtDtP7guM9xANeF_f0iHNGFSv3qBDdx1kPvEl8kUg==
expires: Sat, 04 Nov 2023 04:17:23 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 7BBB 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 41644
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 15:43:19 GMT
expires: Sat, 02 Nov 2024 15:43:19 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ca Show response
choices.truste.com/ Frame 19F0 28 KB
9 KB 104ms
104ms Script
text/javascript 13.32.121.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=27432037&js=st0

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.121.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f2d9c43cf87edf39ab7193b069222daab0e664b0e1354727a5edab325c4210d9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 adc51edbb4dc468fb382e40b115a2f62.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: FRA60-P1
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8028
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: MvPp97C9eG8zk83YCJ6-rhyYco9lBVSDTYx39SFCm_I3v_IW4Z_rBA==
expires: Sat, 04 Nov 2023 04:17:23 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5702536393117632765/ Frame 76C1 18 KB
4 KB 22ms
7ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c413abebd13289f215d61d2da266a20ff91001195265f50f6641613cc8033f98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 154612
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4501
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 02 Nov 2023 08:20:31 GMT
expires: Fri, 01 Nov 2024 08:20:31 GMT
last-modified: Thu, 19 May 2022 16:46:41 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 19F0 0
0 78ms
43ms Fetch
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuWlt0T9H6gkITDjqb_O4K0-vBoSIHC49jURnB-nbOpeMiGhcekihyFclYY9mfLCjvMfH5Nan9hRHA63oJ_FcnimAKATleBYckvASkY08j-6f5U6j4C9aFfFoHAZ-ArcuzqYlY7YcaYhFr0Q43Bl3jQE47QOtyejN2l&sai=AMfl-YR95KvoRWmTvN0GE5VzLRk9zd0aEg2_jfYrKGB_jztLBO17a4vaX80q1LFOQVmiQGl3iMxtskQJpYWe5j9SYDEMBMMUzRHnSw7N-w&sig=Cg0ArKJSzNjY2h5WS6aSEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=41&cbvp=1&cstd=38&cisv=r20231101.90225&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 dcm
beacon.sojern.com/imp/ Frame 19F0 42 B
102 B 16ms
15ms Image
image/gif 107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.sojern.com/imp/dcm?auc=7015247356217304908&io=${INSERTION_ORDER_ID}&li=${CAMPAIGN_ID}&cr=347914397&io=${INSERTION_ORDER_ID}&seg=${PIXEL_ID_COMMA}&src=${SOURCE_URL}&ord=%c
Requested by: Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame 7BBB 38 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 13:40:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49042
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 13:40:01 GMT

GET
H3 200 b64344c8e55cd46ed9616069b5bec411.js Show response
s0.2mdn.net/sadbundle/5702536393117632765/ Frame 76C1 74 KB
19 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/b64344c8e55cd46ed9616069b5bec411.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c2699d839960f04dedb0f3811eab8fbf2635be1ccd2a83f18d7d0dfd443861

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:58:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33517
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19395
x-xss-protection: 0
last-modified: Thu, 19 May 2022 16:46:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Nov 2024 17:58:46 GMT

GET
H3 200 user_uploaded_din_700_normal.ttf
s0.2mdn.net/sadbundle/5702536393117632765/fonts/ Frame 76C1 28 KB
15 KB 8ms
8ms Font
font/ttf 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/fonts/user_uploaded_din_700_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5702536393117632765/b64344c8e55cd46ed9616069b5bec411.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa121f9bdb891acdfbd269059f7c43ffe2897eadf84edcde869e8988d6986743

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 18:30:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117990
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15398
x-xss-protection: 0
last-modified: Thu, 19 May 2022 16:46:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 18:30:53 GMT

GET
H3 200 user_uploaded_din_500_normal.ttf
s0.2mdn.net/sadbundle/5702536393117632765/fonts/ Frame 76C1 27 KB
15 KB 9ms
8ms Font
font/ttf 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/fonts/user_uploaded_din_500_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5702536393117632765/b64344c8e55cd46ed9616069b5bec411.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

761035902658487ed48be0ff2ff82ec2f7359e4247510acdf909a346835420e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 08:20:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 154611
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15322
x-xss-protection: 0
last-modified: Thu, 19 May 2022 16:46:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 08:20:32 GMT

GET
H3 200 d1412950269b596d77d4cce100d3633d.jpg
s0.2mdn.net/sadbundle/5702536393117632765/media/ Frame 76C1 10 KB
10 KB 14ms
13ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/media/d1412950269b596d77d4cce100d3633d.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a21b3f6c49ca19ac60a1b22ba9b7856b10bb85db1ca36a26084ded7b16e83a1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 04:55:08 GMT
x-content-type-options: nosniff
age: 80535
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10564
x-xss-protection: 0
last-modified: Thu, 19 May 2022 16:46:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Nov 2024 04:55:08 GMT

GET
H3 200 0ac92a191fc88381561c0286711cdd6e.jpg
s0.2mdn.net/sadbundle/5702536393117632765/media/ Frame 76C1 11 KB
11 KB 12ms
11ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/media/0ac92a191fc88381561c0286711cdd6e.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21002478c2b78b6afcade844728126fcaa4b525482e3c89fd094f4f5338efac5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:51:35 GMT
x-content-type-options: nosniff
age: 285948
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11394
x-xss-protection: 0
last-modified: Thu, 19 May 2022 16:46:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Oct 2024 19:51:35 GMT

GET
H3 200 2c2b45f16ea54f675090713464ec13d3.jpg
s0.2mdn.net/sadbundle/5702536393117632765/media/ Frame 76C1 10 KB
10 KB 12ms
12ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/media/2c2b45f16ea54f675090713464ec13d3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3cd22cdbb542bb052df36533b5bf3b6854c7efaf87364005705f91a4ba15b4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 17:58:52 GMT
x-content-type-options: nosniff
age: 206311
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10199
x-xss-protection: 0
last-modified: Thu, 19 May 2022 16:46:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 31 Oct 2024 17:58:52 GMT

GET
H3 200 6cd8e0c7582de7c5e681d52163236485.png
s0.2mdn.net/sadbundle/5702536393117632765/media/ Frame 76C1 4 KB
4 KB 11ms
11ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5702536393117632765/media/6cd8e0c7582de7c5e681d52163236485.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

701f3f36af58702b039602dde440fc697cef1d1ec676a0fcaf77fb740d877a42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5702536393117632765/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 09:57:21 GMT
x-content-type-options: nosniff
age: 62402
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3811
x-xss-protection: 0
last-modified: Thu, 19 May 2022 16:46:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Nov 2024 09:57:21 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 19F0 0
0 43ms
43ms Fetch
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuWlt0T9H6gkITDjqb_O4K0-vBoSIHC49jURnB-nbOpeMiGhcekihyFclYY9mfLCjvMfH5Nan9hRHA63oJ_FcnimAKATleBYckvASkY08j-6f5U6j4C9aFfFoHAZ-ArcuzqYlY7YcaYhFr0Q43Bl3jQE47QOtyejN2l&sai=AMfl-YR95KvoRWmTvN0GE5VzLRk9zd0aEg2_jfYrKGB_jztLBO17a4vaX80q1LFOQVmiQGl3iMxtskQJpYWe5j9SYDEMBMMUzRHnSw7N-w&sig=Cg0ArKJSzNjY2h5WS6aSEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=127&vt=11&dtpt=86&dett=3&cstd=38&cisv=r20231101.90225&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 10F3 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 10F3 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 10F3 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Roboto-Bold.woff
contextual.media.net/__media__/fonts/Roboto-Bold/ Frame 10F3 24 KB
24 KB 11ms
11ms Font
font/woff 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/Roboto-Bold/Roboto-Bold.woff

