intercelestial.com Open in urlscan Pro
2606:4700:3030::ac43:c58d Public Scan

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://intercelestial.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
166 B 58ms
20ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://intercelestial.com
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
960 B 241ms
188ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-18-184-139-185.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

b7525a8232c811cf75cdd9067cf73f19a98803cadff00bae99526091ce3192c3

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
an-x-request-uuid: ab096f8d-cf06-4838-bf2e-36aa0f63807c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 6 KB
3 KB 363ms
215ms XHR
application/json 18.184.139.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.52.0&referrer=https%3A%2F%2Fintercelestial.com%2F&tmax=1500

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.184.139.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ee80fcc073d628802362399903f7cba6ecf317da844e220548b70a51a69ed254

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
accept-ch: sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 12 KB
6 KB 307ms
259ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

53b2cd60c283f497cf7fe025ac00f50c59158abf7cca8d835adba8c6caf5c964

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
content-encoding: gzip
an-x-request-uuid: f0a71ac0-d204-4c60-872a-fcf27dbcfd1a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
317 B 189ms
166ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=825836
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf40b641efaf9197a336d899eee576a06e692bdbc3bb03d50f4a9ed78eaf153d

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q4FbbMMncruTheCTxjEP3zyEKMWTcH2EG6X0%2B1CLcQIXwZBT46Bf3X2Ey%2Bk%2FJAmCeEAiQ09ZEByRX%2FivICsz6oPPD1kzy285CCR%2FN1VqtyFmSj2mynl0AOPJskCE9FwZT%2BD%2F6I8F"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7f1ebcd03ea41e6c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
365 B 31ms
12ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ec2-18-184-139-185.eu-central-1.compute.amazonaws.com

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://intercelestial.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
165 B 57ms
20ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://intercelestial.com
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 6 KB
3 KB 352ms
212ms XHR
application/json 18.184.139.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.52.0&referrer=https%3A%2F%2Fintercelestial.com%2F&tmax=1500

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.184.139.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

04e6c70d20c621618caad6e3e67dfc3e80c65d49e66c62836c0db8a5bf69a2ea

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
accept-ch: sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 2832
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 310 B
660 B 228ms
173ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=16&rp_schain=1.0,1!adinplay.com,ICL,1,,,&rf=https%3A%2F%2Fintercelestial.com%2F&tg_i.domain=intercelestial.com&tg_i.page=https%3A%2F%2Fintercelestial.com%2F&tk_flint=pbjs_lite_v7.52.0&x_source.tid=2d4d1faf-4938-4678-b6f1-b7edb2aee06e&l_pb_bid_id=26b9530aebb918e&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=2d4d1faf-4938-4678-b6f1-b7edb2aee06e&rp_maxbids=1&slots=1&rand=0.11876415890820069
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 4af9e1a170bb9872713cd3a5733fc62785a21df23657b88ad08e77a753024c5c

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 310
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
365 B 25ms
11ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://intercelestial.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
165 B 74ms
38ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://intercelestial.com
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
961 B 223ms
184ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-18-184-139-185.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

7d1147b21ed4b3fa633c746f215490c2933dd8fee5ccc344fe83a9121f838e53

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
an-x-request-uuid: 13531aba-36ff-464e-980b-cf64b8b53834
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 310 B
837 B 212ms
162ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=14&rp_schain=1.0,1!adinplay.com,ICL,1,,,&rf=https%3A%2F%2Fintercelestial.com%2F&tg_i.domain=intercelestial.com&tg_i.page=https%3A%2F%2Fintercelestial.com%2F&tk_flint=pbjs_lite_v7.52.0&x_source.tid=8ff97e14-527d-47c1-8cfd-fd4def4933f7&l_pb_bid_id=343514aa662c179&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=8ff97e14-527d-47c1-8cfd-fd4def4933f7&rp_maxbids=1&slots=1&rand=0.6904224482538439
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: c1e08ae8819b9f1d8d3ccb97c89ffee31c3d2e57cb34939893fc6db3074c7efe

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 310
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
561 B 159ms
143ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=825825
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfe4c6b54659c9c41ce8aac0dec9dee4fff9e29401764038c3e938fb0d327eda

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wq2g%2B%2FjxratsK6%2BdPHNG8Wl%2B%2FUtF3xgdZNeOJs35jYocqG%2FH5zJ0xJiFExCs8OGLyVwr7YcRWDqRFD55xOgDVbv0v%2FRmlNk1%2FcaMoB5J%2BZ%2BlEuUoyRwx%2BvTdhD%2ByDEoYKDBgYuem"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7f1ebcd03ea51e6c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
528 B 187ms
54ms XHR
application/json 18.184.139.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.52.0&referrer=https%3A%2F%2Fintercelestial.com%2F&tmax=1500

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.184.139.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
accept-ch: sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
165 B 73ms
37ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://intercelestial.com
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
365 B 20ms
11ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://intercelestial.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 311 B
686 B 326ms
281ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=117&rp_schain=1.0,1!adinplay.com,ICL,1,,,&rf=https%3A%2F%2Fintercelestial.com%2F&tg_i.domain=intercelestial.com&tg_i.page=https%3A%2F%2Fintercelestial.com%2F&tk_flint=pbjs_lite_v7.52.0&x_source.tid=dc3195a8-6832-420f-89b6-ac9366a22930&l_pb_bid_id=4407f60a9febf7d&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=dc3195a8-6832-420f-89b6-ac9366a22930&rp_maxbids=1&slots=1&rand=0.5031702207051052
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 6c07efd147134635ad99e9a1a4ec755e5c480d0f1b89277349a18f7a5efc5ec4

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 311
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
309 B 175ms
164ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=825820
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0121e433965a2a280d89a51567b4142fd6de300831056856ac990a22c9f1d5b0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oqD0BMSCz9GVbXopI39KSjOEqzAaPYWbT7d6Acopvp2I2hgyBMWzHf1nIgaswTGKRPIHbIew%2FV2ibLICfb3DCJqzAB54epAL9urRQnxMvPj0zZ%2FcgqfXUeH7u8Fx9%2FcCorv4iPdB"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7f1ebcd03ea61e6c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 138 B
699 B 39ms
7ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

nginx/1.21.3 /

Resource Hash

488279ac25f8f3efcd2159ba6bd58edf54639cdedbece4f902f6b2c9f6f8a798

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
an-x-request-uuid: 005f462d-0085-4017-8391-e2be33e480f0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 138
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 28ms
17ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 29774
x-jsd-version: master
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230042-FRA, cache-jnb7027-JNB
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zAEzGLouaLnXsOz2tSx2T5xmU3deZT4g8IOwmNWgfRANwb9oablMqxytKMapMzm%2BPKpgH1jNKeR7D5VqnyJPYvG%2BfAbYqLtnW4H1xLfHliuNao9bR9vGYOamdghGzAiwiyCDb9Nq%2FdbAul5P9s8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 7f1ebcd05de83a7e-FRA

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 112 KB
26 KB 67ms
22ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0c750b97759124bffe209a81cfb7a3aa05dd20ca1168314348cb865254f1ce2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:35 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 02 Aug 2023 11:32:19 GMT
server: cloudflare
x-amz-request-id: S6NJHAT78962V74G
age: 2026
etag: W/"25c6f4638264ba52fb77e06351d38d61"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7f1ebcd09df93a68-FRA
x-amz-id-2: pULxqnHz94H+gKRNhEEwAQGfnJCvxCVztYEUKpBMzyXT9kEsO5GJZ0qqcvPfABHnAn1qa/6Epno=

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 69ms
38ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:35 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 005618c661d23d6bd83ccec122fe9e60
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 38 KB
12 KB 39ms
9ms Script
text/javascript 99.84.88.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.88.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-91.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0c2ec1f2d626ab278d81abe34d30681f0007e8c79a890165f27e3e1550e99b7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:15:11 GMT
content-encoding: gzip
via: 1.1 5b3be43b5ff3292b36e9c737ff94254a.cloudfront.net (CloudFront)
last-modified: Wed, 31 May 2023 20:34:33 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-C1
age: 1225
x-amz-server-side-encryption: AES256
etag: W/"550ead3a95bd6cfcd917d45c5f8f4553"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: bSbpBk29iYAyO2B6Pvi_KcLQD9Z3-NGu1-Af7dFM-boJaj1v4eTPXw==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 57ms
6ms Script
text/javascript 2600:9000:225b:1600:a:e047:753:be1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225b:1600:a:e047:753:be1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: null
Date: Sat, 05 Aug 2023 01:26:26 GMT
Via: 1.1 1a45d1e1304c39dfa9b034c2308f4976.cloudfront.net (CloudFront)
Last-Modified: Thu, 04 May 2023 00:14:06 GMT
Server: AmazonS3
X-Amz-Cf-Pop: MUC50-P1
Age: 36550
x-amz-server-side-encryption: AES256
ETag: "4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1858
X-Amz-Cf-Id: nQ-6rk9gEDVlTeA2Uj8E_Vm0svuqyIf7jH7a7sFEH23AAkpis8Ts0w==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 53ms
9ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 23:58:04 GMT
content-encoding: gzip
age: 819451
x-guploader-uploadid: ADPycdsJEoGEdACkPhEpLcadnh3aQlj77UDinvOmb6bbnYP4ZBIZ1c4FNa4dKEFL9W-lxAEBMvtWjPiKZu_LC3LquNuUVfFyLVER
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 25 Jul 2024 23:58:04 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 58ms
26ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

b118568858df50612fa3591132d6d6bb41ddf00f8c74ad8cccd16e5510691aad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Jul 2023 13:25:47 GMT
server: nginx
etag: W/"64ad585b-a980"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 06 Aug 2023 11:35:35 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 940 B
468 B 196ms
194ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=2312113634698447&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_interstitial&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=3&adks=4159574851&didk=3522135470&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235335735&lmt=1691235335&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcYrvzsq5wxSABSAghkEhcKCHJ0YmhvdXNlGK787KucMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSFAoFb3BlbngYr_zsq5wxSABSAghkEhsKDGlkNS1zeW5jLmNvbRiu_OyrnDFIAFICCGQ.&dlt=1691235335028&idt=621

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e50ab14e8c13ed52ffa484d33f551c9c6f93e8c6f087296cab065b73caf55236

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:35 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 437
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B0A2 6 KB
3 KB 79ms
16ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:35 GMT
expires: Sun, 04 Aug 2024 11:35:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/ 37 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad426d1dc2d0d527e2ad3f0e36344c25d9893546a49353e19bd991bd1b1638a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:01:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2021
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13114
x-xss-protection: 0
server: cafe
etag: 13739258740327089956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sun, 04 Aug 2024 11:01:54 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 103ms
29ms XHR
application/json 18.203.192.232
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.192.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-192-232.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 58c383f65b43f64a1de983ad01ef889ee1a0beefe92e12d0016098bc152adc78

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache
x-server: 10.45.14.225
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fintercelestial.com%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fintercelestial.com%2F&rid=esp&cc=1

85 B
194 B

119ms
118ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fintercelestial.com%2F&rid=esp&cc=1
Requested by: Host: intercelestial.com
URL: https://intercelestial.com/
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: f3ea6be76d7522672893a28a7c5edba4d96e4587dfe824f076d55d8548610813

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-4zBeJTEHmBmIPvWJLwOZTPQa/x4"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Sat, 05 Aug 2023 11:35:35 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://intercelestial.com
location: /esp?url=https%3A%2F%2Fintercelestial.com%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 10EF 15 KB
6 KB 55ms
19ms Document
text/html 2a02:2638:d::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=intercelestial.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

645709dcb09b2700fd5a5938dbdf783ac90a88334e5104041db53302441f33e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:35 GMT
server: Kestrel
server-processing-duration-in-ticks: 283078
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
327 B 40ms
8ms XHR
text/plain 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://intercelestial.com
date: Sat, 05 Aug 2023 11:35:35 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

sid Show response
mug.criteo.com/ Frame 10EF
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=intercelestial.com&sn=ChromeSyncframe&so=0&topUrl=intercelestial.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=GqVQv3w1bjBxYkFPY3RPVVVQVXFZTjNabTI0VGExd24yY3NIRE9QOVJaOEFSM0hiWVhGZytBUE5QcitRZDlHaTRmaFR1STdIRkxxa3VVTlNKR29DZmhHKzlxZlpDR1Q3aFBHYit1dXd2ZEs5S1dJVENrWGtSaXl0eXdORG...