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2270&&kkdd=un%7CH%7C*9nA&(R=J~ddz~*aE5~9~!9J9a~&QKuD=J&sLu.=z&0K(=JJz!&wL0B=n!z*&0RK=a834kUr!x&0u0K=kiyC~i4fF5!7fdK*-mKi!Q%3D%3D&0DRK=aEd95!!*J&LRtB=*5aFdz&00=Yr&L0=xr&01Ps=xjGkvec&uRK=a)v8ndJ~n&wuRK=2)~p53~&1wwuL=J&DDD=wtGT1n0XTndxu)u6aZU7cXs0*D0vZ-52EMy*5Er3r(kN!X3MpsDcLcNbMc08NS9l&AhD_=1wwuL%3A%2F%2Fh1BDBQ-BLH0-s&BAhD_=h**rU%3A667hZnZMsZUHesc&PLB=9&Xh=J&gQK=E&.KwJ=a83Jaa!Ji&.Kw5=d9zJ95EJ*&SK.w.=LK5%3DPgXXqRgDXlX%3D5zq-QBDus%3DzHz!q(RLlLK%3DdzqD_l0Pw%3DJqK05%3DJqL0K%3D1Bq(l.LP%3Ddzzdq(X5DlLK%3D5z5!JJz!5JqRgDXlS%3DdJ*zHJJqgDXlwA0%3DzqLwK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qX.Lw%3Dq(RLlgDXlS%3DzH*5qRu%3D)iZykq_SS%3Dzq(RLlgDXlX%3D!zqDRRug.%3Dz%2CzqBw%3DJ~qD0%3DJqDuLlLK%3D5z5!JJz!5zq(RLlS%3DazJH~qgDXlS%3DzHJJq(X5DlgDXlS%3Dzq(X5DlgDXl(R%3DJrTJ~qgDXlw(R%3DzqgDXlX%3D5zqQ0.w%3DTJqSS%3DJd~q((%3DzqX5DlS%3DJzzzqBDus%3DzHz!q(X5DlgDXlA0%3Dzrzq(X5DlgulX%3D5zqSs%3DJq.!ulS%3DzH~9%2CEdHEaqLRK%3DE~ddKS9a90~EzzzSES*zS~aBJ*KKB5aBqLK%3DTJqgRK%3D55K9py)0BF6137Y9c~qSwK%3D!z*d*J*~!dza~59!~5*~5EJz**~za~!~E!Ed5za5E*za9J**EdddJ5dEaza9!a!a5~*59aa~9~~5*9JJa~J9dd!~**J9d~~J~z**!J5q(hg%3DTJqK5ulX%3D!zq!u0_%3DJzzzqgRs%3Dzq(hlsBK%3DzHEaqKsslLwDQ%3D1.Ds-PMq(X5DlgulS%3DzqK5ulS%3DzHd~q-QK5ulS%3DzHdJq(gDXlS%3DzH5qLL%3DJ~zzFJ5zzq00%3DYrqgRh%3DTJq0B%3DzqDuLlS%3DEdHEaq(gDXlX%3D5zq8i%3D!zEJqASlg0%3DT5qPwL%3DJqASl00AL%3DT5q0w%3D_D.PA_gDw%20.s%20s.RPqSLLlV24%3Dej%2CejqS.LRL5%3DJd~qS.LRLJ%3DJd~qRLGB_%3DzqR(gDXlS%3D9qRLR_%3DzqSRK%3DzHz5qK0%3D*q(X5DlS%3DzH~9qR(gDXlX%3D5zq0SKu%3DzHzJEqLK%3DTJqRwMuBlRK%3D!qLBXXBDlw.QlRK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qLguuXMlw.QlRK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qu-L%3DJqDB_l0Pw%3DJq0.DDRBDiK%3Dzq-QSRK%3DzHz5zqS_XD%3DzHzzzqKw0%3DBglSBqKsslBDus%3D_.XLBqKss%3D1.Ds-PMqSKu0.uK%3DzqK.XQ%3DgPRL-PJ5qL-Su%3Dq1wsX%3DJqK0gw%3D9zqK-QS%3DzTJqRS0%3DJqPLt%3DJqwQL%3D*5aFdzqSLS%3DzqSLu%3DzqwsF%3D5dE&Pw(=z&sss=gN-Le_iYyrA%3D&Rh=*5a&RPi_D=J&SKDiK=E9d&SRK=!EaJ!d&AwwXB=2D.0B%20GBLgXwL%20%7C%2041BDBp-BL&s0_=~95J!&MKLuD=J&S.B=7E..BEyeeQ&A.wuDB=J&A.wSRK=TJz!&0.K-s.RP=wtGT1n0XTnaVwvnEZm-R8V1aw0!jutg!ubaRuzBE)tr%3D&MuXu=J&RLRK=9&uQRK=uJdda9EJ**Ew5z5!JJzEz!J*&LLXK=%7B%22LLRu%22%3A%22E9HJEJHJ95Hz%22%2C%22LL00%22%3A%22Yr%22%2C%22LLL0%22%3A%22xr%22%2C%22LL0wM%22%3A%22_D.PA_gDw%20.s%20s.RP%22%7D&1wsXLD0=J&sflct=2096410&ure=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c8a7ea184c79a6f61c400968314d03aae7c327f03efc03603f6a3cbada7bfb9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2270&&kkdd=un%7CH%7C*9nA&(R=J~ddz~*aE5~9~!9J9a~&QKuD=J&sLu.=z&0K(=JJz!&wL0B=n!z*&0RK=a834kUr!x&0u0K=kiyC~i4fF5!7fdK*-mKi!Q%3D%3D&0DRK=aEd95!!*J&LRtB=*5aFdz&00=Yr&L0=xr&01Ps=xjGkvec&uRK=a)v8ndJ~n&wuRK=2)~p53~&1wwuL=J&DDD=wtGT1n0XTndxu)u6aZU7cXs0*D0vZ-52EMy*5Er3r(kN!X3MpsDcLcNbMc08NS9l&AhD_=1wwuL%3A%2F%2Fh1BDBQ-BLH0-s&BAhD_=h**rU%3A667hZnZMsZUHesc&PLB=9&Xh=J&gQK=E&.KwJ=a83Jaa!Ji&.Kw5=d9zJ95EJ*&SK.w.=LK5%3DPgXXqRgDXlX%3D5zq-QBDus%3DzHz!q(RLlLK%3DdzqD_l0Pw%3DJqK05%3DJqL0K%3D1Bq(l.LP%3Ddzzdq(X5DlLK%3D5z5!JJz!5JqRgDXlS%3DdJ*zHJJqgDXlwA0%3DzqLwK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qX.Lw%3Dq(RLlgDXlS%3DzH*5qRu%3D)iZykq_SS%3Dzq(RLlgDXlX%3D!zqDRRug.%3Dz%2CzqBw%3DJ~qD0%3DJqDuLlLK%3D5z5!JJz!5zq(RLlS%3DazJH~qgDXlS%3DzHJJq(X5DlgDXlS%3Dzq(X5DlgDXl(R%3DJrTJ~qgDXlw(R%3DzqgDXlX%3D5zqQ0.w%3DTJqSS%3DJd~q((%3DzqX5DlS%3DJzzzqBDus%3DzHz!q(X5DlgDXlA0%3Dzrzq(X5DlgulX%3D5zqSs%3DJq.!ulS%3DzH~9%2CEdHEaqLRK%3DE~ddKS9a90~EzzzSES*zS~aBJ*KKB5aBqLK%3DTJqgRK%3D55K9py)0BF6137Y9c~qSwK%3D!z*d*J*~!dza~59!~5*~5EJz**~za~!~E!Ed5za5E*za9J**EdddJ5dEaza9!a!a5~*59aa~9~~5*9JJa~J9dd!~**J9d~~J~z**!J5q(hg%3DTJqK5ulX%3D!zq!u0_%3DJzzzqgRs%3Dzq(hlsBK%3DzHEaqKsslLwDQ%3D1.Ds-PMq(X5DlgulS%3DzqK5ulS%3DzHd~q-QK5ulS%3DzHdJq(gDXlS%3DzH5qLL%3DJ~zzFJ5zzq00%3DYrqgRh%3DTJq0B%3DzqDuLlS%3DEdHEaq(gDXlX%3D5zq8i%3D!zEJqASlg0%3DT5qPwL%3DJqASl00AL%3DT5q0w%3D_D.PA_gDw%20.s%20s.RPqSLLlV24%3Dej%2CejqS.LRL5%3DJd~qS.LRLJ%3DJd~qRLGB_%3DzqR(gDXlS%3D9qRLR_%3DzqSRK%3DzHz5qK0%3D*q(X5DlS%3DzH~9qR(gDXlX%3D5zq0SKu%3DzHzJEqLK%3DTJqRwMuBlRK%3D!qLBXXBDlw.QlRK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qLguuXMlw.QlRK%3DSL.Tt-PBlJ~EJ55az5~9d9TElJ5!E9~qu-L%3DJqDB_l0Pw%3DJq0.DDRBDiK%3Dzq-QSRK%3DzHz5zqS_XD%3DzHzzzqKw0%3DBglSBqKsslBDus%3D_.XLBqKss%3D1.Ds-PMqSKu0.uK%3DzqK.XQ%3DgPRL-PJ5qL-Su%3Dq1wsX%3DJqK0gw%3D9zqK-QS%3DzTJqRS0%3DJqPLt%3DJqwQL%3D*5aFdzqSLS%3DzqSLu%3DzqwsF%3D5dE&Pw(=z&sss=gN-Le_iYyrA%3D&Rh=*5a&RPi_D=J&SKDiK=E9d&SRK=!EaJ!d&AwwXB=2D.0B%20GBLgXwL%20%7C%2041BDBp-BL&s0_=~95J!&MKLuD=J&S.B=7E..BEyeeQ&A.wuDB=J&A.wSRK=TJz!&0.K-s.RP=wtGT1n0XTnaVwvnEZm-R8V1aw0!jutg!ubaRuzBE)tr%3D&MuXu=J&RLRK=9&uQRK=uJdda9EJ**Ew5z5!JJzEz!J*&LLXK=%7B%22LLRu%22%3A%22E9HJEJHJ95Hz%22%2C%22LL00%22%3A%22Yr%22%2C%22LLL0%22%3A%22xr%22%2C%22LL0wM%22%3A%22_D.PA_gDw%20.s%20s.RP%22%7D&1wsXLD0=J&sflct=2096410&ure=1
Origin: https://contextual.media.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 24816
expires: Sun, 05 Nov 2023 03:17:23 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 10F3 15 B
178 B 33ms
33ms Script
text/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=5401&&vgd_canary=0&vgd_l2type=scs_newfl&fp=W0cfseha3aKdfMTCv5h_5RiDYZFYrWuEb5pxDp4Ed4mhqlJIkjLrsagD8ieQobChAsroI79I8mbzdiHu3M7FhMWDEdfuQ6LfT-UE_irszDROOOAyjjIHEFpFY96_26p0Vh_gFDngqp2vFcsiFcRDTw%3D%3D&cme=4cOxhFTlUiaekw_WG9hW-3Fy7vU-WF5jQqPoBQemLGHKToGM-CGlfxAZRMO6y1sDzpUGfNifN3GcYxpJIq-f1MybVK1oYJoFVd9J8TkvdDlThsym_Fvb-mcZKLYAzGPO_xMW_8x8AqDraR554IuY4Szah17j9QgtrGFcYHuEmiFzWgFlIOoBCH0hzb_-zkQ5BSVvsv4GYmstW6z3Uz5Q07GLr_1slRUmjSUYiekQg55TmFO5Bm6rTw%3D%3D%7C%7Ca0AmFUYXmD4xoVDcMCSohdoT-YwCWNAerAHD6uEMv1K9DbyyDYouzrNpQ1SmlTOiyvIooLdHbgw%3D%7Cxrl5Md8q4-8glDlbUPMSt3FeMVWn2h2mj7Xw_c-0vKM%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7COgXPJEe-1ZIyuxj2MkvIpEGjjoMehD8QHNiC4OiKR_teBpTP3Sr8dmONsoG8SyRaRWUW8kSUHp20pB1Jn8qUUHKDeycf2BoMNniHpEvACUA4Sk4ZYpfQd0SvC1kD-KATmPkZyLnp5DJGDYQqTtj_ro3OQP4_Oc69GL1StC9XU1fVLfAp7A0wqxg4Z4fQxhZH9hjwR0xKhCVid2Jkr3Rb8pQqU6145Z8P5bXsMv8twoJ5t4ewgAbPRhUqjxkvO0X24WSUqubClnYGyjkf-zPH6g%3D%3D%7Cu8A6SM53vAd1h_O4ROJtLwq5PaKyqUuh%7CrOVKs0reXUTjiL-aIpkXfGE2Xr53FGjy%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7C&subBdr=196&bdrid=459&ksu=243&fdkt=391&vgde_kbbh=ffoyxQJuO&kwd[]=Die+10+Besten+Aktien&kwt[]=391&kbc[]=1300920941&kwp[]=1&kid[]=71911461&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0000%7C8%3D110314%7C13%3D0.1390%7C14%3D110322%7Cokt%3D391%7Cbkt%3D391%7Cps%3D0.368%7C53%3D2.12%7C80%3D1.31%7C12%3D1.01%7C60%3D1.53%7C1%3D1.91%7C2%3D7.62&ktd[]=274894881024&kwd[]=Kanaren+Luxusreise+Angebote&kwt[]=391&kbc[]=1300920941&kwp[]=2&kid[]=329585879&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D110314%7C13%3D0.0944%7C14%3D110322%7Cokt%3D391%7Cbkt%3D391%7Cps%3D0.368%7C53%3D0.35%7C80%3D1.31%7C12%3D0.02%7C60%3D0.22%7C1%3D0.25%7C2%3D2.21&ktd[]=4503874522251520&kwd[]=Schnelle+Low+Carb-Rezepte&kwt[]=391&kbc[]=1300920941&kwp[]=3&kid[]=326736717&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D110314%7C13%3D0.0640%7C14%3D110322%7Cokt%3D391%7Cbkt%3D391%7Cps%3D0.368%7C53%3D0.15%7C80%3D1.31%7C12%3D0.05%7C60%3D0.14%7C1%3D0.12%7C2%3D0.60&ktd[]=274894881024&kwd[]=Top+10+Kreditkarten&kwt[]=391&kbc[]=1300920941&kwp[]=4&kid[]=326438072&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D110314%7C13%3D0.0912%7C14%3D110322%7Cokt%3D391%7Cbkt%3D391%7Cps%3D0.368%7C53%3D1.64%7C80%3D1.31%7C12%3D0.59%7C60%3D0.35%7C1%3D1.25%7C2%3D3.44&ktd[]=274894881024&v=1&gdpr=1&geo=48.3%7C11.4&dlper=20&lper=100&lpid=&tsid=4&hint=&cc=DE&wsip=170774658&bca=0&ugd=4&vgde_setid=Nff&ssld=%7B%22QQNN%22%3A%22r4%22%2C%22QQN75%22%3A%22kL1zUkxL7n1YnY18z%22%2C%22QQ8E%22%3A%22HX.uHu.uXf.9%22%2C%22QQQN%22%3A%22q4%22%7D&cid=8CUWMQE3H&vi=1699067842656351586&vsid=DefVid&tdAdd[]=asnum%3D9009&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_adprefflag=11&vgd_adpref_diff=1100&vgd_fm_lang=DE&vgd_implt=3&vgd_cage=2&vgd_tsce=L307-S307&vgd_l3_sc=HE&vgd_chost=contextual.media.net&vgd_sslb=1111&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=950152417&vgd_refdomain=wheregoes.com&vgd_katbid=-103&vgd_pdtid=1&vgd_nrrv=82094&vgd_nrrmf=3001c80a&vgd_nrrsf=scrr&vgd_cty=dachau&vgd_ifrmode=13&sttm=1699067843178&upk=1699067843.27917&hvsid=00001699067843178007642542088298&verid=3111299&sbdrId=196&tsrc=entity&vgd_l1rakh=1699067842162740469&vgd_ecrid=S0300080711068000728009099999900&vgd_isiolc=1&kbbq=%26asn%3D9009&vgde_ydsp=%7B%22QEx%22%3A%22%2FKTP4nXuWX%22%7D&vgd_mcf=65213&vgd_vstrid=DefVid&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9A~e8QMQOvi9~LkMNz7vu~ONfvu~QNOvwJ~eM1Qzvi99i~ejfLMQOvf9fAuu9Afu~8xLjMGviuh9.uu~xLjM7UNv9~Q7OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~j1Q7v~e8QMxLjMGv9.hf~8Ev0V6%20c~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vuF~LNvu~LEQMQOvf9fAuu9Af9~e8QMGvW9u.F~xLjMGv9.uu~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9A~ejfLMxLjMUNv949~ejfLMxEMjvf9~GYvu~1AEMGv9.FX%2CHi.HW~Q8OvHFiiOGXWXNFH999GHGh9GFWJuhOOJfWJ~QOvou~x8OvffOXZ%200NJ-bwPRrX3F~G7OvA9hihuhFAi9WFfXAFfhFfHu9hhF9WFAFHAHif9WfHh9WXuhhHiiiufiHW9WXAWAWfFhfXWWFXFFfhXuuWFuXiiAFhhuXiFFuF9hhAuf~eBxvou~OfEMjvA9~AENkvu999~x8Yv9~eBMYJOv9.HW~OYYMQ7Lyvw1LYmz5~ejfLMxEMGv9~OfEMGv9.iF~myOfEMGv9.iu~exLjMGv9.f~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvHi.HW~exLjMjvf9~%3DVvA9Hu~UGMxNvof~z7Qvu~UGMNNUQvof~N7vkL1zUkxL7n1YnY18z~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvX~8Q8kv9~G8Ov9.9f~ONvh~ejfLMGv9.FX~8exLjMjvf9~NGOEv9.9uH~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~EmQvu~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9f9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8Qmzuf~QmGEv~w7Yjvu~ONx7vX9~OmyGv9ou~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfiH&vgd_cfud=230119&vgd_scsver=232&vgd_optout=0&vgd_ydspr=1&vgd_l2shld=1&vgd_rensize=728_90&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgde_ydata=duh%25Aru&vgd_l1cdv=1103&vgd_l1rpth=%2Fnmedianet.js&vgd_lbt=200&vgd_mbr=1&vgd_pgids=1&tdAdd[]=uiparams%3D%3Brend_w%3A728%3Brend_h%3A90&vgd_uspa=0&vgd_sc=HE&vgd_l1rhst=contextual.media.net&hvsid=00001699067843178007642542088298&rc=0&rand=1699067843519&acid=3ec8adeb6e05a40a307ab37b5459ba5d&matm=1699067843519&vgd_ltimesrc=1&vgd_ltime=616&vgd_rtime=601&vgd_etm=8&vgd_l1hcsd=Og4dd%7C7235&vgd_l1ch=1&vgd_lhl=1302&vgd_pgid=p1998541774t202311040317&vgd_csip=rtb-common-64568487bd-twxx7.BE&vgd_sbSup=1&vgd_nrrs=82094&vgd_cntrdt=SL%7CDIV-rc_046321465faf1d83c18dba5fa8efda60%7CDIV&vgd_crefurl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&vgd_eadm=1&vgd_matchstr=hr%3D0%7C&vgd_end=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sat, 04 Nov 2023 03:17:23 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 15
expires: Sat, 04 Nov 2023 03:17:23 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 06B7 52 KB
17 KB 38ms
6ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 62462
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sat, 04 Nov 2023 03:17:23 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 19 Oct 2023 09:55:51 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 3491, 342332
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230109-FRA
X-Timer: S1699067844.578516,VS0,VE0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7BBB 0
20 B 44ms
44ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B2Ve5w7dFZc_BEZSz9u8PjaqNiAgAAAAAOAHgBAI&bg=!8POl87zNAAb4oU7C2KE7ADQBe5WfOEg-t-BW5eqV1Jc9SsnI2RAHXN2mdxT4cq7GOowpHVi95DwOTtZa2pfcMCLBku81AgAAAExSAAAABWgBB5kDSC2yckxVBtDiiFrPx2k_ZYy6-ymXZNP2Ii1-WVccq4XPUEc21sCN73HL1YV3YFZXZ0HX5xu-CKWrobBN4MSZ0Ap5AdgbzFyybilRpWJSoZZtS4XAZj7Z7U6CcJ3DhZpmcp18LfHyKdsK_oWsaxp3vZWBpUZwGF3punB2AEvves6g8ofoyr04WTjsTm_T6lVNvCbA9egOlXvv2k2gBrz-RKDU8NFq60nSk-cNQku0FldPnN59cfRLPOrQbwcMM4ZbGYSMopAFhwwCYw9j_5WSR4pHlG9X0ZCa9ltHPiSmMCTPA6IEPJHII6EdkrqCHCN-xaMfmSA42mmIrXLDp-oxpQ9HFiuTCU1uHl6w9N8_IQ0hmagQQ7cvEHsCJC1ELXkNUYXVfrS_9erU28ywfSx_UOWmhcU9UP04VrvZ4ZcwRWGbwTtp3QGx4pjkQE8nzC8u60G9KYkdAxdFwwJhG97F5Mpi7sNpTH2x2UmCGaMjgKzMt539tGL7aZJFgUjDDV2QLuPRKD1JoafIC0oaFLdrGd8bJ9LzSP6QkV8v--QnpkWISYo6fnNGu_Or3ObVKbxU_T_2F8dgWFg0yv1EW3ZOthXHoujjoP9RlPWTzYD_5a7AO3g1n5R34KWYM8MWrMv5sjQj0EfNWi42_V3ciQx2xMydLYl2uHzrlXFfokkvxN9Hp4J9Z2YKjDNHipl06Go47rE09PUo3VeHctv_7Tjd-X71YJbv9nSUdf7pB9FwOY4ouacTsSxxxQ-res7jtgblfSsKQtT1i-aWVA_dKS24xw-7jYOfjsMOCXVdemCRBI7NU3Rf1OgaF9epo-OeFjziiuzZ3bKtXhbQUpXzK0jYopX4cY35q7Vz1uTalcypjW5T1Lwx_3HuRSAj2UZ8MZ656v3ObUL1vNOHTauuVIXs-OFQDLmk3xl13EYpJwlNJ9n2bQSKKEI00Oec3B0l-JORlnVJlMDbDNLUg-oILfPMyXD-R4QluGnJKI4TW0nPXBfX24GrsE072bkz1VS2X0ds2XCYzE3LVywyFvHPagFZXvtZVnfmP4zn0t1cZC5YFZNoqg_cIXVxiJOSg-2rw7UFWM-4pUr7qCeynqabsAye4nQNVEk6Bfbq0Q

Requested by

Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 vevent
fra1-ib.adnxs.com/ Frame 19F0 0
695 B 7ms
7ms Ping
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLRD_Q7BtEHAAADANYABQEIwu-WqgYQzM7SttXJyq1hGI7b3eml0PzOBCo2CQv4qNMVf5U_EUxxEx22V40_GQAAAOBRuL4_IVssoKsIkpA_KZ5GWipvR5g_MQAAAEDheoQ_MOOC9Ag4ykFA6j9IAlCdgfOlAViY1VJgAGiR92t4s4cGgAEBigEDVVNEkgEDVVNEmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAa4FaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlY2xpY2submV0JTJGcGNzJTJGY2xpY2slMjUzRnhhaSUyNTNEQUtBT2pzdl9ZM3dSMmtXTF9CQ1lfQ3F3YjRFQkdkTTZDYmxWTjlub0loNVpOTXBocWpfZzYzNXlGNi1aSDl4ckhfQnZIZWE4ZjE0QWFkbjZJU0NKTmdlM1BZZnAwNHBYc1JCR3pubDJGNzZTTERKRGxjeng5UVNsdktLZm9MY2JCdDZ4S1N1T0xqNHJ6TmdnbnpoSzBZQks2NVphdFM0MjFxbHJhTjFmWW9ONTJlMkNYb0tjNzdEWFBMbVZOeEJkZVdmc3A3MFd5eUhwaV84UmN0S3UwTDh0SjhWdGR5SnhHMGMzYmxUUUpGTjFVOGNUSHNVaXdxa2JCVUk4YW92emMxZHdVZzlMUmZNYWZLZXhkYnRBTlotQmROWVhaTl9ZOFFVZkJ2UHZDZmZYQU4wMG41Q0dUVVRQeUZjbDRSQ1otbjFwMkNROFY2NElRR1RuM2htQ1pMZm9hWGdJOUElMjUyNnNhaSUyNTNEQU1mbC1ZUy1wOXQwZlA3dmhSeDd5SHlGcl81bUZZaUxYTGpjRUNJWnBIb2xCNFFXaTQtU2ZBSVV6MnQ4RmR2NFpuZGJlZDN1bzV2b2ZhM2R2ZURmN1EyN01WZ2RKeGRQV1J1TTNTbjhmckJPTE5MVUtMQ0VmcEd1ajNWa1hrNmRDejNIME1mbld0dG1QSk1tb0E5WEJmQSUyNTI2c2lnJTI1M0RDZzBBcktKU3pHVDRMckVwZ25zWkVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQCKAlN1ZignYScsIDI5Mzg3OTUsIDApO3VmKCdpJywgNDgyMzI5OSwgMCk7dWYoJ2cnLCAxMjcyNDYzOSwgMCk7dWYoJ3InLCAzNDc5MTQzOTcsIDApO5ICjQQhYjExVm5BalkyZE1WRUoyQjg2VUJHQUFnbU5WU01BQTRBRUFBU09vX1VPT0M5QWhZQUdEdUJHZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JNNV9GT3NCR21EX0JBVE9meFRyQVJwZ195UUVBQUFBQUFBRHdQOWtCQUFBQUFBQUE4RF9nQVlPeXBnTDFBZncxd2p5WUFnQ2dBZ0cxQWdBQUFBQzlBZ0FBQUFEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHNkF3bEdVa0V4T2pZMU9UUGdBX0pFZ0FTSTE4VUVpQVNGbDhzRWtBUUJtQVFCd1FRQUFBQUFBQUFBQU1rRUFBQUFBQUFBQUFEWUJBRHhCQUFBQUFBQUFBQUFpQVhCTTZrRkFBQUFBQUFBOEQteEJRQUFBQUFBQUFBQXdRVTBNek16TXpQRFA4a0ZBQUFBNFBRNnhEX1JCUUFBQUFBQUFBQUEyUVVBQUFBQUFBRHdQLUFGd3hMd0JaX1RpQWI0QmF1dnN3R0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJnQUFBQUFBQUFBQXFBWUVzZ1lrQ1FBQUFBQUFBQUFBRVFBQUFBQUFBQUFBR1FBQUFBQUFBQUFBSVFBQUFBQUFBQUFBdUFZS2dRZzBNek16TXpQRFB3Li6aApkBIUd4R3R5UWpZMmRNVkVKMkI4NlVCR0pqVlVpQUFLQUF4QUFBQUFBQUFBQUE2Q1VaU1FURTZOalU1TTBEeVJFa0FBQUFBQUFEd1AxRUFBQUFBQUFBQUFGa0FBQUFBQUFBQUFHRUFBQUFBQUFBQUFHawmOAQEESEUBBgkBEEhnQWlRERBERHdQdy4u2AIA4AKf8D_qAhZoocDwizovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAPYBMgDANgDxdTyAeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA00NS4xNDEuMTUyLjc1qAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA0gQOODE3MCNGUkExOjY1OTPaBAIIAeAEAPAExZcgiAUBmAUAoAX_EQEYAcAFAMkFAAUBFPA_0gUJCQULQAAAANgFAeAFAfAF2p0f-gUEAW4okAYAmAYAuAYAwQYBITAAAPA_0AboKdoGFgoQCREZAXAQABgA4AYB8gYCCACABwGIBwCgBwHIB7OHBtIHDRVkASYI2gcGAV3AGADgBwDqBwIIAPAH0uADiggCEACVCAAAgD-YCAHACADSCA4IgYKEiJCgwIABEAAYAA..&s=82dd097d574b2ec298decae2c90795501add80d9&type=nv&nvt=5&jm=1140|1141|1003&px=0&py=0&bw=300&bh=250&sid=6119082551137033523&vd=ct~0|rr~0&sv=239&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=300&ph=254&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:23 GMT
an-x-request-uuid: ac0c2ed7-873e-4f06-82e0-c24549bb0d77
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 06B7 0
594 B 7ms
6ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:23 GMT
an-x-request-uuid: 4f5e2be5-cbd6-4e70-b959-aa84df4fb96b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
43ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202310310101&jk=1394095844482027&bg=!KCulK2TNAAb4oU7C2KE7ADQBe5WfOHmXbeAdGAHbBiYtisX3Xqxm66t9tXEfd8XdqaZBtae6Hv3HLUHRWne27saeJuomAgAAAR9SAAAAEWgBBwoAlAL1_Ys834QGqYdjsNlG6CKmmzXCS45Vobp6VvtBslhW1wt6XB11DWDM7KD09ZaSckCsIeRjPOXebGqvuqbqyOqMaBCoqXAkw_VdqHczWTkdK09FQbBba-u8uO3UD9vO44T5_OhRNP7OtnAQd7e5lmecjFtyDpXaG2DzPhNxDsKX4rxwFI8zdfHoKun8GI4fwRb7Nq6ZAvqjaqv8z8cqK8hnb4HfPyZuVUeg_FapDpFGMBjKIhdRE2zdPbk9ZYictq8q3eU81k9y1ywpqLMbcZd-UFxMm3TcyevTxAU1KfXcoTGh4amanl9BV99WhNIMv84yFRTzv5SHA5D-Bche4alwbI43NQJlUTsLQ8FZFFfRBlrDvn1JHIf-oSQXMM0-buoskTZe1CRORqVlYXmLCNOT7iS7OkEIhqQRDuNUXXifPXYZXYPDEAQVzTWXMhH2Ho1QRTXVsB4yOEaJ1NkGO_k9lCkmFDMUT74hlEtz75LfNlrCIsyWuLwunUw-At7VwdJ-Ji77nq3rwr82vsv49DyCsrraYz7c5IUh0TU2aJiXACFR3tQudt195Yn8I4HhH9yeSaDCkmfqCiE20LFhln6TsvE8bw4wuCjZektoqiNzqboB9XcS_BTLPTZ-yrZRaACuNGd-U_CdyZU_dNW45I43Fc1q18zkny3U-cPase-dcoubtkI9eMouhPEJu7X6-8JaYZvyrcWZzgu5xHBQW21Z6rN2qJSo1ggN6kg_YMP6RQ50bA58nWgwMUmtqK_GlBsqNhRDQVC4dx7WREUgTjPq4BYBOzARcoKzlf8pRytwgZ0mPUV6G95Ha6h9hbq39CiLEbHh7MmN6DlkLbeTfMdtgaX8O2WK0hZDPoVwzZ1MxZvmYDpAHuwyP9FU6I3Y0mWFjXUkymZ53Nn7i4dVcsMMn0SlzxJwLZvnQGJ0AAJDo5frksWkUQjFCERW-p0xiXHexKUvWQP-Fhj6z_EVYEAO_Nf-PfS9UxcuV4zqT7FYRGxFYmNfAdk8STMMkLgA9uwKKWfB-ZOq3kH0CZAzphsG9_CEdiIm8YHz__z4-PltgIITLFNKZIJKC99zgL0veFC1TJQjRmQxyXaeAe4DyRPbMTAwD21xzZb-T3srvdOXFDihk3p5aFxkGYeidqIctteFRV_MAbD674GsFQYuUQ5JplertpnurbKPOYTyEtcd5Pi7jRGyZYfK5JBufuhk1qo
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2 200 300x250.gif
creatives.sportradarserving.com/b98f1ab2-f5e3-4ac1-a78c-7252e503f599/ Frame DC1C 85 KB
85 KB 146ms
62ms Image
image/gif 2a02:26f0:11a::5f65:17b9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creatives.sportradarserving.com/b98f1ab2-f5e3-4ac1-a78c-7252e503f599/300x250.gif
Requested by: Host: usw.sportradarserving.com
URL: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::5f65:17b9 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: adb4faa2832cb1579eee87db0c922005035418d0f3198c9f136e455e6750f259