449 B
666 B

98ms
22ms

Fetch
application/json

178.250.7.13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=GqVQv3w1bjBxYkFPY3RPVVVQVXFZTjNabTI0VGExd24yY3NIRE9QOVJaOEFSM0hiWVhGZytBUE5QcitRZDlHaTRmaFR1STdIRkxxa3VVTlNKR29DZmhHKzlxZlpDR1Q3aFBHYit1dXd2ZEs5S1dJVENrWGtSaXl0eXdORGRoK2J6M2JsdUlETzRUK0taMXZZWmkrYzJtS1NJSXFjcUhuVUYrS2NzcGpRQk56WnIrOGZzUkVLbDlDcWtOSFB1TTBURHl1OEM1QWR1SE1UZW9jZjJMVGdheDJxbGxXRFp6dHo1LzUySTI1M3Y1T1Q4ZVBGci92RHJPdlg2SVhGRGdXZkJobHl4aVAwcldGMk1Ya0o3dDEzUkdiRWNuV2Jnd2M5Nm45UkpkL25VUENrMTdrRT18&cppv=2

Requested by

Host: intercelestial.com
URL: https://intercelestial.com/

Protocol

Server

178.250.7.13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

1b0da47568b24581020397ae1c2cee0925361744e79501afdd94d195891a89b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1359435
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=GqVQv3w1bjBxYkFPY3RPVVVQVXFZTjNabTI0VGExd24yY3NIRE9QOVJaOEFSM0hiWVhGZytBUE5QcitRZDlHaTRmaFR1STdIRkxxa3VVTlNKR29DZmhHKzlxZlpDR1Q3aFBHYit1dXd2ZEs5S1dJVENrWGtSaXl0eXdORGRoK2J6M2JsdUlETzRUK0taMXZZWmkrYzJtS1NJSXFjcUhuVUYrS2NzcGpRQk56WnIrOGZzUkVLbDlDcWtOSFB1TTBURHl1OEM1QWR1SE1UZW9jZjJMVGdheDJxbGxXRFp6dHo1LzUySTI1M3Y1T1Q4ZVBGci92RHJPdlg2SVhGRGdXZkJobHl4aVAwcldGMk1Ya0o3dDEzUkdiRWNuV2Jnd2M5Nm45UkpkL25VUENrMTdrRT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 256441
content-length: 0
expires: 0

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 18ms
18ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://intercelestial.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://intercelestial.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Sat, 05 Aug 2023 11:35:35 GMT

POST
H/1.1 200
OK view.aspx Show response
server.cpmstar.com/ 45 B
523 B 610ms
153ms XHR
application/json 131.153.170.212
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://server.cpmstar.com/view.aspx?media=banner&json=c_b&mv=1&poolid=81286&reachedTop=true&requestid=50f4eca830b95fe&referer=https%253A%252F%252Fintercelestial.com%252F&schain=1.0,1!adinplay.com,ICL,1,,,
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 131.153.170.212 Ashburn, United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 30df81d42f2b49f022db25faa1bbfe5b386509fe5a01a70758686644f0868f49

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Server: Microsoft-IIS/10.0
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://intercelestial.com
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADM DEVa PSAa PSDa OUR OTR IND UNI NAV STA"
Cache-Control: private,no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
332 B 160ms
159ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=825828
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 789d3b46cd9443e5033f5b978714b217bec6ecab3c04be0a08d8de774450e97b

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dfosMp8e1bjqEPzmzSr%2BnwRIZZ2ac2A9WzozLDLCojEPAoNY7xofhs%2FGB%2BZmggzbCUuGUxBk7f1w0W2uzkvGTTLynNzKcdi01tL2j0e85oXL5lBV4M2VaLIrNNer%2BUrpbXgWhufL"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7f1ebcd1781a1e6c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
365 B 8ms
8ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://intercelestial.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 309 B
343 B 150ms
150ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=9&rp_schain=1.0,1!adinplay.com,ICL,1,,,&rf=https%3A%2F%2Fintercelestial.com%2F&tg_i.domain=intercelestial.com&tg_i.page=https%3A%2F%2Fintercelestial.com%2F&tk_flint=pbjs_lite_v7.52.0&x_source.tid=1071eb0e-df34-49f6-858a-f937afd64608&l_pb_bid_id=563fc556051bf02&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=1071eb0e-df34-49f6-858a-f937afd64608&rp_maxbids=1&slots=1&rand=0.0075937266176893115
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 77c23ad85deb3db697d1cceef690e7be6b0aa5d3d6654c4d62e85624abff6516

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 309
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
961 B 181ms
181ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

a8adc0efae63a6475befcbaf87ebb8f61844c6ef1c8577444319dfa817e47567

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
an-x-request-uuid: 6e249d88-a16b-4ff4-99fc-b3a5df686bd5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
165 B 20ms
20ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://intercelestial.com
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 393 B
173 B 271ms
270ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=613802254034102&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_250x250&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=4&adks=3858479959&didk=3608661488&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235335926&lmt=1691235335&adxs=180&adys=1939&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=826x0&msz=826x0&fws=4&ohw=1600&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcY1vzsq5wxSABSAghqEhcKCHJ0YmhvdXNlGIf97KucMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSFAoFb3BlbngYr_zsq5wxSABSAghkEhsKDGlkNS1zeW5jLmNvbRiv_eyrnDFIAFICCGo.&dlt=1691235335028&idt=621&prev_scp=CDT%3Dno%26richmedia%3Dno%26GS%3DNo%26FC%3D1%26OS%3DOther%26Conc%3DNo

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

217eafadf82f953b22e7dc85178f2b4e9129482ea7bd1fda81afdf7cef0b140c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 18ms
18ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://intercelestial.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://intercelestial.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Sat, 05 Aug 2023 11:35:35 GMT

POST
H/1.1 200
OK view.aspx Show response
server.cpmstar.com/ 45 B
546 B 599ms
153ms XHR
application/json 131.153.170.212
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://server.cpmstar.com/view.aspx?media=banner&json=c_b&mv=1&poolid=81286&reachedTop=true&requestid=627a1b57d7266c9&referer=https%253A%252F%252Fintercelestial.com%252F&schain=1.0,1!adinplay.com,ICL,1,,,
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 131.153.170.212 Ashburn, United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 30df81d42f2b49f022db25faa1bbfe5b386509fe5a01a70758686644f0868f49

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:35 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://intercelestial.com
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADM DEVa PSAa PSDa OUR OTR IND UNI NAV STA"
Cache-Control: private,no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 309 B
343 B 152ms
151ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=9&rp_schain=1.0,1!adinplay.com,ICL,1,,,&rf=https%3A%2F%2Fintercelestial.com%2F&tg_i.domain=intercelestial.com&tg_i.page=https%3A%2F%2Fintercelestial.com%2F&tk_flint=pbjs_lite_v7.52.0&x_source.tid=4d8a58f7-42f5-4210-8cb0-8dfa8f427ac3&l_pb_bid_id=643d8872d026139&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=4d8a58f7-42f5-4210-8cb0-8dfa8f427ac3&rp_maxbids=1&slots=1&rand=0.9669379419267063
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a4aa5fdbb1e25faac4446bccd06a81c4a412f061bbe3fa78c78651f4565feaae

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 309
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
165 B 20ms
20ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://intercelestial.com
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
365 B 40ms
40ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://intercelestial.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 13 KB
7 KB 238ms
237ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-18-184-139-185.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

17ff8324fe1bf5fb8f29d83414b7ce2abf5146f9a832df92419a5860e89fd45a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
an-x-request-uuid: d3569831-bfde-4119-b4e8-65a220210558
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
522 B 25ms
24ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=825822
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3dacbf78d3403c4185ae9063e5c4070af0d0db2f4042dd4bc89dace26b7b708

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wx8uhZkuFRaUpTnltrUCQ3N9EQh6M7PjNfUwPCOzl7Tkp2kKs%2FkSCuXhf5JMFgkSjAinldqH7BNbtcz9NlunhqGGZQ9XQiDo3vowpbx9VKxfXV%2BpIBGpi2Svbz6FgR5%2F8wgq3Tiv"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7f1ebcd1990a3626-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 19ms
18ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://intercelestial.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://intercelestial.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Sat, 05 Aug 2023 11:35:35 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
483 B 138ms
137ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=825823
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18f65d870734ba4242eee39cf26d9ccea5482438fa5f33853ce840e6abcce409

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qLUqAztmXKidSCvCCa3ojOOOFQsNj29YqbQe4h%2FDoE%2FaEsDeB46QOGLV4CNZeEeNtr4ntnCf4pD1EiKoTMfT3CCzbmv4bge25ySnLYZwXH51HYGDh8Co2uPmvp5GcU6fpx2D9XJR"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7f1ebcd1a9133626-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 309 B
343 B 160ms
159ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=2&rp_schain=1.0,1!adinplay.com,ICL,1,,,&rf=https%3A%2F%2Fintercelestial.com%2F&tg_i.domain=intercelestial.com&tg_i.page=https%3A%2F%2Fintercelestial.com%2F&tk_flint=pbjs_lite_v7.52.0&x_source.tid=e1805573-f194-4fe7-b618-93a034feaa7b&l_pb_bid_id=762b404e8d4a064&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=e1805573-f194-4fe7-b618-93a034feaa7b&rp_maxbids=1&slots=1&rand=0.589237837808527
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 2a3d72548ae6bce9a560df5d1a58d4774d08da8a4f97c8bf301b6891ac20503f

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 309
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 6 KB
3 KB 200ms
199ms XHR
application/json 18.184.139.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.52.0&referrer=https%3A%2F%2Fintercelestial.com%2F&tmax=1500

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.184.139.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ba95ff31e5cfc9304ab92e0df527016ae3b6326a72cb40300ac7c44324b5878c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
accept-ch: sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 2463
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
365 B 34ms
33ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://intercelestial.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
959 B 221ms
221ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e5cb62400e2a5a0b5da91402548656a6c2393a1fe60dd0249b28a1ee796be701

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
an-x-request-uuid: 34f8f241-e33a-4c16-ac0e-c0b0b4283c48
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
165 B 20ms
20ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://intercelestial.com
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:35 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK view.aspx Show response
server.cpmstar.com/ 1 KB
2 KB 605ms
158ms XHR
application/json 131.153.170.212
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://server.cpmstar.com/view.aspx?media=banner&json=c_b&mv=1&poolid=81284&reachedTop=true&requestid=86d937cc6af7dca&referer=https%253A%252F%252Fintercelestial.com%252F&schain=1.0,1!adinplay.com,ICL,1,,,
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 131.153.170.212 Ashburn, United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 34a97f3ffd667ce92fdc9e1b6fe199d9e1a4cf2a80cb00d0ec0d7a5aa4f758e2

Request headers

Referer: https://intercelestial.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:35 GMT
Server: Microsoft-IIS/10.0
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://intercelestial.com
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADM DEVa PSAa PSDa OUR OTR IND UNI NAV STA"
Cache-Control: private,no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 9e2bee75a202ad399d9d0a48a9635e9b
secure.gravatar.com/avatar/ 2 KB
2 KB 27ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/9e2bee75a202ad399d9d0a48a9635e9b?s=120&d=mm&r=g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3171fc2cecfe1c3d875ae060c2a369801730efb9f46d8ec3073066504d27460d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Sat, 05 Aug 2023 11:35:36 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="9e2bee75a202ad399d9d0a48a9635e9b.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/9e2bee75a202ad399d9d0a48a9635e9b?s=120&d=mm&r=g>; rel="canonical"
content-length: 1717
expires: Sat, 05 Aug 2023 11:40:36 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
12 KB 54ms
53ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230802&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed3052bd51fc5cb4757a287f317c25196a778a8afc2586fe0d7e1174f51936a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11725
x-xss-protection: 0

GET
H2 200 9e2bee75a202ad399d9d0a48a9635e9b
secure.gravatar.com/avatar/ 2 KB
2 KB 6ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/9e2bee75a202ad399d9d0a48a9635e9b?s=120&d=mm&r=g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3171fc2cecfe1c3d875ae060c2a369801730efb9f46d8ec3073066504d27460d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Sat, 05 Aug 2023 11:35:36 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="9e2bee75a202ad399d9d0a48a9635e9b.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/9e2bee75a202ad399d9d0a48a9635e9b?s=120&d=mm&r=g>; rel="canonical"
content-length: 1717
expires: Sat, 05 Aug 2023 11:40:36 GMT

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 94CA 37 B
140 B 39ms
9ms Document
image/gif 76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Sat, 05 Aug 2023 11:35:36 GMT

GET
H2 204 /
onetag-sys.com/usync/ Frame 6B63 0
0 9ms
8ms Document
text/plain 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1691235335759

Requested by

Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 91E1 52 KB
17 KB 42ms
7ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 18076
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sat, 05 Aug 2023 11:35:36 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 27 Jul 2023 06:34:02 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2853, 106474
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230124-FRA
X-Timer: S1691235336.065949,VS0,VE0

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 116A 281 B
554 B 50ms
8ms Document
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Aug 2023 11:35:36 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 162E 3 KB
2 KB 76ms
15ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: api.adinplay.com
URL: https://api.adinplay.com/libs/aiptag/pub/ICL/intercelestial.com/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1024
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7f1ebcd29c429b4f-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 05 Aug 2023 11:35:36 GMT
expires: Sat, 05 Aug 2023 15:35:36 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 48 KB
17 KB 436ms
436ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=2505509871251362&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_320x100&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x100&ifi=5&adks=3329032940&didk=4010337038&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235336037&lmt=1691235336&adxs=1076&adys=1713&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=344x0&msz=344x0&fws=4&ohw=1600&psts=AOrYGsmw2h0SXzedc7OzdiZM77lHpRtRGd3jQlbDyq4A26M2&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcY1vzsq5wxSABSAghqEhcKCHJ0YmhvdXNlGIf97KucMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSFAoFb3BlbngYr_zsq5wxSABSAghkEhsKDGlkNS1zeW5jLmNvbRiv_eyrnDFIAFICCGo.&dlt=1691235335028&idt=621&prev_scp=CDT%3Dno%26richmedia%3Dno%26GS%3DNo%26FC%3D1%26OS%3DOther%26Conc%3DNo

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4611513e001efdd2420faf1fbae5e3f0648c2529457deebcb6551a3a3d69f62d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16889
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 59 KB
14 KB 417ms
416ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=2797819312278892&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_336x280&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=6&adks=972096720&didk=1345979740&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235336056&lmt=1691235336&adxs=632&adys=382&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=1600x0&msz=1600x0&fws=4&ohw=1600&psts=AOrYGsmw2h0SXzedc7OzdiZM77lHpRtRGd3jQlbDyq4A26M2&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcY1vzsq5wxSABSAghqEhcKCHJ0YmhvdXNlGIf97KucMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSFAoFb3BlbngYr_zsq5wxSABSAghkEhsKDGlkNS1zeW5jLmNvbRiv_eyrnDFIAFICCGo.&dlt=1691235335028&idt=621&prev_scp=CDT%3Dno%26richmedia%3Dno%26GS%3DNo%26FC%3D1%26OS%3DOther%26Conc%3DNo%26hb_format_triplelift%3Dbanner%26hb_size_triplelift%3D336x280%26hb_pb_triplelift%3D0.01%26hb_adid_triplelift%3D94f0fce8720d9f2%26hb_bidder_triplelift%3Dtriplelift%26hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D336x280%26hb_pb_appnexus%3D0.03%26hb_adid_appnexus%3D8743a7ba7c2983e%26hb_bidder_appnexus%3Dappnexus%26hb_format%3Dbanner%26hb_size%3D336x280%26hb_pb%3D0.03%26hb_adid%3D8743a7ba7c2983e%26hb_bidder%3Dappnexus

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d164877b1e907a4bec5b28249a9d4757bf7d259587bbdedd006b11564316659