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usw.sportradarserving.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
last-modified: Thu, 13 Oct 2022 15:31:20 GMT
server: AkamaiNetStorage
etag: "206d966db37181ad5f5c5866480ff982:1665675080.81576"
content-type: image/gif
cache-control: max-age=600
accept-ranges: bytes
content-length: 87134
expires: Sat, 04 Nov 2023 03:27:24 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame DC1C 43 B
146 B 42ms
7ms Image
image/gif 52.57.96.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=2e80c1aa-9f09-453a-b106-cc62c020be6f
Requested by: Host: usw.sportradarserving.com
URL: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.96.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-96-192.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usw.sportradarserving.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 youronlinechoices_icon.png
usw.sportradarserving.com/ Frame DC1C 1 KB
1 KB 173ms
172ms Image
image/png 35.212.242.235
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usw.sportradarserving.com/youronlinechoices_icon.png
Requested by: Host: usw.sportradarserving.com
URL: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.242.235 The Dalles, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 235.242.212.35.bc.googleusercontent.com
Software: /
Resource Hash: 30c065c5189582302f1fc91edd7f8c99956f6f8bd6c4b242081f41ab1c772b08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
via: 1.1 google
last-modified: Tue, 31 Oct 2023 11:50:04 GMT
etag: 16987530041319
content-type: image/png
cache-control: max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1319

GET
H2 200 y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCs...
usw.sportradarserving.com/mimp/ Frame DC1C 43 B
112 B 173ms
172ms Image
image/gif 35.212.242.235
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usw.sportradarserving.com/mimp/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1
Requested by: Host: usw.sportradarserving.com
URL: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.242.235 The Dalles, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 235.242.212.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
content-type: image/gif

GET
H2 200 log
hblg.media.net/ Frame EBCE 35 B
191 B 18ms
18ms Image
image/gif 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=adpvlog&__q=AfIFMgCAjAQAAACAAAAAgAEAAAAIAAAEAAEAAAAAAgEEAAAAAAAAIAAAAAAAAAxQ_AQAQDNlYzhhZGViNmUwNWE0MGEzMDdhYjM3YjU0NTliYTVkwrORigeWBwRERRp3aGVyZWdvZXMuY29tEjhDVTE4ODMxST5ic2Etem9uZV8xNjQxMjI4MDI2NTk1LTRfMTIzNDU2DDcyOHg5MApldV9iZQQyMwxQUkVCSUQSOFBSVzIzSEc1DkJJRF9BUEkAPmJzYS16b25lXzE2NDEyMjgwMjY1OTUtNF8xMjM0NTYCMDxydGItY29tbW9uLTY0NTY4NDg3YmQtdHd4eDcuQkVAUzAzMDAwODA3MTEwNjgwMDA3MjgwMDkwOTk5OTk5MDACMAAGATBnZW4tdmJsdF9wcmViaWRfdGVzdF8yXzFGMjAyMzExMDMxNzExX2dlbi12Ymx0X3ByZWJpZF90ZXN0XzImZ2VuLXZibHRfcHJlYmlkX2FsbGAkTUVESUEuTkVUIEVYQ0hBTkdFAgJi&evttyp=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:24 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 04 Nov 2023 03:17:24 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 19F0 6 KB
3 KB 114ms
114ms Script
text/javascript 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=995609740&js=pmw1&base=te-clr1-ec56172c-4aac-4953-b9e6-31bb372bd743

Requested by

Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=995609740&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.100 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3ff0f6f83c76ddfdc995ceff17102561e4793de4ab6ecec1289066f78ea94476

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: FRA56-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2329
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: t9ziva_M96BP2NjsHojqqhpgCMHkmehpxpFAhSay8H3t3Gqkn2vePw==
expires: Sat, 04 Nov 2023 04:17:24 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 19F0 38 KB
12 KB 111ms
111ms Script
text/javascript 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=995609740&js=pmw2

Requested by

Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=995609740&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.100 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: FRA56-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: p1rD1isxJ9Kc_OtmMN0QbV5lsjZ2GtKBSVJbteIcXazKiixb8iORVA==
expires: Sat, 04 Nov 2023 04:17:24 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 19F0 43 B
975 B 103ms
103ms Image
image/gif 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.trustarc.com/cap?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=e7b1

Requested by

Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.100 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Origin
content-type: image/gif
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: blM2usM0fhckSka2uAGgS2A1F5Yc2e67IPod7jFBo86Pn9BjMxq11w==
expires: Sat, 04 Nov 2023 04:17:24 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 19F0 287 B
627 B 6ms
6ms Image
image/png 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by: Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-100.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: public
date: Fri, 20 Oct 2023 13:19:27 GMT
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P3
age: 1259877
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 287
x-amz-cf-id: vvCetGlnCIxgRFkezcAanha0e27HzHGnpKOBMzhegsL3UYmYNfDxIg==
expires: Sun, 19 Nov 2023 13:19:27 GMT

GET
H2 200 get
choices.trustarc.com/ Frame FC11 287 B
627 B 6ms
6ms Image
image/png 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by: Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=995609740&js=pmw2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-100.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: public
date: Fri, 20 Oct 2023 13:19:27 GMT
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P3
age: 1259877
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 287
x-amz-cf-id: WJi30NUWmvvZWtrfIQoqXsm3Gx7zM9Q6skPrG1S2xM80VSDTdEA-SQ==
expires: Sun, 19 Nov 2023 13:19:27 GMT

GET
H2 200 get
choices.trustarc.com/ Frame FC11 739 B
1 KB 7ms
7ms Image
image/png 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by: Host: f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
URL: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-100.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: public
date: Tue, 17 Oct 2023 21:12:42 GMT
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P3
age: 1490682
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 739
x-amz-cf-id: oPeYb7MbaDBSLQcsr6_4g7p__uFfSeI-koQxlo0ikCVLhKIMaECwYQ==
expires: Thu, 16 Nov 2023 21:12:42 GMT

GET
H2 200 bqi.php
lg3.media.net/ Frame EE7E 15 B
15 B 17ms
17ms Image
text/javascript 184.30.24.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=2227&lf=3&&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=950152417&vgd_tsce=L307&vgd_l2type=scs_newfl&vgd_ydspr=1&vgd_bid=348139&vgd_cdv=1103&vgd_cage=1&vgd_rensize=728_90&vgd_ren_page_h=2226&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9A~e8QMQOvi9~LkMNz7vu~ONfvu~QNOvwJ~eM1Qzvi99i~ejfLMQOvf9fAuu9Afu~8xLjMGviuh9.uu~xLjM7UNv9~Q7OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~j1Q7v~e8QMxLjMGv9.hf~8Ev0V6%20c~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vuF~LNvu~LEQMQOvf9fAuu9Af9~e8QMGvW9u.F~xLjMGv9.uu~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9A~ejfLMxLjMUNv949~ejfLMxEMjvf9~GYvu~1AEMGv9.FX%2CHi.HW~Q8OvHFiiOGXWXNFH999GHGh9GFWJuhOOJfWJ~QOvou~x8OvffOXZ%200NJ-bwPRrX3F~G7OvA9hihuhFAi9WFfXAFfhFfHu9hhF9WFAFHAHif9WfHh9WXuhhHiiiufiHW9WXAWAWfFhfXWWFXFFfhXuuWFuXiiAFhhuXiFFuF9hhAuf~eBxvou~OfEMjvA9~AENkvu999~x8Yv9~eBMYJOv9.HW~OYYMQ7Lyvw1LYmz5~ejfLMxEMGv9~OfEMGv9.iF~myOfEMGv9.iu~exLjMGv9.f~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvHi.HW~exLjMjvf9~%3DVvA9Hu~UGMxNvof~z7Qvu~UGMNNUQvof~N7vkL1zUkxL7n1YnY18z~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvX~8Q8kv9~G8Ov9.9f~ONvh~ejfLMGv9.FX~8exLjMjvf9~NGOEv9.9uH~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~EmQvu~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9f9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8Qmzuf~QmGEv~w7Yjvu~ONx7vX9~OmyGv9ou~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfiH&vgd_lbt=200&gdpr=1&mspa=0&prid=8PRVCXX19&cid=8CUWMQE3H&crid=849523371&rrr=tzR-hLcl-L9HpPpS8JQBYlmc7rcOJo2T4yq724EUEvMX3lUyGmrYsYXVyYcCXb5_&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&vi=1699067842656351586&ugd=4&cc=DE&sc=HE&bdrid=459&subBdr=196&vgd_kwrf=https%3A%2F%2Fwheregoes.com&startTime=1699067843172&l1ch=1&l1hcsd=l1!Og4dd|7235&cref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235212457%2F&mmm=uXosNfIDqEk=&buid=348139&sttm=1699067843178&upk=1699067843.27917&hvsid=00001699067843178007642542088298&acid=3ec8adeb6e05a40a307ab37b5459ba5d&verid=3111299&infr=1&stime=1699067842927&tsrc=entity&vgd_l1rhst=contextual.media.net&vgd_l1rakh=1699067842162740469&vgd_sc=HE&vgd_ecrid=S0300080711068000728009099999900&vgd_uspa=0&vgd_isiolc=1&vgd_pgid=p1998541774t202311040317&vgd_pgids=1&vgd_end=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235212457/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sat, 04 Nov 2023 03:17:24 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 04 Nov 2023 03:17:24 GMT

POST
H2 200 vevent
fra1-ib.adnxs.com/ Frame 19F0 0
694 B 7ms
7ms Ping
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLRD_Q7BtEHAAADANYABQEIwu-WqgYQzM7SttXJyq1hGI7b3eml0PzOBCo2CQv4qNMVf5U_EUxxEx22V40_GQAAAOBRuL4_IVssoKsIkpA_KZ5GWipvR5g_MQAAAEDheoQ_MOOC9Ag4ykFA6j9IAlCdgfOlAViY1VJgAGiR92t4s4cGgAEBigEDVVNEkgEDVVNEmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAa4FaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlY2xpY2submV0JTJGcGNzJTJGY2xpY2slMjUzRnhhaSUyNTNEQUtBT2pzdl9ZM3dSMmtXTF9CQ1lfQ3F3YjRFQkdkTTZDYmxWTjlub0loNVpOTXBocWpfZzYzNXlGNi1aSDl4ckhfQnZIZWE4ZjE0QWFkbjZJU0NKTmdlM1BZZnAwNHBYc1JCR3pubDJGNzZTTERKRGxjeng5UVNsdktLZm9MY2JCdDZ4S1N1T0xqNHJ6TmdnbnpoSzBZQks2NVphdFM0MjFxbHJhTjFmWW9ONTJlMkNYb0tjNzdEWFBMbVZOeEJkZVdmc3A3MFd5eUhwaV84UmN0S3UwTDh0SjhWdGR5SnhHMGMzYmxUUUpGTjFVOGNUSHNVaXdxa2JCVUk4YW92emMxZHdVZzlMUmZNYWZLZXhkYnRBTlotQmROWVhaTl9ZOFFVZkJ2UHZDZmZYQU4wMG41Q0dUVVRQeUZjbDRSQ1otbjFwMkNROFY2NElRR1RuM2htQ1pMZm9hWGdJOUElMjUyNnNhaSUyNTNEQU1mbC1ZUy1wOXQwZlA3dmhSeDd5SHlGcl81bUZZaUxYTGpjRUNJWnBIb2xCNFFXaTQtU2ZBSVV6MnQ4RmR2NFpuZGJlZDN1bzV2b2ZhM2R2ZURmN1EyN01WZ2RKeGRQV1J1TTNTbjhmckJPTE5MVUtMQ0VmcEd1ajNWa1hrNmRDejNIME1mbld0dG1QSk1tb0E5WEJmQSUyNTI2c2lnJTI1M0RDZzBBcktKU3pHVDRMckVwZ25zWkVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQCKAlN1ZignYScsIDI5Mzg3OTUsIDApO3VmKCdpJywgNDgyMzI5OSwgMCk7dWYoJ2cnLCAxMjcyNDYzOSwgMCk7dWYoJ3InLCAzNDc5MTQzOTcsIDApO5ICjQQhYjExVm5BalkyZE1WRUoyQjg2VUJHQUFnbU5WU01BQTRBRUFBU09vX1VPT0M5QWhZQUdEdUJHZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JNNV9GT3NCR21EX0JBVE9meFRyQVJwZ195UUVBQUFBQUFBRHdQOWtCQUFBQUFBQUE4RF9nQVlPeXBnTDFBZncxd2p5WUFnQ2dBZ0cxQWdBQUFBQzlBZ0FBQUFEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHNkF3bEdVa0V4T2pZMU9UUGdBX0pFZ0FTSTE4VUVpQVNGbDhzRWtBUUJtQVFCd1FRQUFBQUFBQUFBQU1rRUFBQUFBQUFBQUFEWUJBRHhCQUFBQUFBQUFBQUFpQVhCTTZrRkFBQUFBQUFBOEQteEJRQUFBQUFBQUFBQXdRVTBNek16TXpQRFA4a0ZBQUFBNFBRNnhEX1JCUUFBQUFBQUFBQUEyUVVBQUFBQUFBRHdQLUFGd3hMd0JaX1RpQWI0QmF1dnN3R0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJnQUFBQUFBQUFBQXFBWUVzZ1lrQ1FBQUFBQUFBQUFBRVFBQUFBQUFBQUFBR1FBQUFBQUFBQUFBSVFBQUFBQUFBQUFBdUFZS2dRZzBNek16TXpQRFB3Li6aApkBIUd4R3R5UWpZMmRNVkVKMkI4NlVCR0pqVlVpQUFLQUF4QUFBQUFBQUFBQUE2Q1VaU1FURTZOalU1TTBEeVJFa0FBQUFBQUFEd1AxRUFBQUFBQUFBQUFGa0FBQUFBQUFBQUFHRUFBQUFBQUFBQUFHawmOAQEESEUBBgkBEEhnQWlRERBERHdQdy4u2AIA4AKf8D_qAhZoocDwizovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAPYBMgDANgDxdTyAeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA00NS4xNDEuMTUyLjc1qAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA0gQOODE3MCNGUkExOjY1OTPaBAIIAeAEAPAExZcgiAUBmAUAoAX_EQEYAcAFAMkFAAUBFPA_0gUJCQULQAAAANgFAeAFAfAF2p0f-gUEAW4okAYAmAYAuAYAwQYBITAAAPA_0AboKdoGFgoQCREZAXAQABgA4AYB8gYCCACABwGIBwCgBwHIB7OHBtIHDRVkASYI2gcGAV3AGADgBwDqBwIIAPAH0uADiggCEACVCAAAgD-YCAHACADSCA4IgYKEiJCgwIABEAAYAA..&s=82dd097d574b2ec298decae2c90795501add80d9&type=pv&jm=1140|1141|1003&px=0&py=0&bw=300&bh=250&sf=1&sid=6119082551137033523&vd=ct~0|rr~5&sv=239&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:24 GMT
an-x-request-uuid: b40f27e8-c5c6-4ff2-b971-0a151fcaa2ef
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 93 KB
30 KB 18ms
18ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0c1ce1aa8e07e9cd49cd881147c0495b5c636dab10ab1c30ceb935b74a8c0ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 19 May 2023 17:15:21 GMT
server: nginx
etag: W/"6467aea9-175c4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Nov 2023 03:17:24 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 06B7 0
594 B 7ms
6ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:24 GMT
an-x-request-uuid: 8780c429-f558-4f6c-9ba4-71e840a89995
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 66E2 15 KB
6 KB 15ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/iponweb/blocking_script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 04 Nov 2023 03:17:24 GMT
server: Kestrel
server-processing-duration-in-ticks: 793753
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 93 KB
30 KB 50ms
25ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0c1ce1aa8e07e9cd49cd881147c0495b5c636dab10ab1c30ceb935b74a8c0ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 19 May 2023 17:15:21 GMT
server: nginx
etag: W/"6467aea9-175c4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Nov 2023 03:17:24 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 66E2
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=3&topUrl=wheregoes.com&bundle=9ktvtl92SlA0SkFtcUdPTmpVSEV2eGdCN05ablhuWUszeDQlMkJEWWVlQnc5UUZ3dENyMm5K...
https://mug.criteo.com/sid?cpp=-eQCGXxyaTB0dEFSWmFSK1IzemhDWWxhOUV1S2VpdzdheXVyYVpOVGZ1NVcxcFdHRTcxN1BoNVpFNVc0cWllem56KzJnb0FSMGpsMHJ3Mlk1d2NmVHZ2akVWUjg4N2JIbDZ0N3RlYnRqb3pXbzVMNnVQZHZrM1hpMkxVWV...

438 B
655 B

23ms
23ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=-eQCGXxyaTB0dEFSWmFSK1IzemhDWWxhOUV1S2VpdzdheXVyYVpOVGZ1NVcxcFdHRTcxN1BoNVpFNVc0cWllem56KzJnb0FSMGpsMHJ3Mlk1d2NmVHZ2akVWUjg4N2JIbDZ0N3RlYnRqb3pXbzVMNnVQZHZrM1hpMkxVWVp0U3EwTXdOaE5IRVRRWEx4ZFJVMngzeEVETTNmdzNnSHFITWoxUDE3U29rZGI3RFVnejNiV0ljdW9WT3c3R0Q2MERUN3ArdUhONkVmOGxDUnRRODRlRzA0MjdyZUUrYkxZUlZ1VE5CZ2lRSXhheng3cS9NNjJ3ZUpPUXNsMWV5bFZXd1JOQmM4YVZ1Z2d0bithazVLOUs4QWNMeGxnT0MyT1lIbzBXSURDYlhsK0pDQVc2UT18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8e1709f563e81fe2a4024e0e6c8bd90bc2bb61d02477ee05822b94bfac9d954e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:23 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 5190487
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:24 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=-eQCGXxyaTB0dEFSWmFSK1IzemhDWWxhOUV1S2VpdzdheXVyYVpOVGZ1NVcxcFdHRTcxN1BoNVpFNVc0cWllem56KzJnb0FSMGpsMHJ3Mlk1d2NmVHZ2akVWUjg4N2JIbDZ0N3RlYnRqb3pXbzVMNnVQZHZrM1hpMkxVWVp0U3EwTXdOaE5IRVRRWEx4ZFJVMngzeEVETTNmdzNnSHFITWoxUDE3U29rZGI3RFVnejNiV0ljdW9WT3c3R0Q2MERUN3ArdUhONkVmOGxDUnRRODRlRzA0MjdyZUUrYkxZUlZ1VE5CZ2lRSXhheng3cS9NNjJ3ZUpPUXNsMWV5bFZXd1JOQmM4YVZ1Z2d0bithazVLOUs4QWNMeGxnT0MyT1lIbzBXSURDYlhsK0pDQVc2UT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 321112
content-length: 0
expires: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EBCE 0
0 58ms
44ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstFw61nDTJOkmR35WVKFqaqCKuUr8GS0sUUgzEZ4PqsqWlZtuLruOcRR7UpIFx7bCHoLJ5-zBHQj_fafzaRhr9z78LK9G1KRJEUsTCTagg1Y9MB7JgquBi5ByZ4PQ_YH07H2Yaf09cNVZhvczgg_rdvD5-dv36RxGHf7jG42hNZy0Sridqzluj_7juW71ukfvTEwGc1z2D2UwtVJlGla4BTmZ72PZ5IFPZq3HFl955peJzw9DPhEytTLXcnAlO8apxROf6qtOPcuNeIkX_h4wZ-mtdaGyE-3xhrAa4MC3fgR8Ia--0eM-F6uGH9tc2MpUw7gi1w-sG7vko8mfJuJEWHV-ez4Bq86BAsF_g&sai=AMfl-YSIQogyuThDIU9CuSIolMf__mhOig2Jpda8W4EKy2AykeQcnNqJk_qWSwY1K3onqF4htXtcgdd1CGIxJ5Ia-Lfhin0rGVYew7Rj52-C2Ddj4CthSD6pVBo_QW5tXPwH56Algu_7Q91rJspbBL8&sig=Cg0ArKJSzNIwAtgVdv9aEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 04 Nov 2023 03:17:24 GMT