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14630
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 59ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 05 Aug 2023 11:35:36 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 92C2 0
176 B 56ms
18ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Sat, 05 Aug 2023 11:35:36 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 91E1 0
593 B 152ms
152ms Script
text/html 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
an-x-request-uuid: 6b2d896c-5333-4d5b-bf7e-f880d08e8c72
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 116A 34 KB
10 KB 11ms
11ms Script
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 98da83172e5725f5e97f021eda8fb4e38d27a5f9a99d4db1f336a92bc416a12d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Sat, 05 Aug 2023 11:35:36 GMT
Content-Encoding: gzip
Last-Modified: Sat, 05 Aug 2023 06:03:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66471
Connection: keep-alive
Content-Length: 10114
Expires: Sun, 06 Aug 2023 06:03:27 GMT

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 6468
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

2 KB
2 KB

10ms
9ms

Document
text/html

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: f90afc710fc00cfdc5a4919c758f1161f3a2943114a95b2f6a0351737179198e

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1793
Content-Type: text/html
Date: Sat, 05 Aug 2023 11:35:36 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

Redirect headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 0
Date: Sat, 05 Aug 2023 11:35:36 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
Location: /usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame A23E 13 KB
5 KB 8ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3511
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 10:37:05 GMT
expires: Sun, 04 Aug 2024 10:37:05 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 095A 783 B
1 KB 41ms
17ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

31465342deaf169da4779aa18333d9919bc35bea32b87f73386cbf6fb3540f94

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hyJqAfqBKVm_SPz0-y_Ydw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-hyJqAfqBKVm_SPz0-y_Ydw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:36 GMT
expires: Sat, 05 Aug 2023 11:35:36 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js Show response
pagead2.googlesyndication.com/bg/ Frame A23E 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

616caa77f3b26bf752bc7e76e496c90f09e972978a16e9fd7111d8f23009f504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:27:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 487
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 04 Aug 2024 11:27:29 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 095A 0
0 102ms
102ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230802&jk=3604643475947393&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 116A
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEtYWFVPVUUtUi1LNkFC
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKbSmDlq01OHcx4cSNuloG0&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtYWFVPVUUtUi1LNkFC&google_push=

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtYWFVPVUUtUi1LNkFC&google_push=

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtYWFVPVUUtUi1LNkFC&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 116A
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKXXUOUE-R-K6AB

0
649 B

140ms
108ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKXXUOUE-R-K6AB
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:35 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E1F8FE3245D14FE09C6400CCB4AC0170 Ref B: DUS30EDGE0306 Ref C: 2023-08-05T11:35:36Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYCK2l0sC9XQhOVcmrmRQ==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKXXUOUE-R-K6AB
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 54ae5f20a7acdd83fd00ddb00e96a2c1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 116A 70 B
264 B 122ms
34ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 116A
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OWRmNzgxYWFjYjRjZTE3NmYzNTY0Y2NhMmZiZjIzZDJmYzRhNGRjYQ

170 B
243 B

19ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OWRmNzgxYWFjYjRjZTE3NmYzNTY0Y2NhMmZiZjIzZDJmYzRhNGRjYQ

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-210-82-246.eu-west-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OWRmNzgxYWFjYjRjZTE3NmYzNTY0Y2NhMmZiZjIzZDJmYzRhNGRjYQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 54ae5f20a7acdd83fd00ddb00e96a2c1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 116A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHLNbq54etNIStJhS0Wb9Xc&google_cver=1

0
239 B

55ms
8ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHLNbq54etNIStJhS0Wb9Xc&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: f5982f4f9cc79eb2b489dda8b92e3144
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHLNbq54etNIStJhS0Wb9Xc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 116A
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/dNaqtngzYbFp79SK8wKV6A?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-erwDX0NE2oJ65sDJyGtnJmIClq7VFqwkQjjkOg--~A

0
239 B

8ms
8ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-erwDX0NE2oJ65sDJyGtnJmIClq7VFqwkQjjkOg--~A
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Sat, 05 Aug 2023 11:35:36 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-erwDX0NE2oJ65sDJyGtnJmIClq7VFqwkQjjkOg--~A
content-length: 0

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 116A
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=BW5r90ncST2YW5AdBvnepg&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=BW5r90ncST2YW5AdBvnepg

43 B
720 B

176ms
176ms

Image
image/gif

67.220.224.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=BW5r90ncST2YW5AdBvnepg

Protocol

HTTP/1.1

Server

67.220.224.150 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: PSSC4VY3TWBVPPQR88KW
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=BW5r90ncST2YW5AdBvnepg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 116A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=i8RObUI-QkqNaeHJwES0bA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=i8RObUI-QkqNaeHJwES0bA

43 B
479 B

99ms
98ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=i8RObUI-QkqNaeHJwES0bA

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: F3YV3ZHB8314E6JEEQ96
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=i8RObUI-QkqNaeHJwES0bA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame A23E 0
10 B 7ms
6ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?3KguWQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 6468
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEH-UVUHE_YmFMi78XXt9lYI&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEH-UVUHE_YmFMi78XXt9lYI&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEH-UVUHE_YmFMi78XXt9lYI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 6468 70 B
265 B 84ms
33ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 6468
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

176ms
175ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: GZGJPQ69W3D9K6GFAQ4B
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: EMWMSDPCRF9P7DRKCF6K
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6468
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZM40CErFdB6tbzU52pebGgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESED8ADSNDbzQs8IJ68a-CC0M&google_cver=1

43 B
632 B

9ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESED8ADSNDbzQs8IJ68a-CC0M&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESED8ADSNDbzQs8IJ68a-CC0M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ie
match.prod.bidr.io/cookie-sync/ Frame 6468 43 B
433 B 130ms
29ms Image
image/gif 52.210.82.246
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/ie

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.210.82.246 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bridge
cm.adgrx.com/ Frame 6468 43 B
282 B 116ms
14ms Image
image/gif 63.251.232.170
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.251.232.170 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: ams-mon-1.sys.adgear.com
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: Cowboy
content-type: image/gif
p3p: CP="NOI OTC OTP OUR NOR"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx: ams-delivery-2
content-length: 43
expires: Thu, 23 Sep 2004 17:42:04 GMT

GET
H2 204 sync
ups.analytics.yahoo.com/ups/55940/ Frame 6468 0
125 B 77ms
9ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.64 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 6468
Redirect Chain

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZM40CErFdB6tbzU52pebGgAA%263395?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZM40CErFdB6tbzU52pebGgAA%263395

42 B
942 B

43ms
42ms

Image
image/gif

34.250.238.79
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZM40CErFdB6tbzU52pebGgAA%263395

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

34.250.238.79 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-250-238-79.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v050-0c77e4b94.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: HdRvMY3tT5o=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v050-0b601b3e9.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: w0hBmt17TS0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZM40CErFdB6tbzU52pebGgAA%263395
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 6468 43 B
353 B 48ms
15ms Image
image/gif 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZM40CErFdB6tbzU52pebGgAA%263395
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fintercelestial.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 58259
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7f1ebcd3cfc72c7e-FRA
content-length: 43
expires: Sun, 06 Aug 2023 11:35:36 GMT

GET
H2 200 container.html Show response
687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6767 6 KB
3 KB 9ms
8ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:35 GMT
expires: Sun, 04 Aug 2024 11:35:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012307180709000/ Frame 33F0 222 KB
62 KB 57ms
10ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307180709000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42cc0d0d864fa8e8dc6b4ff64b9a6e126a86719e00cced4e6694c984429da88c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 01 Aug 2023 13:35:44 GMT
age: 338392
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62064
x-xss-protection: 0
server: sffe
etag: "7c75c6afffb97d84"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 31 Jul 2024 13:35:44 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 33F0 15 KB
5 KB 78ms
31ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307180709000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35ddba307fe258726edbca8406973763f489f91f8d2488e67c3e9d691fb8883a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 01 Aug 2023 13:35:44 GMT
age: 338392
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5274
x-xss-protection: 0
server: sffe
etag: "b24c5d555100d699"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 31 Jul 2024 13:35:44 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 33F0 94 KB
28 KB 89ms
42ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307180709000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cab486b36e4f2fa09ab81d2964db38d78e8962420a7cbf1c8367e2b0596bb838

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 01 Aug 2023 13:35:44 GMT
age: 338392
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29021
x-xss-protection: 0
server: sffe
etag: "908f04349b1b2df1"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 31 Jul 2024 13:35:44 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 33F0 5 KB
2 KB 90ms
43ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307180709000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce05ebc645534f502c40ebf919b2992e353a216068772467822ef88f725052b1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 01 Aug 2023 13:35:44 GMT
age: 338392
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "5416cfef676738bf"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 31 Jul 2024 13:35:44 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 33F0 40 KB
13 KB 90ms
44ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307180709000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b03afcbf2fbeba733a2b40a4f6f5307977268b29df242211d0c1b12a88812593

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 01 Aug 2023 13:35:44 GMT
age: 338392
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13013
x-xss-protection: 0
server: sffe
etag: "4da616cd662b7cdb"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 31 Jul 2024 13:35:44 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 33F0 6 KB
779 B 23ms
18ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7abab7a5fed6d1eb8dcfed4e7f6bfcbc1a1a1dfbf95d281b008f04245b26c769

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 05 Aug 2023 11:35:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 05 Aug 2023 11:35:36 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 33F0 4 KB
751 B 21ms
17ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 05 Aug 2023 11:08:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 05 Aug 2023 11:35:36 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 33F0 2 KB
2 KB 11ms
8ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: intercelestial.com
URL: https://intercelestial.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 04:40:07 GMT
x-content-type-options: nosniff
server: cafe
age: 24929
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 06 Aug 2023 04:40:07 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 33F0 295 B
319 B 10ms
8ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: intercelestial.com
URL: https://intercelestial.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 15:21:19 GMT
x-content-type-options: nosniff
server: cafe
age: 72857
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 05 Aug 2023 15:21:19 GMT

GET
H2 200 2560905734134455667
s0.2mdn.net/simgad/ Frame 33F0 117 KB
118 KB 32ms
8ms Image
image/jpeg 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2560905734134455667

Requested by

Host: intercelestial.com
URL: https://intercelestial.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89e85f9b8fc9cbd03a4754b9dbe43f26e1f42aa2007fe1e2a590c8ad21dcaff9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 07:25:44 GMT
x-content-type-options: nosniff
age: 14992
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120160
x-xss-protection: 0
last-modified: Wed, 12 Jul 2023 13:09:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 04 Aug 2024 07:25:44 GMT

GET
H2 200 17558191872829141573
s0.2mdn.net/simgad/ Frame 33F0 10 KB
10 KB 38ms
14ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17558191872829141573

Requested by

Host: intercelestial.com
URL: https://intercelestial.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 15:15:38 GMT
x-content-type-options: nosniff
age: 73198
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10020
x-xss-protection: 0
last-modified: Wed, 12 Jul 2023 13:09:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Aug 2024 15:15:38 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 33F0 0
0 17ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRd5DtVbNtOMpWQEMiij6AJRgs3aZYuw1JUjWRqs8bK473OnlvEjlV0NRdk86vwtZPVPOxFnzDmWlsJ9f9VJrUiTqO_Pw
Requested by: Host: intercelestial.com
URL: https://intercelestial.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 33F0 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3e6f63d87e052bd0835e82eb7619c01f5d09be263aef71ae933af10456d6f6f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
11 KB 337ms
337ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=434171122061092&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=7&adks=1170471350&didk=2790689495&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235336529&lmt=1691235336&adxs=436&adys=281&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=1600x0&msz=1600x0&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsmw2h0SXzedc7OzdiZM77lHpRtRGd3jQlbDyq4A26M2&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcY1vzsq5wxSABSAghqEhcKCHJ0YmhvdXNlGIf97KucMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pWkZNNVVVcE1Vek5SVm1GeVlXbEZjQzlqVkdNMFp6MDlJbjA9GIb_7KucMUgAEhsKDGlkNS1zeW5jLmNvbRiv_eyrnDFIAFICCGo.&dlt=1691235335028&idt=621&prev_scp=CDT%3Dno%26richmedia%3Dno%26GS%3DNo%26FC%3D1%26OS%3DOther%26Conc%3DNo%26hb_format_cpmstar%3Dbanner%26hb_size_cpmstar%3D728x90%26hb_pb_cpmstar%3D0.00%26hb_adid_cpmstar%3D997abef055f7f23%26hb_bidder_cpmstar%3Dcpmstar%26hb_format_triplelift%3Dbanner%26hb_size_triplelift%3D728x90%26hb_pb_triplelift%3D0.01%26hb_adid_triplelift%3D95c9f198d197312%26hb_bidder_triplelift%3Dtriplelift%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.01%26hb_adid%3D95c9f198d197312%26hb_bidder%3Dtriplelift

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fa0bd4af8fa4981924d79c6f5271ea51bf6f519bea0c0bc6eb9b9dc701ec2e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11182
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 137 KB
48 KB 345ms
344ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=3056315306123503&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_160x600&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=8&adks=8611126&didk=1009955376&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235336553&lmt=1691235336&adxs=15&adys=39&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=516&ohw=160&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsmw2h0SXzedc7OzdiZM77lHpRtRGd3jQlbDyq4A26M2&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcY1vzsq5wxSABSAghqEhcKCHJ0YmhvdXNlGIf97KucMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pWkZNNVVVcE1Vek5SVm1GeVlXbEZjQzlqVkdNMFp6MDlJbjA9GIb_7KucMUgAEhsKDGlkNS1zeW5jLmNvbRiv_eyrnDFIAFICCGo.&dlt=1691235335028&idt=621&prev_scp=CDT%3Dno%26richmedia%3Dno%26GS%3DNo%26FC%3D1%26OS%3DOther%26Conc%3DNo

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b0b65499343717d854391ec506cdbd7ce907a0051dd1c8531ecc309e5aebb0aa