GET
DATA 200
OK truncated
/ Frame EBCE 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8cb8d044ed60607fbfc769c3630a10e4f92dbd80dc32f5b2edf8ea0888719d08

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7205 0
0 44ms
44ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstEgkt9cpxZ7cBg-zsoX8kZBihi2WetrX0kIBozakatzGDeA-LywTtNO87ToQEIAWxz-RsoNzvbZI0-b8Z-eKuiSeVBNMCCv150s88iKMYJEbhkQ37Agfij-lovAa2zbFALiNA1saOSggkNafsLIcNkZWsBVU4pbF8oz4aAiA14yj-wspa--xCsR2oMltmm0HFeb_OBjHHKibLm7s2MTj6Vi0jTe5KlMXzB0H4vCyIdfAZSb9TW-GqCja_AC_VZyvOgUUOCA45aoyeRQLgfM4hchykvPzzbwPIFLBnOs5Yqqr15VcID2njankqI3Q5lFuLZYdBLQgv_0jzW088t4AC2ndB4hp2TPE07OnpD4MnoPg&sai=AMfl-YQt7qjkQ0mvTLKAhrhzIa7sBeea_vc3KiBaOH57ltsGeOYT-aoXOJ15tu3SMBWStmizF_5FtHMJrWGEmYeffkbDMRqLGOTOZeCEjf1LMEyA8sePcELWmOeB9LY4iuQeYAbqYTGxJ1bDSQ-FUrs&sig=Cg0ArKJSzG0Z-3BicO-LEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/iponweb/blocking_script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 04 Nov 2023 03:17:24 GMT

GET
DATA 200
OK truncated
/ Frame 7205 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2bf619640f5d8425abb20f31cca1feb041c71099794ef717a811b48a52d01e83

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 19F0 0
0 45ms
44ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuRgvG45xAIhpfVTwtWFnt_io0hxiWwDqzFTQzfzd2D3HGXd-pKg7Hu1dB7NI6MC-BXaSAuzxyFhW0rKyLNmxyK-DSPIgLCvh8Vp7zjGQbd2ly4Cq0YZ0HOzO14lnZgucuhlpuqS73SsjpBK6iz2TBOy3VNux6wnFXK4Ge_5pBRrr-p11-GFvgI7pmVuaJ6PViPi4-bGv6jw6WzaGbQ5polDH7Ul0CprBM5YO-st0rsyB3-esXdKxq_E4fAjCZ87JIZsMsM7JSjoMhutzYIP4CJi4V2DvYlmnL5XKfDuvHHIDpQi6Fs2E2L9wcKjUfVSlD3-tBUDI4FZ5gf4isZD_bHt44GIW0N&sai=AMfl-YRk2mPt9rZ8rAWhoEbYw5IsbCAWv9Ej3Nst42sdWVoxQFgrkZT7ueWL8PyupzZXTonLRv3wKYCSI4FKEH0YO0UwK4OeTrHqXiVvsWQN5nSTQAre8aUwmSa-pLj1edtHOXBX7xNuhCth0mkDTAg&sig=Cg0ArKJSzPooZ1s5neJ1EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 04 Nov 2023 03:17:24 GMT

GET
H/1.1 204
No Content beacon
ce.lijit.com/ Frame 0404 0
0 52ms
13ms Document
text/plain 216.52.2.91
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?informer=8128488&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/iponweb/blocking_script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.91 New York, United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Sat, 04 Nov 2023 03:17:25 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap1ams1

GET
DATA 200
OK truncated
/ Frame 19F0 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4bab63e4e10c4366cc62d6851a6281348a9925465309ff6358b504e68eaf119e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCs...
usw.sportradarserving.com/vimp/ Frame DC1C 43 B
101 B 180ms
179ms Image
image/gif 35.212.242.235
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usw.sportradarserving.com/vimp/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.242.235 The Dalles, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 235.242.212.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usw.sportradarserving.com/ul_cb/content/y0C9gAxGVOLqwq6TcuVMVWAfsV0BHuGEPOFLzIH0sBG0mDtgEDbBvJRrl_39ILO_H24aUpCtab1CLOs_1bR0rNCsc_164ohjkV9trW9AFRWiDxT8BqJEAW10WV-J07-rN0ZsTkY5jenqRczAED7cFyV5bJAdKpqv-ZPcKQOmtz7U6gVyF5Zl4knnfTPoHwtUzDuCsmm7Itj4NDTGrzi-psKW9ksELwdBP3ba0IPlLs_AOq29d2M3HJ1G7f_34jwlTKB-r6YwRSUc_yUvKdNceHz0A5KSlEAc6biSPr-7c6MfSBNGBciu5IknHjyVDL8Uk09o1pblA8ZFUnQ0lA4IjrQDKRTZa9_ACy-cD79vKIYSYE3fL7kjrDOaQBzBEKDYAW0G5SPp6mV_v1bksnMhygNprdQPjvJ_uZEvw4s37cns4dGAU7rSP539y9T_sTbBlGhnI0AjAlpGIIl1iRXMBT7IUSLh82TD6hkS54dsfW87yn8EpE5uxg-e4xq7SNRyZBbE5kNm8UvaoGtSDeO5veQITyNXvS9ZuVwIb0lanPjKJdneDrDINqU3ehNLHo66MxmixskDCKVUu5GTj1vGLdHT49i2O8uwpJC-bCHf5urEskNChVFFYGB2wplZ4S6PyI_6C2VzZ_LF4xpigo4UZ3rR_sZZUYUOty5x_Z-PPVWMZsDCVLWBjpOZ0mNXhyS7Za7tmtJv61T9D9e-w0ZphRcuB71NkJ2XZnec-txgeOrCOdE8P-h3IcGnkNpP3GkzgL23-T9yPc465FsF912DMf75_SS0Lha5f6ghCbFJ1-PQAqYcXSDt4nPbPbci8AmlfrlY9-53Q42QjRBu2xiUcxL4cyHQdFQoJs2OdS7iaVehw5_pao857wopEtkzSs23LCQDMwLSMieNQTKABCtD7_if6Q_e_s3ydNCYsPw2AcAMY6_ul3t_z0zmQ_TWxknBVMZ1cgmNB7CdKHezGVXYsxL-EPDGujkLXz_X9q3_GVfToAOzFjdvDxzu19aPdw8YIJbxz5wfSG62jOB4cehaNWKGCO27XsNR7YBCf_RWHXhNsqX_H_U6y4Vvxu8hNG1LiXQG8_H-qojGBwLqpSjqOJDyJGn_XWcC9-J7QjqL8XsjHhAI6R7V9r6O0LFqDGfuVO49J4mbTmzIGpBxxXm9iqp75NAE-UHH1pLC8frMgXZ1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
content-type: image/gif

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 19F0 6 KB
3 KB 105ms
104ms Script
text/javascript 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=27432037&js=st_1&sz=300x250&c=te-3e32

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=27432037&js=st0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.100 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b51657a07bb06f8cb1d8f99cfec6131f6314aec34d21f17586ec808436a4a8ab

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: FRA56-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2249
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: HJ-NlSyzDDAbxpDOh-ZChtfWHeSjWxbCK5cbm8PqV6LZAV-4kh5gKg==
expires: Sat, 04 Nov 2023 04:17:25 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 19F0 38 KB
12 KB 8ms
8ms Script
text/javascript 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=27432037&js=st_2

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=27432037&js=st0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.100 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:57:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: FRA56-P3
cross-origin-embedder-policy: unsafe-none
age: 33612
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: QhcD8eMepU0IZ6ap-G9uf_lXQn74OSdFkjLD6Z6etR5jDEWqEdEw8w==
expires: Fri, 03 Nov 2023 18:57:13 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 19F0 43 B
977 B 104ms
104ms Image
image/gif 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.trustarc.com/cap?aid=sojern02&pid=sojern01&cid=27432037&w=300&h=250&c=4c5a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.100 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Origin
content-type: image/gif
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: wPfs8qGn_78icKtLp6-Od9Q2FCuwzwt8xSOUx8A0MqPHvBwnJ_GIhA==
expires: Sat, 04 Nov 2023 04:17:25 GMT

GET
H/1.1

204
No Content

beacon
ce.lijit.com/ Frame 9664
Redirect Chain

https://ap.lijit.com/beacon?informer=8128488
https://ce.lijit.com/beacon?informer=8128488

0
0

18ms
13ms

Document
text/plain

216.52.2.91
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.91 New York, United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Sat, 04 Nov 2023 03:17:25 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap1ams1

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/beacon?informer=8128488

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 5307 281 B
555 B 35ms
7ms Document
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 04 Nov 2023 03:17:25 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 204 /
onetag-sys.com/usync/ Frame 64F7 0
0 8ms
7ms Document
text/plain 51.75.86.98
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1699067842121

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.75.86.98 , France, ASN16276 (OVH, FR),

Reverse DNS

ip98.ip-51-75-86.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 0C19 52 KB
17 KB 6ms
6ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 62464
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sat, 04 Nov 2023 03:17:25 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 19 Oct 2023 09:55:51 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 3491, 342334
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230109-FRA
X-Timer: S1699067846.771141,VS0,VE0

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame A9F2 24 KB
9 KB 22ms
22ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2031%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C359%2C437%2C97%2C55%2C99%2C2045%2C3012%2C3011%2C3010%2C244%2C201%2C3007%2C246%2C4%2C203%2C446%2C9%2C407%2C2011%2C2055%2C2099%2C3022%2C3020%2C173%2C294%2C251%2C175%2C450%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C336%2C3014%2C337%2C459%2C339%2C70%2C77%2C38%2C182%2C261%2C141%2C262%2C461%2C222%2C301%2C345%2C225%2C468%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

a9115d432e639576e82060e4ffb1a0bb828b44db78870b9b3ac0e2f09dac0172

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=108734
content-encoding: gzip
content-length: 8541
content-type: text/html; charset=UTF-8
date: Sat, 04 Nov 2023 03:17:25 GMT
expires: Sun, 05 Nov 2023 09:29:39 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 1AD7 9 KB
4 KB 37ms
6ms Document
text/html 13.32.27.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1699067400000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-99.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c20d54555b098aef8269b6fa89b316fa731aac67e6926c1203c27edf8cf9dbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 78063
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Fri, 03 Nov 2023 09:59:46 GMT
etag: W/"ea81456e0a6e1fca0e7a864b1d3121aa"
last-modified: Mon, 02 Oct 2023 23:54:30 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 07fbd2276304c86925071791c7032950.cloudfront.net (CloudFront)
x-amz-cf-id: htyI0Cc7JfLabhhEmtMm3e4eRKPeckJFbdcdeLKTZOmXOJNiiEKgJw==
x-amz-cf-pop: FRA56-C2
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:58584356-ee8f-4de0-abcc-b50f847fba2c
x-amz-meta-codebuild-content-md5: d3f9c0952d74faa30fada14e06b377b0
x-amz-meta-codebuild-content-sha256: 8aa4841af9e8588faa6f0e126d94acab1f39eb0115dfa16eac2daccf149690d0
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 0C19 0
594 B 23ms
23ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
an-x-request-uuid: f2283af2-4c94-490b-a206-19417e9f8e82
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 5307 46 KB
13 KB 7ms
6ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 2370824014f588c0a504d6bcca32475f2684a93fa4e54071ac08aea47465433f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:25 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Nov 2023 21:07:15 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=64176
Connection: keep-alive
Content-Length: 13281
Expires: Sat, 04 Nov 2023 21:07:01 GMT

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 1354 3 KB
1 KB 115ms
32ms Document
text/html 54.220.165.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.220.165.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-220-165-75.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 006424772d23ae85c9726532f8da663e56492f50a408e5dd84e13f2b30e1cabc

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sat, 04 Nov 2023 03:17:25 GMT
etag: W/"043bf6d763fca39d5c98411c67f52ef23"
server: nginx
timing-allow-origin: *

GET
H2 204 /
onetag-sys.com/usync/ Frame B87F 0
0 7ms
7ms Document
text/plain 51.75.86.98
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.75.86.98 , France, ASN16276 (OVH, FR),

Reverse DNS

ip98.ip-51-75-86.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 0A40 727 B
977 B 125ms
20ms Document
text/html 185.86.138.151
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.151 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 2e1a54e6232e3869499e231b93d349492340b927e7ec9d8453e04e6bf7fca879

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 727
content-type: text/html
date: Sat, 04 Nov 2023 03:17:25 GMT

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 00FF
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
904 B

21ms
20ms

Document
text/html

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd08a8d663c25a4315657ecf87d24da0d9a4d6f3657d31dbb81a799fdabfea1f

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8209b434bb5a37f5-FRA
content-encoding: br
content-type: text/html
date: Sat, 04 Nov 2023 03:17:25 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rsRp3w1LxAAdXgiMFYYAqE4PcUYHC12aYLxhRHsvOIbshdeX9aBKCr2%2FeI7e4Dwsu6xOiuz%2BT6%2FtjBa%2B4wS7%2B5mMaax7o1Wa4QinuKdkyHQBL%2FeD0iZei6pmdlj49OVCWWfcMlqpXG6aQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8209b4349b3b37f5-FRA
content-length: 0
date: Sat, 04 Nov 2023 03:17:25 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QRetgBTrBJ93MYQgXj7tU2Xw2yKhfYWHOCh%2FqQ8e6o5mMN17EaRSjxOKNzxHMfOWFYFoq0nXi3KUUBBqcSsmDLisVWjALVEj8NGlnEAbibvf7QH4P7Qdyn%2F2b6lDuqCbAfPMW4hc2QRuZg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 7BB6
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
555 B

7ms
6ms

Document
text/html

184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 04 Nov 2023 03:17:25 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 04 Nov 2023 03:17:25 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 719C 15 KB
6 KB 39ms
7ms Document
text/html 184.30.16.195
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.16.195 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-16-195.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=63368
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Sat, 04 Nov 2023 03:17:25 GMT
expires: Sat, 04 Nov 2023 20:53:33 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 74A3 0
525 B 143ms
99ms Document
text/html 2600:9000:2057:de00:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:de00:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-length: 0
content-type: text/html
date: Sat, 04 Nov 2023 03:17:25 GMT
server: istio-envoy
via: 1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)
x-amz-cf-id: cglw4Mq0n3sdIBOpQHQI6Anff7fmlIM37OZyEy3cxarQoV7wPH2EDw==
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to GDPR policy: gdpr is not applied

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 5EB5 0
160 B 51ms
14ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Sat, 04 Nov 2023 03:17:25 GMT
Pragma: no-cache
Server: nginx

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame 49E5 0
370 B 312ms
104ms Document
text/html 34.224.234.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.224.234.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-234-145.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-length: 0
content-type: text/html
date: Sat, 04 Nov 2023 03:17:26 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to GDPR policy: gdpr is not applied

GET
H2

200

sync
ads.servenobid.com/ Frame 1AD7
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=332688589218868622

0
343 B

33ms
32ms

Image
image/avif

54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=332688589218868622
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
an-x-request-uuid: 1097e07c-6839-4556-81bd-2c711846c7b0
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ads.servenobid.com/sync?pid=312&uid=332688589218868622
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 1AD7
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=HmQlpRZH26hy3GNgTpuA1f56

0
349 B

33ms
33ms

Image
image/avif

54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=HmQlpRZH26hy3GNgTpuA1f56
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:25 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=HmQlpRZH26hy3GNgTpuA1f56
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 1AD7 0
277 B 323ms
193ms Image
text/plain 63.251.14.14
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS: 14.14.251.63.unassigned.ord.singlehop.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sat, 04 Nov 2023 03:17:26 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1sea1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 1AD7
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1699067845874
https://ad.turn.com/r/cs?pid=45&rndcb=7481161175
https://sync.1rx.io/usersync/turn/3259655685575554287?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-1865e6a8-b...
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003

43 B
163 B

20ms
20ms

Image
image/gif

185.86.138.155
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Server: 185.86.138.155 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003
date: Sat, 04 Nov 2023 03:17:26 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX1865e6a8b1174e4898b6a0a5234f9a4d003
content-type: text/html

GET
H2

200

sync
ads.servenobid.com/ Frame 1AD7
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5124322329341146070

0
344 B

35ms
35ms

Image
image/avif

54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5124322329341146070
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5124322329341146070
Date: Sat, 04 Nov 2023 03:17:25 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 usa
sync.go.sonobi.com/ Frame 1AD7 0
401 B 287ms
93ms Image
text/plain 69.166.1.34
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.166.1.34 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:26 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-6-169
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 1AD7
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0

0
252 B

33ms
33ms

Image
image/avif

54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0
date: Sat, 04 Nov 2023 03:17:25 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 0
server: envoy
content-length: 0

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58559/ Frame 1AD7 0
15 B 53ms
10ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58559/occ

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame 1AD7
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://ads.servenobid.com/sync?pid=346&uid=ua-42cf5ba2-5caf-3140-a954-df8914f4167c

0
358 B

35ms
35ms

Image
image/avif

54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=346&uid=ua-42cf5ba2-5caf-3140-a954-df8914f4167c
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:26 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=346&uid=ua-42cf5ba2-5caf-3140-a954-df8914f4167c
pragma: no-cache
date: Sat, 04 Nov 2023 03:17:26 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58632/ Frame 1AD7 0
125 B 52ms
9ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58632/occ

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 v1
match.sharethrough.com/universal/ Frame 1AD7 0
35 B 44ms
6ms Image
text/plain 3.127.86.108
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/universal/v1?supply_id=KW3eSFMR&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.86.108 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-86-108.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 1AD7
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D353%26uid%3D%3Cvsid%3E
https://ads.servenobid.com/sync?pid=353&uid=0000EEA

0
336 B

36ms
34ms

Image
image/avif

54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=353&uid=0000EEA
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Sat, 04 Nov 2023 03:17:25 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
location: https://ads.servenobid.com/sync?pid=353&uid=0000EEA
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
x-mnet-hl2: E
expires: Sat, 04 Nov 2023 03:17:25 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EBCE 42 B
174 B 45ms
44ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsubmdiOzh_Yh22Wyjkf-JnLm2xHYqnp85cULmlLc0_dx9CghAaJltE1upkMZnJcfc1E4ONumtEMelp2tOhFo6zSqUvsgKYxTh2e6saJ_bRBKHRvGb4iVpA9sj0bTwxdUqslJJVrTo3xkg&sig=Cg0ArKJSzCN4fDxDIl-NEAE&id=lidar2&mcvt=1004&p=440,436,534,1164&mtos=0,1004,1004,1004,1004&tos=0,1004,0,0,0&v=20231101&bin=7&avms=nio&bs=1600,1200&mc=0.95&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699067842877&rpt=1945&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 5307 7 B
380 B 82ms
7ms XHR
application/json 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 402fba8a82f093def2459220061c8d31
Expires: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 7BB6 46 KB
13 KB 7ms
7ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 2370824014f588c0a504d6bcca32475f2684a93fa4e54071ac08aea47465433f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:25 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Nov 2023 21:07:15 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=64176
Connection: keep-alive
Content-Length: 13281
Expires: Sat, 04 Nov 2023 21:07:01 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 719C 0
42 B 67ms
13ms Script
text/plain 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=53139239&p=162412&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:23 GMT
content-length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 00FF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZUW3xaabaQdcc6JGT.TktAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHKMvG_JzD5-qHzI6t_fSGg&google_cver=1&google_hm=2

43 B
773 B

25ms
24ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHKMvG_JzD5-qHzI6t_fSGg&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mz%2BNwAa0iyKWUp6SgG5R%2FR4AL5LQ%2BVIQyIgkbtV1c%2B2iL6SIhPYZwgpZwlS59kmwjbSNMUf2asgecM6FZsygFnzSwPcuySyYiKYgvm%2BAhpXzdP4tN1nK8EPOo%2FCRO0dcgqYnk%2BojF4uVrg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8209b4355d763643-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHKMvG_JzD5-qHzI6t_fSGg&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 00FF
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

125ms
125ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 0EMJ8CGCMJK2N6B2PX4D
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: GM45SMBR4FRCKCCEW26S
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 00FF 70 B
148 B 99ms
31ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 00FF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESECtExVRRv4X22wkr18uNj3M&google_cver=1

43 B
735 B

25ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESECtExVRRv4X22wkr18uNj3M&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tRZDtJwAFh5hy%2BemQVtDTDQi4Yt2CzM9BqFWIJ3NK8hfgmvUJK0DNrZRWJW4s8fLJ6ulh34dE%2BWP4pUUTHPUWV0ydNAnej4zYaEEZjQqCwOegHxgfMnj5ucDHgI%2BLwwPf2glpng%2F9NIJVw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8209b4355d773643-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESECtExVRRv4X22wkr18uNj3M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 00FF
Redirect Chain

https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=bdd26fe8-403f-454e-933c-d85e27ad8375&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null

43 B
475 B

18ms
18ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=bdd26fe8-403f-454e-933c-d85e27ad8375&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kxDXGz50R%2Fc0%2B8tzgayttqJLR8j8DYAk5GJrz%2BoByUljCR%2F4m9Q4m4d9ndttO6HK3Piohr%2BBQNTVCObEuhV8j0UY3e1pxJmKz2CFdm2Nn44rVf0cu1XbHslL3PeST3RQReOeCXS6jnfqbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache
cf-ray: 8209b4357d7d3643-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=bdd26fe8-403f-454e-933c-d85e27ad8375&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
date: Sat, 04 Nov 2023 03:17:25 GMT
server: _
content-length: 0

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 00FF 0
75 B 56ms
20ms Image
text/plain 185.86.138.151
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.151 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
content-length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 00FF
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=

43 B
733 B

19ms
19ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B5%2Bdf1u%2Btz9Pt8as3rXFAKfmdNvWN0lZGufR04Bkn%2F6VLn8%2F6Vq7yvqckS9EHofKsfmFbt3M6K8oini9kzSlcLtPkrlHTwj2KnSOyGyqgr2NPa8oWII6ikhQmv5trYxpdsHaE8LfgFd5FA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8209b4373e6b3643-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H2 200 ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 00FF 43 B
601 B 108ms
34ms Image
image/gif 2a05:d018:d29:3605:7dd5:b158:1cf:8f7c
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:7dd5:b158:1cf:8f7c Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2 200 sync
ads.servenobid.com/ Frame 00FF 0
356 B 33ms
33ms Image
image/avif 54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=ZUW3xaabaQdcc6JGT-TktAAADUQAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 7BB6 7 B
380 B 14ms
7ms XHR
application/json 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 402fba8a82f093def2459220061c8d31
Expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1354
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=332688589218868622