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJC74Mu2xYADFdAo4AodKAANfA&gqi=&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJC74Mu2xYADFdAo4AodKAANfA&gqi=&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html
date: Sat, 05 Aug 2023 11:35:36 GMT
x-content-type-options: nosniff
content-encoding: br
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49339
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 137 KB
48 KB 384ms
384ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=1472602549477835&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_160x600_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=9&adks=737990101&didk=3171707667&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235336569&lmt=1691235336&adxs=1425&adys=39&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=516&ohw=160&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsmw2h0SXzedc7OzdiZM77lHpRtRGd3jQlbDyq4A26M2&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcY1vzsq5wxSABSAghqEhcKCHJ0YmhvdXNlGIf97KucMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pWkZNNVVVcE1Vek5SVm1GeVlXbEZjQzlqVkdNMFp6MDlJbjA9GIb_7KucMUgAEhsKDGlkNS1zeW5jLmNvbRiv_eyrnDFIAFICCGo.&dlt=1691235335028&idt=621&prev_scp=CDT%3Dno%26richmedia%3Dno%26GS%3DNo%26FC%3D1%26OS%3DOther%26Conc%3DNo%26hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D160x600%26hb_pb_appnexus%3D0.04%26hb_adid_appnexus%3D977929f09dca117%26hb_bidder_appnexus%3Dappnexus%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.04%26hb_adid%3D977929f09dca117%26hb_bidder%3Dappnexus

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45a7f0a95e81c406a981e6ced929d8d11ee7c4fbddecb9ea9774d367b5d0b899

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJbb4cu2xYADFUWx3god4wALHw&gqi=&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJbb4cu2xYADFUWx3god4wALHw&gqi=&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html
date: Sat, 05 Aug 2023 11:35:36 GMT
x-content-type-options: nosniff
content-encoding: br
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49433
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dr Show response
as.ad4m.at/ad/ Frame F615 2 KB
3 KB 70ms
34ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/dr?ed=1g6r27q48pg7jqeje7r4vhyv72t83kgmqx2cckezt4arnx807aanb4dq1151g60aqw8aw43tejkmb9b8h588es6s8kb2ykg9mmtmsyg6rdd383gf2fz7ed9g7d1vkc0f8rre6yczb56fx67jzpyat2yxz54p7y04ncr840etqasyw0mnpqf6t7mp310fh8h6qn3ja4z12xm0wydb6nceefspnhw32ay2502kx62m49rtwd3a67bng4hrg5g0dc5w63wvt72ewg1ndkaahz5tvbwyma5bbmnay0mqhfjf2satev1bkmcy77gvv1rby1mg6p827pysa3qf4cfkxnxc1xyj0rdxxmztmqsj1dxh0edz1k56n7ynchd0z535zy723pcaa7e9vax2604mw17qx1r23gftj7sehj12s6y273acm106w4qkpv6n7z9qgjvathseyxex0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%26client%3Dca-pub-3282547114800347%26adurl%3D

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12d6643c7b1eeb6dc0e2095f268bce6f1a82aa85f985a076129ff366f7d26aa9

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7f1ebcd5fab69016-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:36 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 5296 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/window_focus_fy2021.js

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 14:44:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75052
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 14:44:44 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B652 1 KB
643 B 13ms
10ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 29426
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 03:25:10 GMT
etag: 48472445140208031
expires: Sun, 06 Aug 2023 03:25:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 5296 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9278ee0a91cf49cab1fcafd47c3b9875e683dbe7a26e3ffa83c9e671b75ca28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:47:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78513
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8261
x-xss-protection: 0
server: cafe
etag: 3571037177597359341
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:47:03 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5296 0
0 18ms
16ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRagPXR5nJeoy8cVr5Jcu184DRexTF0EjFkClY-RA6Sj1Ej2s-B98D7MLjtF68ogUUh9uUn_dqPGk7fc9Si4jOycx_1eg
Requested by: Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 5296 24 KB
6 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 08:18:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 271031
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 01 Aug 2024 08:18:25 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5296 179 KB
57 KB 53ms
26ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45b4eee66ac74743c86ea5a55ea614ddb12bc1407e4bfca8ff92c308c82795e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57430
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690976231057960"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:36 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 33F0 15 KB
15 KB 10ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://intercelestial.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 17:49:54 GMT
x-content-type-options: nosniff
age: 63942
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Aug 2024 17:49:54 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 33F0 16 KB
16 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://intercelestial.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 17:26:14 GMT
x-content-type-options: nosniff
age: 324562
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 Jul 2024 17:26:14 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
11 KB 378ms
377ms XHR
text/plain 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3604643475947393&correlator=1921078956247035&eid=44777900&output=ldjh&gdfp_req=1&vrg=202308010101&ptt=17&impl=fif&iu_parts=421469808%3A21878865861%2Cintercelestial.com_728x90_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=10&adks=3115380484&didk=1487631737&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D8c2ae50e58955e6d-22e129ea46de007a%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MZqYsASj_2aNr7HogYoUaoitY76tw&gpic=UID%3D00000c4c3e7b1c33%3AT%3D1691235335%3ART%3D1691235335%3AS%3DALNI_MaElQmQbfc_BeEeWcwvqD89Q-DpFw&abxe=1&dt=1691235336622&lmt=1691235336&adxs=436&adys=4340&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fintercelestial.com%2F&frm=20&vis=1&psz=1600x0&msz=1600x0&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsmw2h0SXzedc7OzdiZM77lHpRtRGd3jQlbDyq4A26M2&ga_vid=1812439828.1691235335&ga_sid=1691235336&ga_hid=391139574&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYrvzsq5wxSABSAghkEhkKCnB1YmNpZC5vcmcY1vzsq5wxSABSAghqEhcKCHJ0YmhvdXNlGIf97KucMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiv_OyrnDFIAFICCGQSGQoKdWlkYXBpLmNvbRiu_OyrnDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pWkZNNVVVcE1Vek5SVm1GeVlXbEZjQzlqVkdNMFp6MDlJbjA9GIb_7KucMUgAEhsKDGlkNS1zeW5jLmNvbRiv_eyrnDFIAFICCGo.&dlt=1691235335028&idt=621&prev_scp=CDT%3Dno%26richmedia%3Dno%26GS%3DNo%26FC%3D1%26OS%3DOther%26Conc%3DNo%26hb_format_cpmstar%3Dbanner%26hb_size_cpmstar%3D728x90%26hb_pb_cpmstar%3D0.00%26hb_adid_cpmstar%3D1001deaea981b66e%26hb_bidder_cpmstar%3Dcpmstar%26hb_format_triplelift%3Dbanner%26hb_size_triplelift%3D728x90%26hb_pb_triplelift%3D0.00%26hb_adid_triplelift%3D9661d35bfc7a69d%26hb_bidder_triplelift%3Dtriplelift%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.00%26hb_adid%3D9661d35bfc7a69d%26hb_bidder%3Dtriplelift

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a953264e94a68b2b601ec1a0d97c256d5590f1b2253e37edfca4c1e21f519a82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11009
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://intercelestial.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame B652
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEMDok7B-rdd9NmdkE1YNrVM&google_cver=1&google_push=AXcoOmR7HmsGa2EL2VbJbQnqguKmWgGCd1zH2h8KyY42s1rdae7btreWDPE50O6rux5JrFy04HLHLbxycHysIal8FBBOCxiXs0Vi9...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMDok7B-rdd9NmdkE1YNrVM&google_cver=1&google_push=AXcoOmR7HmsGa2EL2VbJbQnqguKmWgGCd1zH2h8KyY42s1rdae7btreWDPE50O6rux5JrFy04HLHLbxycHysIal8FBBOCxiXs0V...

43 B
451 B

185ms
165ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMDok7B-rdd9NmdkE1YNrVM&google_cver=1&google_push=AXcoOmR7HmsGa2EL2VbJbQnqguKmWgGCd1zH2h8KyY42s1rdae7btreWDPE50O6rux5JrFy04HLHLbxycHysIal8FBBOCxiXs0Vi9w&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmR7HmsGa2EL2VbJbQnqguKmWgGCd1zH2h8KyY42s1rdae7btreWDPE50O6rux5JrFy04HLHLbxycHysIal8FBBOCxiXs0Vi9w%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7f1ebcd89b5718bf-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 477
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMDok7B-rdd9NmdkE1YNrVM&google_cver=1&google_push=AXcoOmR7HmsGa2EL2VbJbQnqguKmWgGCd1zH2h8KyY42s1rdae7btreWDPE50O6rux5JrFy04HLHLbxycHysIal8FBBOCxiXs0Vi9w&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmR7HmsGa2EL2VbJbQnqguKmWgGCd1zH2h8KyY42s1rdae7btreWDPE50O6rux5JrFy04HLHLbxycHysIal8FBBOCxiXs0Vi9w%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7f1ebcd7488118bf-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B652
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEJ3M-f5h1h9znHXCuLcX9PY&google_cver=1&google_push=AXcoOmTLzMpo9VKF5EsOwuRfXvk5X_cO_Pdp-ORmK0SrpvPL7PIBxtGNRolYANPrlcnZHESUPKFZ3ivi...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEJ3M-f5h1h9znHXCuLcX9PY&google_cver=1&google_push=AXcoOmTLzMpo9VKF5EsOwuRfXvk5X_cO_Pdp-ORmK0SrpvPL7PIBxtGNRolYANPrlcnZHESUPKF...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA2NTg5NTYwMTEyMzg5NDUwNg&google_push=AXcoOmTLzMpo9VKF5EsOwuRfXvk5X_cO_Pdp-ORmK0SrpvPL7PIBxtGNRolYANPrlcnZHESUPKFZ3i...

170 B
188 B

23ms
23ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA2NTg5NTYwMTEyMzg5NDUwNg&google_push=AXcoOmTLzMpo9VKF5EsOwuRfXvk5X_cO_Pdp-ORmK0SrpvPL7PIBxtGNRolYANPrlcnZHESUPKFZ3iviKtvV4ilKrex8yCwZ6t-2Lg

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA2NTg5NTYwMTEyMzg5NDUwNg&google_push=AXcoOmTLzMpo9VKF5EsOwuRfXvk5X_cO_Pdp-ORmK0SrpvPL7PIBxtGNRolYANPrlcnZHESUPKFZ3iviKtvV4ilKrex8yCwZ6t-2Lg
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B652
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIdidLB3TBpS6hJ_pfvRsOI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIdidLB3TBpS6hJ_pfvRsOI&google_hm=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&google_nid=index&google_push=AXcoOmQ1yBx1DU38hExbMWkt55EDKtxIlZG_6...

170 B
188 B

23ms
19ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIdidLB3TBpS6hJ_pfvRsOI&google_hm=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&google_nid=index&google_push=AXcoOmQ1yBx1DU38hExbMWkt55EDKtxIlZG_6nISxibWKSz_VObFQS2B8ZMy8iRI2gGrNX5KrwK0KyhT7RxiFsoUzcz4lIS_plhWjQ

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIdidLB3TBpS6hJ_pfvRsOI&google_hm=ZM40CErFdB6tbzU52pebGgAADUMAAAIB&google_nid=index&google_push=AXcoOmQ1yBx1DU38hExbMWkt55EDKtxIlZG_6nISxibWKSz_VObFQS2B8ZMy8iRI2gGrNX5KrwK0KyhT7RxiFsoUzcz4lIS_plhWjQ
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 0
Expires: 0

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame B652 0
500 B 496ms
92ms Image
text/plain 69.166.1.12
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAXcoOmRgzQ-Yo1oX1hjLMBMTaqOCsZWElVWoxQrjmJhyZSdEu1C4nRx48_UEBCODANWMIZVO-Fi3DTvOfAXnnRDNJEKRs5fhMXExhA%26google_hm%3D%5BUID%5D&google_gid=CAESEDgqDt_FJd2O6F7Pxrm046k&google_cver=1

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.12 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:37 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-108
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B652
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEKDZpNQWomaHKt9zoetEqVY&google_cver=1&google_push=AXcoOmQGsb2SOOTzsCmyYNgGYkiy5atzXHfSpC-GCtFWOfkRYlWjXedUuJWh0LWfIG64jl7jRRPuqABKkPC0sBrTlYcwJx...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEKDZpNQWomaHKt9zoetEqVY&google_cver=1&google_push=AXcoOmQGsb2SOOTzsCmyYNgGYkiy5atzXHfSpC-GCtFWOfkRYlWjXedUuJWh0LWfIG64jl7jRRPuqABKkPC0sBrT...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=RtigUD_MR9mU6150tmaRow&google_push=AXcoOmQGsb2SOOTzsCmyYNgGYkiy5atzXHfSpC-GCtFWOfkRYlWjXedUuJWh0LWfIG64jl7jRRPuqABKkPC0sBr...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=RtigUD_MR9mU6150tmaRow&google_push=AXcoOmQGsb2SOOTzsCmyYNgGYkiy5atzXHfSpC-GCtFWOfkRYlWjXedUuJWh0LWfIG64jl7jRRPuqABKkPC0sBrTlYcwJxYj0NBE

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=RtigUD_MR9mU6150tmaRow&google_push=AXcoOmQGsb2SOOTzsCmyYNgGYkiy5atzXHfSpC-GCtFWOfkRYlWjXedUuJWh0LWfIG64jl7jRRPuqABKkPC0sBrTlYcwJxYj0NBE
access-control-allow-origin: *
date: Sat, 05 Aug 2023 11:35:36 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame B652
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEI3PsYd0BY5zGqpRhCpioWI&google_cver=1&google_push=AXcoOmQhH7nm0I8KO4h9nP5NQI6hBpi0utiFke6FGZLaOoWpW9xeMAwCavrvLLIpRozD1mPqA4N0PpX0rtwoMZj2r333FTti9hpi8eY
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmQhH7nm0I8KO4h9nP5NQI6hBpi0utiFke6FGZLaOoWp...

43 B
1 KB

29ms
10ms

Image
image/gif

162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmQhH7nm0I8KO4h9nP5NQI6hBpi0utiFke6FGZLaOoWpW9xeMAwCavrvLLIpRozD1mPqA4N0PpX0rtwoMZj2r333FTti9hpi8eY

Protocol

HTTP/1.1

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Sat, 05 Aug 2023 11:35:36 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmQhH7nm0I8KO4h9nP5NQI6hBpi0utiFke6FGZLaOoWpW9xeMAwCavrvLLIpRozD1mPqA4N0PpX0rtwoMZj2r333FTti9hpi8eY
x-download-options: noopen
vary: Accept
content-length: 274
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B652
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEF5NwqN8HWtx9VtRrUt4vU8&google_cver=1&google_push=AXcoOmR_MKdGcpLG-...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D&google_gid=CAESEF5NwqN8HWtx9VtRrUt4vU8&google_cver=1&google_push=AXcoOmR_MKdGcpLG-D5rIJxvEHLOmZAAL3...

170 B
188 B

22ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D&google_gid=CAESEF5NwqN8HWtx9VtRrUt4vU8&google_cver=1&google_push=AXcoOmR_MKdGcpLG-D5rIJxvEHLOmZAAL3yIYJS0U1KHrp-IWhR9vF9ICzojVYD94ZO09ElI3Qskob9MVbxjFhIVGqb2gwNxvn-Qv6Q

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
an-x-request-uuid: 18f07b78-7398-4781-b7f7-378444ae65c9
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D&google_gid=CAESEF5NwqN8HWtx9VtRrUt4vU8&google_cver=1&google_push=AXcoOmR_MKdGcpLG-D5rIJxvEHLOmZAAL3yIYJS0U1KHrp-IWhR9vF9ICzojVYD94ZO09ElI3Qskob9MVbxjFhIVGqb2gwNxvn-Qv6Q
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B652 0
12 B 144ms
143ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K68Lr5Q3OkdrjUlQ-5TILilsRIGuwj3VTVoK2dicnH_bhAOz_J-9O7-Af3B1jWMc9hFF6lBkI

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 default.css
as.ad4m.at/ad/style/0.1.48/one-ad/ Frame F615 114 KB
14 KB 131ms
130ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.48/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1g6r27q48pg7jqeje7r4vhyv72t83kgmqx2cckezt4arnx807aanb4dq1151g60aqw8aw43tejkmb9b8h588es6s8kb2ykg9mmtmsyg6rdd383gf2fz7ed9g7d1vkc0f8rre6yczb56fx67jzpyat2yxz54p7y04ncr840etqasyw0mnpqf6t7mp310fh8h6qn3ja4z12xm0wydb6nceefspnhw32ay2502kx62m49rtwd3a67bng4hrg5g0dc5w63wvt72ewg1ndkaahz5tvbwyma5bbmnay0mqhfjf2satev1bkmcy77gvv1rby1mg6p827pysa3qf4cfkxnxc1xyj0rdxxmztmqsj1dxh0edz1k56n7ynchd0z535zy723pcaa7e9vax2604mw17qx1r23gftj7sehj12s6y273acm106w4qkpv6n7z9qgjvathseyxex0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%26client%3Dca-pub-3282547114800347%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 032aee61923ef53fb2b9efbb5d55f771f780e9c2fce9c076638b809a9607eee3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1g6r27q48pg7jqeje7r4vhyv72t83kgmqx2cckezt4arnx807aanb4dq1151g60aqw8aw43tejkmb9b8h588es6s8kb2ykg9mmtmsyg6rdd383gf2fz7ed9g7d1vkc0f8rre6yczb56fx67jzpyat2yxz54p7y04ncr840etqasyw0mnpqf6t7mp310fh8h6qn3ja4z12xm0wydb6nceefspnhw32ay2502kx62m49rtwd3a67bng4hrg5g0dc5w63wvt72ewg1ndkaahz5tvbwyma5bbmnay0mqhfjf2satev1bkmcy77gvv1rby1mg6p827pysa3qf4cfkxnxc1xyj0rdxxmztmqsj1dxh0edz1k56n7ynchd0z535zy723pcaa7e9vax2604mw17qx1r23gftj7sehj12s6y273acm106w4qkpv6n7z9qgjvathseyxex0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%26client%3Dca-pub-3282547114800347%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1687950287
age: 865348
cf-polished: origSize=117335
x-guploader-uploadid: ADPycdu7Pb84Y6vCPqpUShyJrQGb98f4yuF1LiyC2B7DeEN9kG_1SbpI2iXm6tsp7d5fI22nNzf0l66mXGhEIUVspATbXw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 28 Jun 2023 11:05:15 GMT
server: cloudflare
etag: W/"5d49535c2a84a9762127b3d9e77d7e02"
vary: Accept-Encoding
x-goog-generation: 1687950315098833
content-type: text/css
x-goog-hash: crc32c=aWAnwg==, md5=XUlTXCqEqXYhJ7PZ531+Ag==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=92Xrm61cHKkoMfvhxeySzJDIr%2BYKRwroETnYRHg0AboZmTWeQkAPttSxZ0o306oTCW%2BplNpE60Ui3xWF0L3%2FrVy8SIEAg257Kbl%2FDoykLE8xYjb6JQAxQUPHgo%2Bv4Ejgrze0O3mMtAE%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 117335
cf-ray: 7f1ebcd71bc29016-FRA
expires: Sat, 05 Aug 2023 12:35:36 GMT

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame F615 25 KB
10 KB 132ms
122ms Script
application/javascript 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1g6r27q48pg7jqeje7r4vhyv72t83kgmqx2cckezt4arnx807aanb4dq1151g60aqw8aw43tejkmb9b8h588es6s8kb2ykg9mmtmsyg6rdd383gf2fz7ed9g7d1vkc0f8rre6yczb56fx67jzpyat2yxz54p7y04ncr840etqasyw0mnpqf6t7mp310fh8h6qn3ja4z12xm0wydb6nceefspnhw32ay2502kx62m49rtwd3a67bng4hrg5g0dc5w63wvt72ewg1ndkaahz5tvbwyma5bbmnay0mqhfjf2satev1bkmcy77gvv1rby1mg6p827pysa3qf4cfkxnxc1xyj0rdxxmztmqsj1dxh0edz1k56n7ynchd0z535zy723pcaa7e9vax2604mw17qx1r23gftj7sehj12s6y273acm106w4qkpv6n7z9qgjvathseyxex0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%26client%3Dca-pub-3282547114800347%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba4a0c91bdda0c6f615970c6c39dbe9e47f84613f5460c2b21bf5d1eec6277a3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jul 2023 16:29:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 327911
etag: W/"8f7b47e4fef4e58c4cfeb4f6c445dcb6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lB5FbSu%2FX3UDd8DxCnxDJQxn62hGKi53OisS5s7JiJNapTu6nF24tKekW6Jrj5eA%2BZZcRW9Ptiqplhl3CV2NoaVh%2BL3evwcn1s9WkqLvuoMtCpTD0%2B56VstFYx75CvVXgYwEEb4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 7f1ebcd71bc49016-FRA
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Aug 2023 16:30:15 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 33F0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

29ms
28ms

Image
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol: H3
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Redirect headers

date: Sat, 05 Aug 2023 11:35:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 33F0 2 KB
2 KB 107ms
106ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 04:40:07 GMT
x-content-type-options: nosniff
server: cafe
age: 24929
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 06 Aug 2023 04:40:07 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 33F0 295 B
319 B 108ms
106ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 15:21:19 GMT
x-content-type-options: nosniff
server: cafe
age: 72857
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 05 Aug 2023 15:21:19 GMT

GET
H2 200 2560905734134455667
s0.2mdn.net/simgad/ Frame 33F0 117 KB
117 KB 103ms
101ms Image
image/jpeg 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2560905734134455667

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/amp4ads-v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89e85f9b8fc9cbd03a4754b9dbe43f26e1f42aa2007fe1e2a590c8ad21dcaff9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 07:25:44 GMT
x-content-type-options: nosniff
age: 14992
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120160
x-xss-protection: 0
last-modified: Wed, 12 Jul 2023 13:09:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 04 Aug 2024 07:25:44 GMT

GET
H2 200 17558191872829141573
s0.2mdn.net/simgad/ Frame 33F0 10 KB
10 KB 103ms
102ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17558191872829141573

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/amp4ads-v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 15:15:38 GMT
x-content-type-options: nosniff
age: 73198
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10020
x-xss-protection: 0
last-modified: Wed, 12 Jul 2023 13:09:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Aug 2024 15:15:38 GMT

GET
DATA 200
OK truncated
/ Frame 5296 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a00abd2f29c410e4651c9aa2f69770ad149884218232e6956fe962bdee84848d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 118ms
118ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230802&jk=3604643475947393&bg=!-fql-q7NAAZGOVy5Zjk7ADkAdvg8Wq5706HVCLAcSt3YJ0w3YRSJd7YWsD9ASCneHQcklQPMNAmOScGTRquqQhjaoSm4ORvXGh0CAAAAVlIAAAAIaAEHmQKrChp14Uj7XzTwJjtNdHoFPk4B2BWGZgVKjY7Ui06QX-IZtkR1PcSWL3aSbvh07OtzlDgSZYGgZlx3QF4eIzVLO55LAqybiyRetFGWH4fGOFcDv83JKTQhF-0Fs_firj36o8s9xl8NBjfFaYi5xK6fCmYRBBGBFwsrcpIwj2mhuBb2Dlpli_rt0sTLHlLmEqhTAnZK7peaELC0L4Se3Erq7YLvDIhf8z_xcYDUD4hQVyrwGx_SFR_Rhi_1uHhLLXEMd7Ki4a5BQ_DlEHHoQaKBI-vT_9e7yczlkjEmGDHUhi6wxjrbO8fWQpsQE1herIsnlrnlRkWHZkTeTrAmHu9tTDq_FCbYP4ENYfFwN0mx7y_UG2c6u32g84i01DjpT0bmBwUJJzdmjr0GsxkGoIirL4I6DyeQCp27gvwyhNjeNNKirjTNtwnVEvgMdgXqtlWcYELkSsAnL8XBMQLHH6BqI2aJFuSjq_XVkHcWosDBwyaFWREHlalQDt6A4sproz743rCt7u4cQLGHUdpQMyyFy_3mr5l9LxJbrj384K5DRke-zK7_qF_GgIw1TUdxsGJhmOZNEQ7sSrzFlE54hEh7PT-7M7s8F92y5m032La1i0ZWZlT0hYY45-ZpOFqQD5njFDHCiwj_sb88Oa1PHA2vEl3YOMaS-fmF8fVXjv65A2D0jZNJwH8POGKaDWeRfwgfbQwn_0PL0LCoMugqIDLxbs5m9j_cZQ-V8vE_MBSF4Rn-xY86FoWoXbhhKrgH1dSymwEqiQ_WDsWIR_OLvhKxjtTxr-ZRDSTBaqwK1eaWJZpyG7h62dN-WPFzU58mh35mCzy5Ad-XrsQNrjmfaRFc1e9SSDe3nnPMUSrqEWVPE_nlmWX116QeHRkSyb8qyNlW9JSNV1sqvaZ6WoQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3 200 ad
googleads.g.doubleclick.net/dbm/ Frame 33F0 42 B
64 B 29ms
28ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DQsHr-yMv1NrAA90s3zeTf35Qitek0Po4vX-ssAhL1Nol1YHk2csvYuOHqLonjblAsCJnD9ZCA-v10AsLRBy2Zv48e64AoossVYjciwXnAhvfAg0Cuan27BQ_4d0LvhvKUZbUBHdckxBmpyObjuZb30TiPRA&dbm_d=AKAmf-AsS5c9T3wXNoLGgYO4VQCq0lpLyNKd6oAjRpl_5Ab0sjOwW99TwhfSF_qpSGSAoeJs1qDbhGQokQNN956sekfs7xc9ifyOE6q6TZLoAu5zFxg68bb3qnKggYqI9HpG5eMPpJhNap-JthfJp6PEjMWzU3Z9oNkU-Tlwl_bRgQjKFupdDtV29-kTzYhGa9pYLst4BAS3RFfBaZtb3oo-xAH2kC5DUMeT_Yuow0kImqseoM5AUjqqN__BDmC9_YdjlmrzsxNBz7TnCUCZ8uEyU6-PdmUTj93D8AT7vkhiyUFhWM2LimhokHI7TO5E0ECBXk2bD4CDm-B-ouaGvkQj3PSL0hIhkaXWc6tuKpRYVgdo5NTU5YuOoyoXwRfwXbWoW2Rnzu7V_5cfC2i-ZWWogaRCAhcyqTAohbgnmSTMI-4vwC2DuemT7okHPpraEMvcuGdWqO4tRAusKHVwDe6shHXOqxFMvNDMK3xnGFaJNSZkQ0LsSYU71HwBK_7vqdJTnd5WeM6O6hkWd66CmmFAwvVTyeWk0k2-22LnStz5QObkYAvOza7iEneQ8_f8j5XDJZM32-Qo3LDLl8E9UkqUJdS58Cv2VOCrfzbiAB_E0_ULM_7T30qaj7TVPvVVMbgOLgQQewqnofQIRLSI3gI7SVw32ZIhuZ8DPiyqrZrijHFtwjjtBYQh405_Zu2rKMstXK0uOMr187otZtH_qFfXY-nxMSKES_mEHyeBZ5G-OaxyzLvpWx0-GwChk0baHNImTfDZAZuBpxjOeZrC_TPKXxc-eGIgxigcknXf5RL6J4myQ0S5oOsM0pecADtpsMgRcWKRaVx8MW7dq0LpVQSexgE1nLHj6KW63rZ2I9llNXPCJtwz-xaDYGhbrlwQgZnxovanFSZcluviR_HKdcrJRExmb9zqBp7UBw-NaUGLsf3KxmKPLHNJLDFTGvzKj1lJXHe-ma7mZLZPHVDDnRqy3AQ6p8SCDjQkazt9an2HKQvBqxP8FJlEnDt-KxdEsJCcD51yWvT3LIMK2JPDIDRFLlwJliWHHjFU7e1U4PuPwhAhagi2dSazaoXzJcgszXUQl01kwApuz4M_Z_cgrBfLT2w58NaJukOMKNeSfuXd4oTfeuP03YQtOh2dvPwglp9iZmIHQS2Gcc5UbsAFARhkyzZ1npmdSlP8WOTbn7-kH9pfJMZaMxZPegvi_Bz-sc33ANW2UWwc9ghFnjsbt4Ym9StindXd9mQ4lLq2De7HUFN61N4CpKgmbBEJYdbtDWOUF7EErmeL9SMOCMUW1lp6KDxfpnAHwU3OYPwkspIZoh5hghlJGLd-E6b8dpPCcPy_teC2AEmtvqSW2UIvYUQBa5clNONYINQvK_8wzqA1g-yjYQKU2LlGBIsGnhB0xguG5V1skB60fBBEJ_auI_-fW1eKFvqnwvfbZKGRBWbMGPC3DMw_mmNzKz4qOLo6Zss8LugNRTUfuhOMCPGD5TPLcCAtAIh8ZLAmyfXyeOyBbNV1F6Od753Ti8BItCC_YMhWbP2lmfTKRscTBFJp3USp9eL0eUX0e0XWvJX-rCDzGgpfV9h4vL81bO-I0KNrGAfY-sx_zPVymeZkW4k-9RtqGDreC6Gonus4XFkRUUvqEhV7MNyf-dg9UYKsY4OGA0MbvGRfshJ5VwiG6Gmhvg9sb8_YF4X_3YuWno3vwjfki5sYO3f-5wr88XrB28sr777IJyBUTydBoGNjJw87F27l7UAzqXbBlccgB1y2D0Sr49amNuU5Tk8TWYQIl11zOz-ITSZmETZ5iR-H35xRIiPIVG9FOCElPW_jJNSgoCe8lFDlPp6aKu9fej4EW0C3M9VUuavpLRv9yYP7yxm8Tn744G6Nq0n1ZBPdqkvA6SAk2thvwTN0LgB1bT0cO66b7gLDODKgA-AzL36ILmhwCW1aPr4MkR26hhHgxbsYCBHJ_qvciAp4ghv2u8ikvk5xCztJkmyKgGcsrXe2PVzgLAih6ews34V3vF00T1brrcWM6FMnC1MFnsN8QGx51UoMeanvQFCQOIPrMhKCAdmaOkmGjlxqXJGL60VG6NQqd4OnVRpTJZj4r5VmrUiPW538ileBw5Xaku2GMjJoJJt_7WbuF3TCbQquxJUe8XQfMqYQaVSkalUbDEyVIblWdewpHCK67BwohhQmLM7KE6k4CP6TTPwn6ZNv7h73OcwUQ6hBuxMcsv7zN_uK0t4u28GuASikS59LxmX0YHyQLTwdx2Bo0ESp2hdxa6K9JtXIj33xK14XdYss9LfAfe3HjcxeL9whSy1etNrUtcKZi3BA4bQGILzRiBXu1x58S8Ais0o1F9aEjc_HzDgZv7dZOmwVwNoHLy675h8_w2WUseLAo-LbV0xDVWrvYvhSoB41zSTLrCgcRQLNiUAZac62GIPZgbXVcA_1crzUm98vPP1-6eqxtVsOVTu2sLyPV4a6y40PtlVUZsMhoGuyv85ghM23h_YE301ZhbUE-5FeXEIRh8rTfM8UiknfTUo-il9RtwDhJJO6W7HItHhpBRxgQ6_J6WZcOukAk89cj3HkmoMBZC6Ii-ncdjKvfzERnOWxdYchi834kLstBmgsqW8dguYNMWnagvj8SllMMt8vibZIaauOuRrBd3WtksyyVgcAh4b0MDQpFoTgIgTgY34pvHdgPEAsbGBMyousquagqy2Y4XH6pbY1Hrmm1UOi_BXpY_ikqYjcXgG5hfI_COt78fjXicBqhqKM-8MqpTxNSxFVfVxt9buLCaZGbl_pX6m4W-dUU2n-Hy_AlZQHuXUjnU4LrSjPkhakZgIIaFiHNRAX5o6QpXPFn5Z2zrPZFTnTE-HvL8H85IEQsr3WAp-QStxXSb3BrvjdeyUlLU5AGYkpPHI5niwJ_OmSoKko28TMHD7xwziUwXanKqD2SKM25HTbm74mKRhNxeLZbNbQY5qw9dvgoLeOUzYsXffnHmCXqG1sTgv0XxeJb8F3p9yAmb0dueS_QfilbugMx5jRc8CGz_bBo7QZlpzpgnF-HmaCP7KoN0NgtUK_XRLGcY7M4r7xPXkNRpXxCle_dUn5DLcJrs1Zgd64yf55Z1mxuPtISd5by4CdDcrNIitNCynRWInnG1QiKouOudaIz8-kZdqcXOKmxY2e7YStqGFXqqiN4Eg0JYNFW3LOKD1Lc0x2loYTnCY3itIkaoY9IYAY1ptp2UZx0BuhAsGcUEkOUvhzpPVBmIrmWa7HvANBAzC9WG4kylXM9XLelEqMdkH51QLd9W7ozujkiNYlYYcAiiPk1vZkxhM7xQ-EtX3POq26AWgIFZbh6UaAzucrXykDbbAMv182OdAarMy77T1gG4d8Xsy9jE2T_shz5cW73gE5Pqhh0auUs4Uh5UFIwWUuBjTLOpIFaxR2jzwcQHz_xqPu2uP1WOKKK8mxgWKU527gwJsSkqTaLnYeXEEHebBjjwh5xsfJPwXwKBuBh5KDk9yswNfmArqVihMrd-Et4qOh2bN94RXltiZAbPTQShwuykQ4xYaOx1E85ah89T0fU5aCndnWpwYdcQ2avxpWEfisg3BGDJkhy5IuB60-CueI5mF95OEsGCtV1PR7K0deaspqqhTT7kQDBeQr8Eg&cid=CAQSPABpAlJW5VkkpwIA_58M0gTaPyliGJviA5SlDYmfy0rJbWrNBYs3ytBsKG8Nnmpc0iRDF7gz4NFGQbvPpRgB&dc_exteid=31197785419869826360286888482683099&dc_pubid=4&cbvp=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 33F0 0
0 47ms
47ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CETwQCDTOZP2JBsHigQfhtILIBbbCwopyqpyXpPER_f2j7ak-EAEgkeLkH2CVko2CmAegAYLg7tIpyAEGqQI1PdpABHeyPqgDAaoE9AFP0Ej8jzUVHzsIki2Z4YJP3PoXsHaS4UojhUZLBXsi8mMEfX40fjDBJncfnNrQXvGSCY29D2w_T7afHOsHP770KLJcrZKpXFcmmRSd9dK9f1x-6mLURGyaRVSut-pMtyMFvIPPw83M5szeYtSznJn4DNPv9_l2gvOrI_A0LVHTh-ojnIKlNVCtsYmx6RUb4wwV7Trix0aIyrMCDaV4jdnS4qZqhgzbE-AhF4406gNDNe7NJKLGonhGHakkty60zT3FsaOl256J-HuleY4EavO844F1yUUaXXsE8WyCfRB_vghIwIxy4yHkhX22qnaS48zT0cHrwAS78qvSsQTgBAOIBfugiu1LkgUGCBsQAxgDkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAY3gAeCmL-yBKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcKELy-CRiv1cXwAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTgyNTgzMDcxMTA2MDAwOTOACgPICwGiDAgqBgoEw7CxArATh9KGFMgTicmf4wPQEwDYEw2IFALYFAHQFQGAFwGyFx4KHAgAEhRwdWItMTU3MDY2MTk2Mjg2Njk4MRiQ_RI&sigh=8IBlR4j4uMQ&uach_m=[]&cid=CAQSPABpAlJW5VkkpwIA_58M0gTaPyliGJviA5SlDYmfy0rJbWrNBYs3ytBsKG8Nnmpc0iRDF7gz4NFGQbvPpRgB&template_id=509&vt=10&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame F615 3 KB
4 KB 71ms
21ms Image
image/png 2606:4700:20::681a:61b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.48/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:61b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 552
x-guploader-uploadid: ADPycdu_bETbAO3L7E3ZwmLe8QxiVBASGCjfRAxwlm_tkXJYko3jNEaJxZb3LISJ1TPqVw-ds5Su5eyQQRqdQCYhbG3a5A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 3262
last-modified: Tue, 21 Jun 2022 12:31:17 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
vary: Accept-Encoding
x-goog-generation: 1655814677405990
content-type: image/png
content-language: en
x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
cache-control: public, max-age=7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TcsYlxHS3CMkuo9kyI9Rds8CtI%2Fqu0dJzumqG4XXA2OBVnzJxYeBo7F0cLwN4DHXJU7ptLdngOZQVijetD3dWJ9E5G9WeJiI2SOaJpFCnO0BsYC0tXioml6JhmeTYa4IVJqofhb2VPXMTZQ%2Bvw3X0l%2Fn"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 7f1ebcd7adcb360e-FRA
expires: Sat, 05 Aug 2023 12:23:45 GMT

GET
H3 200 frame.html Show response
ad4m.at/ Frame BF89 2 KB
1 KB 31ms
31ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1955399
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 7f1ebcd76c529b39-FRA
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Sat, 05 Aug 2023 11:35:36 GMT
expires: Sun, 09 Jul 2023 00:24:59 GMT
last-modified: Thu, 25 Aug 2022 14:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A0YZZFzyzsz%2BbL9iG0KrDY%2BKehhUA9CCZNo5ZEM9UCVMjIGh%2F5CJWj%2BjixyTBvFPmSC7zv2XyiiI2QSg2VcmRGEb13H5I3dLinWKgFwFEcOFI%2BH%2FZlX3z1mySFjbKIbWU%2Fbc6ls%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 container.html Show response
687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9201 6 KB
3 KB 9ms
7ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:35 GMT
expires: Sun, 04 Aug 2024 11:35:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1C2A 6 KB
3 KB 9ms
9ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:35 GMT
expires: Sun, 04 Aug 2024 11:35:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 124E 624 B
242 B 49ms
48ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYm4no4gEwAQ&v=APEucNXr4D_TksOQwVMFP5ajk2aPXJafR9QWYjfNEWoenCpOvo0UzKgRnG77rGJKR-v-NO3p1QP_CkKoy2YGJaOzyS8BVru0hp8aY_Zig2KqbViVANuqwxUSFJdNHFO9zjLqW7VfpBsa7GasHEff8B5ilar07wmM3DjveFZpT8bxvIh4GQaT0ho6Ar-fnmeLUyyU6xiXKwnSmh3JSEgbijGkAT58iolgpw

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9201 86 KB
29 KB 132ms
131ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9201 42 B
63 B 104ms
103ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BFPcNdz7wsP36xwuiDHNEsWH2z9QeSygUwuKq6xZAsW4NTXXWO1usYnPE1UENSiTy1uJk4sg9vhBVQYkuiWw7OcHB8LFvRdzq9e7AaAtWHjHHp-xY

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9201 0
20 B 104ms
103ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11801475402298968733&x=1&ct=76

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 9201 3 KB
1 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/window_focus_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 14:44:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75052
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 14:44:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 9201 20 KB
8 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9278ee0a91cf49cab1fcafd47c3b9875e683dbe7a26e3ffa83c9e671b75ca28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:47:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78513
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8261
x-xss-protection: 0
server: cafe
etag: 3571037177597359341
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:47:03 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9201 0
0 16ms
16ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSW7jXJ9fNmWm_3NG8RBfjYADsyRtYeK_gZZwk6R9ug7RnqyOpq6JPFP1aYGJ4UMr7mF_HZrhM7VS8J0h3g4xcJWOyX-Q
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9201 179 KB
56 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45b4eee66ac74743c86ea5a55ea614ddb12bc1407e4bfca8ff92c308c82795e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57430
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690976231057960"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:36 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5296 0
0 52ms
51ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cuh7ECDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT7AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LBnpdFuxLCbslHcYRxvNutFmKtYarUg1AFMl2HUoJBjqNOkQmvTj4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkzgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTMyODI1NDcxMTQ4MDAzNDcYkP0S&sigh=HxFHPimQ3P8&uach_m=[UACH]&cid=CAQSPABpAlJW0b4bBn7p7ZfEenA7go39is5T9EWkvz7mjEl4rzHGRT5ioaICWNh3SgDtzaASwlSAXwDG1XoQwBgB&cbvp=2&vis=1
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 5296 0
103 B 53ms
17ms Image
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1gs1xq7kcq4h4pnxr1bgz9t245wvndq48zxws703veqfmf0rr5jz8xnr7bscac2mh851cy00e2a8ynvdz2r63y6vhkyhq9zw2j8r8z2zma46xphmn7r40k5ep60vh8whdxgstw13eqd8agy4vnnprnawf2cy86q97xaz0pvr9vwxxr56tv4wkc0y77p05em7sb8s8wj3qxkr8tmd4n56x0hce0x3xr01bc4bj96sajactea63c01t717495hy5wx5jn79810hc3tsb75xeznsy7nfpgvs5vsvmbzkzjq4cdagb6m9drekefqjey5gsnp8dydre92k8aykrvvdpxy7nyrxqf40adeez9xjvfstxd8jmfsc79en0zdyt06p5njsfq9csh8mv3m9p9y&b=ZM40CAABPeYKe6ICAAG22LWPJwqZbJABiyt4yg&cbvp=2
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 05 Aug 2023 11:35:36 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/gif

GET
H3 200 Responsive_listing.html Show response
tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/ Frame 97A2 4 KB
1 KB 9ms
8ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0f380fdee43a0103d5cd9bee42e3822ac60512f918a7ed2f805cdaefc5beadc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 18055
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 1016
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 06:34:41 GMT
etag: 11900953634711111692
expires: Sun, 06 Aug 2023 06:34:41 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/ Frame 1C2A 23 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/abg_lite_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2afc9ac73c644d48e790a39acf19a2f4482c2a6c28d784824b9a164f74cffbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:46:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78572
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9098
x-xss-protection: 0
server: cafe
etag: 16188647127460483431
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:46:04 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AB57 143 B
166 B 10ms
7ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1393
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:12:23 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 1C2A 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/window_focus_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 14:44:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75052
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 14:44:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 1C2A 20 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9278ee0a91cf49cab1fcafd47c3b9875e683dbe7a26e3ffa83c9e671b75ca28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:47:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78513
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8261
x-xss-protection: 0
server: cafe
etag: 3571037177597359341
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:47:03 GMT

GET
H3 200 container.html Show response
687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 335E 6 KB
3 KB 9ms
8ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:35 GMT
expires: Sun, 04 Aug 2024 11:35:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 124E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYm4no4gEwAQ&v=APEucNXr4D_TksOQwVMFP5ajk2aPXJafR9QWYjfNEWoenCpOvo0UzKgRnG77rGJKR-v-NO3p1QP_CkKoy2YGJaOzyS8BVru0hp8aY_Zig2KqbViVANuqwxUSFJdNHFO9zjLqW7VfpBsa7GasHEff8B5ilar07wmM3DjveFZpT8bxvIh4GQaT0ho6Ar-fnmeLUyyU6xiXKwnSmh3JSEgbijGkAT58iolgpw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 124E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZM40CErFdB6tbzU52pebGgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYm4no4gEwAQ&v=APEucNXr4D_TksOQwVMFP5ajk2aPXJafR9QWYjfNEWoenCpOvo0UzKgRnG77rGJKR-v-NO3p1QP_CkKoy2YGJaOzyS8BVru0hp8aY_Zig2KqbViVANuqwxUSFJdNHFO9zjLqW7VfpBsa7GasHEff8B5ilar07wmM3DjveFZpT8bxvIh4GQaT0ho6Ar-fnmeLUyyU6xiXKwnSmh3JSEgbijGkAT58iolgpw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 124E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFe80kZug8ybNBTEZyRkllA&google_cver=1

43 B
840 B

7ms
7ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFe80kZug8ybNBTEZyRkllA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYm4no4gEwAQ&v=APEucNXr4D_TksOQwVMFP5ajk2aPXJafR9QWYjfNEWoenCpOvo0UzKgRnG77rGJKR-v-NO3p1QP_CkKoy2YGJaOzyS8BVru0hp8aY_Zig2KqbViVANuqwxUSFJdNHFO9zjLqW7VfpBsa7GasHEff8B5ilar07wmM3DjveFZpT8bxvIh4GQaT0ho6Ar-fnmeLUyyU6xiXKwnSmh3JSEgbijGkAT58iolgpw

Protocol

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
an-x-request-uuid: c7ef474d-8747-45d1-8ba1-a638c4af2594
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFe80kZug8ybNBTEZyRkllA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 124E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D

170 B
188 B

22ms
22ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D

Requested by

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
an-x-request-uuid: d78bea01-83af-4e50-98a8-ebb0b585cd49
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Configurable_01_122.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 97A2 74 KB
25 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Configurable_01_122.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ef7e00750f06efee8a0074f2984b78a62c1a0f8cb971f01197532d57a78a836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 06:56:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25356
x-xss-protection: 0
server: cafe
etag: 15511454539072389427
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 06 Aug 2023 06:56:34 GMT

GET
H3 200 Responsive_listing.js Show response
tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/ Frame 97A2 199 KB
65 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a96924ddd5fb2ea84242905ab60d5ba262bb28e91fd6f097a077db0a63728dec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 11:44:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85891
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66166
x-xss-protection: 0
server: cafe
etag: 5199203132765013944
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:44:06 GMT

GET
H3 200 Responsive_listing.css
tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/ Frame 97A2 11 KB
2 KB 9ms
8ms Stylesheet
text/css 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c2b09643e58ded9316fb73dfab3ffca42772599008066cf599bfc7fb40766c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 06:46:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17331
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1758
x-xss-protection: 0
server: cafe
etag: 15825927903621683888
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 06 Aug 2023 06:46:46 GMT

GET
H3 200 container.html Show response
687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FD0B 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intercelestial.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:35 GMT
expires: Sun, 04 Aug 2024 11:35:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Responsive_listing.html Show response
tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/ Frame B568 4 KB
1 KB 7ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0f380fdee43a0103d5cd9bee42e3822ac60512f918a7ed2f805cdaefc5beadc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 18056
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 1016
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 06:34:41 GMT
etag: 11900953634711111692
expires: Sun, 06 Aug 2023 06:34:41 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/ Frame 335E 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/abg_lite_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2afc9ac73c644d48e790a39acf19a2f4482c2a6c28d784824b9a164f74cffbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:46:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78573
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9098
x-xss-protection: 0
server: cafe
etag: 16188647127460483431
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:46:04 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 691F 143 B
166 B 9ms
8ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1394
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:12:23 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 335E 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/window_focus_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 14:44:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 14:44:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame 335E 20 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9278ee0a91cf49cab1fcafd47c3b9875e683dbe7a26e3ffa83c9e671b75ca28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:47:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78514
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8261
x-xss-protection: 0
server: cafe
etag: 3571037177597359341
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:47:03 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 97A2 34 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/Configurable_01_122.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 19:42:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57192
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 05 Aug 2023 19:42:25 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 70C4 624 B
242 B 47ms
45ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkYxo39xAEwAQ&v=APEucNVOO1fRDIgFfc_AhVjX85424x4Ub4MD80eLgHTLk4ZkzBaqnb4zHAYbzgjkC47ChDkny2OyZosOpd5yGuuvcCFfASuj8oH3PKSxq9vkUh2gfqIWAG0ZwlNAYOXlV_MI7e9oW3mPou9Xw3lmgHxEMYIieJCJlNootl0t7X3Fl6zOoyoBsYvob6cp-9RwAqfAv67hi_rdqrEg_bIN0P6HXk0Hdsqa2Q

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame FD0B 86 KB
29 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FD0B 42 B
63 B 104ms
103ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AtemJPd7VRc5WjpTxr814oflhxcabSQbR9zV-a358xV472xxschtdPnqsoKKFadmAFq5iKCUkhlPfbVp7ugG0tAvSXgAd8yXuc6Aj4QEe1ccpFZ9c

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FD0B 0
20 B 105ms
104ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16408240602340313142&x=1&ct=76

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame FD0B 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/window_focus_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 14:44:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 14:44:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/ Frame FD0B 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230802/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9278ee0a91cf49cab1fcafd47c3b9875e683dbe7a26e3ffa83c9e671b75ca28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:47:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78514
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8261
x-xss-protection: 0
server: cafe
etag: 3571037177597359341
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:47:03 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FD0B 0
0 16ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQtgqHsInDlYV0rhlqG690s7GrUMdMWqJsfZpaq6IeVUe_3r8Co4KHFJg1rGjTUdgKk96h3jY-8OSOPNV7Hp8fca4-NQw
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FD0B 179 KB
56 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45b4eee66ac74743c86ea5a55ea614ddb12bc1407e4bfca8ff92c308c82795e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57430
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690976231057960"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 91E1 0
593 B 7ms
7ms Script
text/html 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
an-x-request-uuid: 18dc9916-1698-4c9e-9d7a-94327ab88a34
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AB57
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

21ms
20ms

Document
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:37 GMT
expires: Sat, 05 Aug 2023 11:35:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:37 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9201 0
20 B 102ms
102ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6456795757123&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9201 0
20 B 102ms
101ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6456795757123&version=m202307240101&ct=76&x=1&cor=11801475402298968000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9201 95 KB
38 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DoS7q9YYjhTuLjmvLWgHkewRDSJNbKfVQ2xlGuA2Cs7xaD8ZV7jCTggE3gkuCsXorax43RptByI5r9ZOtf0R1PB5yMdzFtBg09ElatdPV0ID1k8Rg&cry=1&dbm_d=AKAmf-DGjZS-1XRixL_j73-ENTMZrC4lreoMx4jhxliPmjK0Bc0FplxKiiYL1WiK8GstknO_HdkrXGHIwFOZXxv0jYQxEMlbRYMwfco5yosIxHRwhfqsBkb0NRgOgd24EzF8LvenFpLTaHnGxi6nSxHzyItiwPLGKcJ5nQMk9iz2zPsJTJCWJIwTYRTLWKImN6o5IxR3hgzDjAVOzDv1Uj4aMzVAOuErwuU-vF7g8xlp6RaXJI1uE966O2FPw2Bx2RlLyR4XKBGIHWfBBXVosdcvqoun_k88ofu7EMsGQ4O4RVmm08Yg2Xh9L5PrzaSdOJKMPm0aRQgBQ-CAgFxo_ji1sUXEMYc1XpZRoTQ4MxFNZpdZYQp7fe9Lkc1Mb1sRYvEiOqZ8DjoLNs0TubBZ9-XLad_BxjJQyXDCz603o5PQR98fTEu0Sf9Er-CJp5v6WDTQlz9hJBipsWa83tZvxG8cwZY3Sb_L76laWJ9KKi_C5uvxxsnprpsAHuqwObJr69WtT7Cayr0KUUAje7tTYtbh_7O5ObCk59jlTKNo7bFqAQ3VJKhSPbUz4rLkvBR-d-P40X9DiQ_62ZgVL2ddOGLD-LCVw-7XvkdzswXLt2bVXct5Oeg6W2vJ3iqw_PR_Hdzm1pFjijGyeFhTbypybFT6z7SMm07mX5yy8GaI2-eILncYckswBBqQIispl1TKqMaZc0Fzz55qU8At4S2JvoWxdoDVqjW_fXfNBlOZqyU-wchSB5FlD0joJ1QmVqPQwdGFiQ8cDTFV5YLnZ07VYMBANloj__vI6SnzJc4WybgxUJcmmJRELcovKe-fwj30M9n4-V8DMCtG8n5Cg0Gy06LZfPiETkd3epVpmnQdnFlykTnkpOHVMUKeqjsqkRlhfup0A52uYQRzU8dOejUeOQbZmY52gXRiCy6WFI0daXQ8I6uKk2U3lNeannnOf5X2rV4-Oy4v2jT89gOiDdu9cHDSMx_2VmONLPHG6NYYsvKkkY4vff7cg4-lVRw9k-3k9f-raZractpAeFGNzFJX-5hjV3udkZrq0v40wjxZbBcmtcN2IIJNEzvbX18dn35zAvCWYbZRYF4CbtYUO9dM_KIc8LnR23L3GGraSiwYNRzP3gJSEij3QhzewsSUVD1rSXINi14gALfFa1XroMNIzfANVJUgGrzRPeRoeANBEQ1KC2sYZ66rEumpLTLCqv_v8Xl0G9lwbJ0fmJptogWJXJZBqhDfgsVkxdu9vi0ujQHS3B8mHAZEHE0jvu0xF_ia9pT3n_YpuPbxEHQbPa3DgyiPHDDjIshZXwHlBMbSmOUlnpZUIg0BF0gjOi4qcSG2HrGHWH3haimr-Jss3fBHOVAVVeludeR1P7SxCVPhRFAs2x1q4qWKTYsjLiIFLFL6tSebn133XQ6-tGrjfw6g-DrQ9Qd1-Uofvqa9_3hF2ZpZyTB3YCTf6aKa9Tj_r9CMqmZ38a2E50Yd1q4jNldBWqWWMYEcuvZz7rwVVibENoZKfexu4tOD-rGdcQfGy-qkUlpReowraYtqYeqrlHzBaiyGHxW8SpwqS6QxA4GkkT6Qv1Cwj5aOM-2WB4c9dJ9--5DeIldg_Y2Xatnd9bRmtaxkQF9NksDb56Ysh0YMK4pHD8V0V1yQUB1jFwSl7b5ulGj7ic7X3qmaJaJZ8apPcOKv7DdNEJ-pUkm-CeTFUDqR1eoicU080GxCXlJW9d2BDSGGU6cKD1gSbwhHlOEWb0h6nnMB64entyAD888hpPKhgp1M_YG1IJ6_N_-9V01h9EHy5E12QhEIGh1i7fJzLGRGJgOpdbElEeIWZ6R2-CM1YSgYBdTaH9wjH5bSYBsC33ULjMONye3dc63OIgZnKZJG7_5HDWdqJtvN5JV8ZS9-xTM3dMDBpUU__rw4SKzGNZWT6jwelp7u6KQM051ZCzeqJgaG_9UyKQHNCMk61YnjNVI3j4MWe_uLbc2K5pey5I0kCAmBWkeCg35rdpkMGkKuU96r_hKNLDOMojmWmFj8RDgsPV2VoVJEVMB99HigFaN5zk85bVJ9-mPBA4OnMLSD7mzy387yAobIvkViUHYxH-uftcNXbcXXuWkCFbkbwUex5P6AEw5yYizg7xW0Ya3qe6fxL_VshHlGRfNMyPDTYgoO5_jlej8BLh6UhLvpTuIEvFUB-taV5_Is_v4npc3R3dqvrtvEj6ll2FA1IkFIacbq0XkI_IZXvtYQbDaAo_O8DqFdavkBkqVVHYlNyGCLKkIKQV30HmYEUfecrpg5KKSbYMCiKyMXMhtNfoQ2BiFVahVsU55AZR1RTChRW-KuvA80YWCOIP6cLE3x-gb8tQ2-xI-RODx_vksJd2IJe7LYEKcgjkbsZi72jD528yy6VDfVFqO5v0MWx1PLtwViOvjG6cEfZ4-Eqi-cft6sJXLQpDcGR4GfmkJJxqvTvZNuawMPjFYduAPfUqoweADysbyRMthPbDs48DmPjRd9eA5R2JzIdq_n4hg-XTslVaQi4N7zap6oIq7YiJdqXMen4TFppqy4OFIHvKxfhPDvX9rUYoWMwjInJyR0pynciP394kiFSZF8QeFrvltcX9Gipk1TGxvjJrEh4VKAxiAulOoCPDZ7TrEfQq1YrGExrhxm51wQgIsiZZ1792zJOrGPZ8WPikCa_Z4O699FL9Z4c4QTv6XgO4OBkPNvBm5aSVLV48TWuC6TUoOjBtVlHgDBwf3rbe9LoyXS0Vv0IhrgBf3XnP_F91xHyeeOA6TZUx3UzfPLh-N2qG1eLcWTWoCZQQiS8G_wk4yUkQXWfXsBJxMoQ6If2upO2pNOE7R3jrGCvnYMRI1q5iN6ZWJREA-Ew4xfSiV2jDlkiH9ll3JsamnCgw1zBX0NXtB0LVqHu_-xGR2qBnzJQegHu4KBjcbWyJjL6FWJZSKnn9OYWX1yrlfTWuGwaeoTd_Sx1VNuFaTLJXpUSukOXOTu-tE5O7Xerf_FrO8_YrqfdpRORUMQsuxcMGcCtlz4z-8AOUaWPydLcSoy7hyrP29QwQumCmTlqQKhy81redlgMB_031QynDquwMLNs6tBvnpgLsweIUUswoj72g5Mi8fwdzNV-Z6PDQyFtL5Jq4GgwTmtgSOSYrcitZSBxeCD5P0T4nfGrMXXxRDxSSJIKcI44VekHflO4d2amM58lKFuu4lzkwZrmeMfvcXNTLqKgCFkIDV8iXvae4UelsLu_ogeS-4VMmxpadS9pkZ-eYulk3MF_rAnSQX3R-dsQsV-0l7T1A2qJvnWgwvW_NNBfLKFmkEf6SScqjWOw1rqv7rtDgpUYGFROfkGAw8RPkIt7YiKAx0OoVogaH1O0flSErQs5MhSRz4lD_efD0TAHyq-bNCb63CVg4TsLs5Sqju40HMmCbPc7nszwQPWR9HiUvkX-zUQ7dD6oMsqocJvFXzrz5BhlWXiQkKAnLYzjCeFSzycNFR5NG9xG-LMiNRDqiWHQCKNjgSXlVrbi5KFbX5yLYZBvyAv_5bc4mTUqlvl&cid=CAQSPABpAlJWkRP8beGh5FN8jZL5K3ine2GpC1Je957OQBBG81BWJEaCG0KFrISoCCDm8FAKaivu6_QSp0ozZBgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fintercelestial.com%2F&ds=l&xdt=1&iif=1&cor=11801475402298968000&adk=2004672170&idt=140&cac=0&dtd=44

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3da9ccad144fad24928fc5d0f69648ea4e6918e1e341e709aac7073fe8fe4bc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38679
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Configurable_01_122.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame B568 74 KB
25 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Configurable_01_122.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ef7e00750f06efee8a0074f2984b78a62c1a0f8cb971f01197532d57a78a836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 06:56:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25356
x-xss-protection: 0
server: cafe
etag: 15511454539072389427
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 06 Aug 2023 06:56:34 GMT

GET
H3 200 Responsive_listing.js Show response
tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/ Frame B568 199 KB
65 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a96924ddd5fb2ea84242905ab60d5ba262bb28e91fd6f097a077db0a63728dec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 11:44:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85891
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66166
x-xss-protection: 0
server: cafe
etag: 5199203132765013944
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:44:06 GMT

GET
H3 200 Responsive_listing.css
tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/ Frame B568 11 KB
2 KB 10ms
9ms Stylesheet
text/css 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c2b09643e58ded9316fb73dfab3ffca42772599008066cf599bfc7fb40766c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 06:46:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17331
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1758
x-xss-protection: 0
server: cafe
etag: 15825927903621683888
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 06 Aug 2023 06:46:46 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 1C2A 0
0 17ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRuDg8IM3JDa0FBeq_pmMnyBqiKzZmgUHbyfFURGuAL2hsg2eb6zlq7s3Ht2PuyY3YOMN1VyIf6gduzHu9X7RvWEEIdNg
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1C2A 179 KB
56 KB 21ms
19ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45b4eee66ac74743c86ea5a55ea614ddb12bc1407e4bfca8ff92c308c82795e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57430
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690976231057960"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 70C4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1

43 B
632 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkYxo39xAEwAQ&v=APEucNVOO1fRDIgFfc_AhVjX85424x4Ub4MD80eLgHTLk4ZkzBaqnb4zHAYbzgjkC47ChDkny2OyZosOpd5yGuuvcCFfASuj8oH3PKSxq9vkUh2gfqIWAG0ZwlNAYOXlV_MI7e9oW3mPou9Xw3lmgHxEMYIieJCJlNootl0t7X3Fl6zOoyoBsYvob6cp-9RwAqfAv67hi_rdqrEg_bIN0P6HXk0Hdsqa2Q
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 70C4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZM40CErFdB6tbzU52pebGgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1

43 B
632 B

17ms
16ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkYxo39xAEwAQ&v=APEucNVOO1fRDIgFfc_AhVjX85424x4Ub4MD80eLgHTLk4ZkzBaqnb4zHAYbzgjkC47ChDkny2OyZosOpd5yGuuvcCFfASuj8oH3PKSxq9vkUh2gfqIWAG0ZwlNAYOXlV_MI7e9oW3mPou9Xw3lmgHxEMYIieJCJlNootl0t7X3Fl6zOoyoBsYvob6cp-9RwAqfAv67hi_rdqrEg_bIN0P6HXk0Hdsqa2Q
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=493
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDKJL5OL_EvFIkEhFe8WhJ0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 70C4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFe80kZug8ybNBTEZyRkllA&google_cver=1

43 B
840 B

7ms
7ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFe80kZug8ybNBTEZyRkllA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkYxo39xAEwAQ&v=APEucNVOO1fRDIgFfc_AhVjX85424x4Ub4MD80eLgHTLk4ZkzBaqnb4zHAYbzgjkC47ChDkny2OyZosOpd5yGuuvcCFfASuj8oH3PKSxq9vkUh2gfqIWAG0ZwlNAYOXlV_MI7e9oW3mPou9Xw3lmgHxEMYIieJCJlNootl0t7X3Fl6zOoyoBsYvob6cp-9RwAqfAv67hi_rdqrEg_bIN0P6HXk0Hdsqa2Q

Protocol

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
an-x-request-uuid: f7be1bcc-c191-457e-9b2f-61867a428b94
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFe80kZug8ybNBTEZyRkllA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 70C4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D

170 B
188 B

24ms
24ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D

Requested by

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
an-x-request-uuid: b01bade2-93e6-40cf-a592-8d94ab37c606
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA1NjEzNDI2NTQ4OTU2NTc3OA%3D%3D
x-proxy-origin: 81.95.5.38; 81.95.5.38; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 1C2A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05532f065ec6d7cbaa5dbe6275d5342863fcb9ee51ed215dd62dd308619ea8e6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 45ms
34ms Preflight
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://as.ad4m.at
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f1ebcd9da65bb83-FRA
content-length: 24
content-type: text/plain
date: Sat, 05 Aug 2023 11:35:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ybYrubYRd21cKfFkVtdZakLBGDp6hUzLVz%2BEwNnZdx%2Bv0GWEGgz3jnG5hqVBNOL5AZ7yd08ORPF6rUfb1%2B98DpHcaA%2BL0wv9c9QHW226uHN2xa%2F%2FUC%2FdtBVlzq0HFBcMywM4CUI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-x9v0

POST
H3 200 rs Show response
ad4m.at/ Frame F615 1 KB
2 KB 49ms
48ms XHR
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6102f37bb618f449b90070a53d552a4cb6ebd1eb6c5531767a35e13b6e3fe88

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=247F8FOv0aRcAIujZFrnx05Dd4DRVbPAa5mMT5df0K%2Bs2BAQG6XKkZ9ZKcXszEL7nXkZgV%2FoMxHlqds%2BVBqpSHCscw36oNAmF2ux8iS4LQa8nalJ7Nh4WQMI5%2FRelsDL%2B4Q2T2E%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
cf-ray: 7f1ebcda0ababb83-FRA
x-backend-server: aa-reachservice-group-europe-west1-5x73
alt-svc: h3=":443"; ma=86400

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FD0B 0
20 B 101ms
101ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6500128754575&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FD0B 0
20 B 101ms
101ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6500128754575&version=m202307240101&ct=76&x=1&cor=16408240602340313000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FD0B 103 KB
39 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aae_KY9cUfih77T3_681Y4F1UvcVPiFlH15tF4ZDUlbJdCm304uypSDTN0oRgz0ZNYXX7vAzSdnNEWWMFWjACDwwzWKgG9_gHMtkBQI_-WPDlo5_FWbzWNAM-IE51abuCfxg5hopW_aEJ1uajKMUn069smf0Bb3veJ4sY6orQ1D2hjcgE&dbm_d=AKAmf-BClFLTK4P7jZFdh1Lb34ujgB-IPIf7iXQqRe-zxJgKN8HLtqwPc4D4b7yZA8CzxBd_uyjwRWp855fihDHeoNu21vCxv6ZClIexlfbwpdpj9cwob7_Vh2TPBVzGrDG_v5c-lufz-rM443C1LUh0IjhJ8a8-gw2uof3OCYkNA29vuo7f2-k8kGG1jGIckF6tC5uAjUStQiagcmHERvpp72BZykXW_q2QHMXwPr6YnUKzWknRA0tljynYuy_pDfBfojoH6eHk59Qp692_QNHVi7amjbwaCEv-4BuiAhqmPk1l00vR0TQRzbFm-1oVH-baxIg0rCB2eeSxLWY6q3nd_Q0Xp-rF7UHR6udX5JoTTALRemX5w0Gz4f6w4wFKK7PfRM1vYfrqmFBQINgo4bOQiiy4aHa2UjsvtNw4SwUtte1MZfT6JcNkKb7xL8bxpSukrMC36202yI_hgGDgjIic7sYfgFICmKjGBi9HzSIemmIZ9pzwTsOaKWNP1kfpiE2ujKhNzkbMlOQmoTV23pNgGIf3Ewj-IZ_Z2SwGraiGLEDbVDB16rLnfxxDryN6H0a3Cgjp25AdkCT-7x4kyP_pwqqFCZ8SyBDUKKyLekgCkpy1vxg07YwMrrE-v9tepDyiOqDPtnqi9R52rM7vrjLpXnNOkmI8HikjKg1FWkIXbKrCMzbyPQwnpW6pQoiw_0uRHs67R3i-r6BECvFOiyW_YoiZ_w7OFtermZRw5cAkfOyOh9XjGD7rb950ZMc2reCHe9OBmRgSxWnY9lyKmMh_iiCVJnBXIsqkTXtBTk6kY4oiGBc_Wg8RGg-ZK4UbV8WTZt0ohrg93Pp2IB-QUFjJZkT7iuh7MPzviFPWEXzvbA6pvnVEHZ3wIp-uqvO9-oFXearzQILX6E_VuTqFSZc-Y0ExBiM9CwbBDICgbvShwnN9ljiXuAFwoDwe8F-ZXicS-hg-bJsryFkwdh1YE2Ltihg8RuV4ULks6G50aNCN8LlqIzGj5Y049C6nx6SL2jWvXQxxpo3SSyXBsFaTY96HIHuZIiKT5GVBcbyHDqwnBkw4NlKYTyK7cR_pxJaxua_nNfgVjnDVp6pZeHpG0iZZPQyh-F_cKjDsElmXsDn9qnj5mNwJ1kKCbnZJ98M7msM8o4qa0jCV0hPMRzrnIFyWwUt_DG9B7hF09zVdAsMtKE2yctAad0YXc-kibzh2FaRctO1EO2d8inD3sRpSZKKsi-ca1XOcAeulk2BzaYJsnZuVk_ZFGvU5bkltOHW6HlCWG0bjXr30wanyo3jl5h5buI3PO5gsx1HT1XP7XMvdH900qPIrWDaqA9ThCfPRpYc2pFIef2VscWnWuif4OuYkbBKeXHLWNv59K6EW7D9Hnrl0ukdG5MNa-pKUMNT2vv8VBOK85Vh89vlwafODDKK3-nGS9_PSITGQTVP9VcjyfbnH5WLGDOY5slL1HoiWLto-b0iW-3ViZeLzhxb6D0DEGRmTjHLaWVQTyP-YlOUVxSNdEd2cdsvUEY3XTEQnMHsPM3ry8oz6nmmN7WOIUb7Bb1JqfmnCNC7CX6CtD_-lBxA1sCN4Mclg3lMOHtp2709eQgKD_67vBZayIfyAwREYOn2jx_MqgIZPhS3gyXidsV55Ab015XWvjep9op1quk83MKCVxT4e6irS6TaoDB-utP9oMVoIIJfdkeVtX2YSR8Z1mgDRFcQtbNFvmQlimJTk0BhRccwGG_6NTrra0SgFHABhJw6sxbHQczzT7hrG6HUBng1J69PXAn2wrtYKgwHtsfjV2URb4UXFj4QN8PDhBoOSe-UlQSpECV5X47iiigfHUNVmFxcCA6pfLRdgEziWgxIbBVGCfXVUk7WO3Yf94EOESErPa25lkjs4RNhCTVX8fNQJXxhJWVB65fRmaVsYy_Q14hNYkhQirUCpYFealJ9Ntns7yiVbY4ip0JSp93lVnWzedJ32YxSZS_vH0ORc3Nynd81eYN6FgIC6fcjm9Fu2oY3vHpEK2Z4ZE4hH1lHCn6-zopDFBQnrHWcPNfN1NRH2T4ksYRLW7jgIaSMXhXCCtxQGYyoCk5e-qdkBSj6SnTbdNgKP0bu50DI4F90NaHC6wTGBrdWDxZYoKvK7Dam-W9sn95timjnUZoC_kKF-xIBBZxSAHuGgUWtUzOIO-f2C7zaOtKLyo5sIzZnzdejOsqbO1mCk_j-9N2ckdS_s5_CYoM0nFX-QAkEuRY0f1RTeE3SoPgleonVS8NIVBEtwDvz9HtvXGdmXlEBOammEjXHc5PSifnIo0fQHicbJKnLVJuvVX-gQqJxQNK5pRs1bNeyFk_E75Ad_kR5ddrAL-PjINztPBVLK0eVzSCsSCX5PwqJWeKiauSbRJOhuyKehjzrxNb4t5KQeyBp42BDZR9A3MnPcN-cGYb816zfIOTzD-JwanDpYeg4QF85BHSDzCAT2TkoGdlY6luceZGAIZSOi-NZN8aTj9XuRP