35 B
250 B

118ms
31ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=332688589218868622
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:25 GMT
an-x-request-uuid: 8a0a6d2c-392e-49e5-9241-556679bf2391
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://usersync.gumgum.com/usersync?b=apn&i=332688589218868622
x-proxy-origin: 45.141.152.75; 45.141.152.75; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
x.bidswitch.net/ Frame 1354
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_4c1acf6e-2d09-4198-a408-a4548b34e51b&gdpr=0&gdpr_consent=&us_privacy=1---
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=5ce29485-e68e-43f2-876a-7f0a20f00fb3&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=5ce29485-e68e-43f2-876a-7f0a20f00fb3&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=850b38bb-96e3-49ec-b9e5-8e394ed2f754&ssp=gumgum2&expires=30&user_group=5&bsw_param=5ce29485-e68e-43f2-876a-7f0a20f00fb3

43 B
145 B

7ms
6ms

Image
image/gif

52.57.96.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=4&user_id=850b38bb-96e3-49ec-b9e5-8e394ed2f754&ssp=gumgum2&expires=30&user_group=5&bsw_param=5ce29485-e68e-43f2-876a-7f0a20f00fb3
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.57.96.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-96-192.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:26 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=4&user_id=850b38bb-96e3-49ec-b9e5-8e394ed2f754&ssp=gumgum2&expires=30&user_group=5&bsw_param=5ce29485-e68e-43f2-876a-7f0a20f00fb3
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1354
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=c4f491a5-c4bf-43b2-b7f5-3a4d89d4f43c

35 B
250 B

90ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=c4f491a5-c4bf-43b2-b7f5-3a4d89d4f43c
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Sat, 04 Nov 2023 03:17:25 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=c4f491a5-c4bf-43b2-b7f5-3a4d89d4f43c
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1354
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-0c18c777-be21-5eff-5ba2-996a2945234c$ip$45.141.152.75

35 B
250 B

31ms
31ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-0c18c777-be21-5eff-5ba2-996a2945234c$ip$45.141.152.75
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-0c18c777-be21-5eff-5ba2-996a2945234c$ip$45.141.152.75
Date: Sat, 04 Nov 2023 03:17:26 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H2 200 gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 1354 43 B
426 B 63ms
32ms Image
image/gif 2a05:d018:d29:3605:7dd5:b158:1cf:8f7c
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:7dd5:b158:1cf:8f7c Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1354
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=e99ba43a-891b-4d2f-b6e1-11f0cc011511

35 B
250 B

30ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=e99ba43a-891b-4d2f-b6e1-11f0cc011511
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=e99ba43a-891b-4d2f-b6e1-11f0cc011511
Date: Sat, 04 Nov 2023 03:17:26 GMT
Connection: keep-alive
X-CI-RTID: 719aa74e-eca9-4adc-9f92-c1b2d59cb46e
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 200 142
match.deepintent.com/usersync/ Frame 1354 0
44 B 291ms
92ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:26 GMT
content-length: 0
server: a

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1354
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_4c1acf6e-2d09-4198-a408-a4548b34e51b&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://b1sync.zemanta.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=0&gdpr_consent=&puid=e_4c1acf6e-2d09-4198-a408-a4548b34e51b&s=2&us_privacy=...
https://usersync.gumgum.com/usersync?b=zem&i=i1jTtxPdJ_MM8mEkFF6h&gdpr=0&us_privacy=1---

35 B
250 B

31ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=i1jTtxPdJ_MM8mEkFF6h&gdpr=0&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&i=i1jTtxPdJ_MM8mEkFF6h&gdpr=0&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1354
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=0LcIwtC2icE4&ev=1&pid=558355

35 B
250 B

64ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=0LcIwtC2icE4&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: de-DE
location: https://usersync.gumgum.com/usersync?b=pln&i=0LcIwtC2icE4&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-59d47cf7f8-bft96
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1354
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=6941574527119041952

35 B
250 B

112ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=6941574527119041952
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=6941574527119041952
date: Sat, 04 Nov 2023 03:17:25 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 1354 0
357 B 35ms
32ms Image
image/avif 54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_4c1acf6e-2d09-4198-a408-a4548b34e51b
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame CECC
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1301&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=adf&i=8594235081752525190&gdpr=0&gdpr_consent=

35 B
208 B

56ms
35ms

Document
image/gif

54.220.165.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=adf&i=8594235081752525190&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.220.165.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-220-165-75.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Sat, 04 Nov 2023 03:17:26 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sat, 04 Nov 2023 03:17:26 GMT
expires: -1
location: https://rtb.gumgum.com/usersync?b=adf&i=8594235081752525190&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame 7155 170 B
243 B 23ms
17ms Document
image/png 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV80YzFhY2Y2ZS0yZDA5LTQxOTgtYTQwOC1hNDU0OGIzNGU1MWI=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Sat, 04 Nov 2023 03:17:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 5223 15 KB
6 KB 8ms
7ms Document
text/html 184.30.16.195
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.16.195 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-16-195.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=63368
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Sat, 04 Nov 2023 03:17:25 GMT
expires: Sat, 04 Nov 2023 20:53:33 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame F645 70 B
149 B 50ms
30ms Document
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 70
content-type: image/gif
date: Sat, 04 Nov 2023 03:17:25 GMT
server: Kestrel

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F8EF
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZUW3x8Co8XcAAHHL4UUAAAAA

35 B
250 B

31ms
30ms

Document
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZUW3x8Co8XcAAHHL4UUAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sat, 04 Nov 2023 03:17:27 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Sat, 04 Nov 2023 03:17:27 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZUW3x8Co8XcAAHHL4UUAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 0
X-SO-HostName: a-ad40192.dc2p.scaleout.jp
X-SO-IP: 45.141.152.75
X-SO-Key: ZUW3x8Co8XcAAHHL4UUAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":true,"ipv4":"0.0.0.0","key":"ZUW3x8Co8XcAAHHL4UUAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40192"}
X-SO-LB-Hostname: m-tgng19.dc4p.scaleout.jp
X-SO-Upstream-ID: a-ad40192

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame DF42
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=lVEDzi8L9Li70mUvkh4f&pi=gumgum&tc=1

35 B
250 B

32ms
31ms

Document
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=lVEDzi8L9Li70mUvkh4f&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sat, 04 Nov 2023 03:17:26 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Sat, 04 Nov 2023 03:17:26 GMT Sat, 04 Nov 2023 03:17:26 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=lVEDzi8L9Li70mUvkh4f&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 3CF3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
555 B

7ms
7ms

Document
text/html

184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 04 Nov 2023 03:17:25 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 04 Nov 2023 03:17:25 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 sync
ads.servenobid.com/ Frame 0A40 0
344 B 34ms
33ms Image
image/avif 54.78.176.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=6941574527119041952&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.78.176.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-176-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

p
a.audrte.com/ Frame 0A40
Redirect Chain

https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=MmU4Wk5TbnhjQnNRNm1STlY2SmMtNzczQQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZ...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZDJlOFpOU254Y0JzUTZtUk5W...
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx...
https://a.audrte.com/a?adform_uid=8594235081752525190&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1M...
https://rtb-csync.smartadserver.com/redir/?partnerid=141&partneruserid=2e8ZNSnxcBsQ6mRNV6Jc-773A&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991...
https://a.audrte.com/match?uid=6941574527119041952&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent=
https://a.audrte.com/p?

68 B
424 B

33ms
32ms

Image
image/png

52.18.201.158
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p?
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 52.18.201.158 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-201-158.eu-west-1.compute.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:26 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Sat, 04 Nov 2023 03:17:26 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com/p?
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 0A40
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3D72348060-38ad-4586-8e4f-f1e2a8e789b3%26id%3DSMART_USE...
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=6941574527119041952&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=6941574527119041952&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

214ms
136ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=6941574527119041952&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 80X0P8TMDPGDA5Q3C7DY
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 04 Nov 2023 03:17:26 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: N7VCRJTBGM49NXX4HGAD
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=6941574527119041952&gdpr=0&gdpr_consent=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 0A40
Redirect Chain

https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=80&&partneruserid=VXwFOAF-UjtOeQQ6U3AcNVJ8BTVOeAA-Ans-3LNc

43 B
163 B

58ms
20ms

Image
image/gif

185.86.138.155
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=80&&partneruserid=VXwFOAF-UjtOeQQ6U3AcNVJ8BTVOeAA-Ans-3LNc
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.138.155 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:26 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://rtb-csync.smartadserver.com/redir/?partnerid=80&&partneruserid=VXwFOAF-UjtOeQQ6U3AcNVJ8BTVOeAA-Ans-3LNc
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 0A40
Redirect Chain

https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent=
https://ad.turn.com/r/cs?pid=45&rndcb=6726801966
https://sync.1rx.io/usersync/turn/3331713279613482223?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-1865e6a8-b...
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003

43 B
163 B

20ms
20ms

Image
image/gif

185.86.138.155
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.138.155 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 03:17:25 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-1865e6a8-b117-4e48-98b6-a0a5234f9a4d-003
date: Sat, 04 Nov 2023 03:17:26 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX1865e6a8b1174e4898b6a0a5234f9a4d003
content-type: text/html

GET
H2 200 get
choices.trustarc.com/ Frame CD25 287 B
627 B 7ms
7ms Image
image/png 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-100.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: public
date: Fri, 20 Oct 2023 13:19:27 GMT
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P3
age: 1259878
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 287
x-amz-cf-id: Ftj-zDqqsge_TB7Br1GaInW9fBBj5qmD0UIVMD4oyebQmyO9s6goRw==
expires: Sun, 19 Nov 2023 13:19:27 GMT

GET
H2 200 get
choices.trustarc.com/ Frame CD25 739 B
1 KB 8ms
7ms Image
image/png 52.222.214.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-full-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-100.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: public
date: Tue, 17 Oct 2023 21:12:42 GMT
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P3
age: 1490683
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 739
x-amz-cf-id: zeX5bxTqADXglKqWfXqiF1yHCc0_bYbzRYI0L0HasLFb3hmK18Dg_Q==
expires: Thu, 16 Nov 2023 21:12:42 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 19F0 42 B
64 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuy7h5QwcoO990tqPQZSXnKDGs4Z5pbgO2t1dRq96WHvLQ7rWj_NnKnWw_crAlS0o2po_AV74n4JG955rgQ4wS72elKvqmtqJFFlTyhJMX0CmrFq2ABVnZIsA&sig=Cg0ArKJSzAAUdaKSi7XxEAE&id=lidar2&mcvt=1026&p=0,0,250,300&mtos=1026,1026,1026,1026,1026&tos=1026,0,0,0,0&v=20231101&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=545847862&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699067842890&rpt=2059&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 19F0 42 B
64 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsugCwMZGp18KcJa6EBo8aDzDoLbEUOROipp6rYzZSwU2YF0fsvIuCCcDBSJM0vIy-JEPtzEPUD-cUBnGdlEpY7xXzy3C7TiZW3HdCKIRST2V-5CR-3z3QL9_l_lelsVchiOpXAsrQORUw&sig=Cg0ArKJSzCoTW9ksqAXSEAE&id=lidar2&mcvt=1028&p=666,1091,916,1391&mtos=1028,1028,1028,1028,1028&tos=1028,0,0,0,0&v=20231101&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699067842890&rpt=2055&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f35e5a4d9203809dfe64d43db882fb64.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Nov 2023 03:17:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3CF3 46 KB
13 KB 7ms
7ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 2370824014f588c0a504d6bcca32475f2684a93fa4e54071ac08aea47465433f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sat, 04 Nov 2023 03:17:25 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Nov 2023 21:07:15 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=64176
Connection: keep-alive
Content-Length: 13281
Expires: Sat, 04 Nov 2023 21:07:01 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 3CF3 7 B
380 B 7ms
7ms XHR
application/json 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 402fba8a82f093def2459220061c8d31
Expires: 0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 0C19 0
594 B 7ms
6ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS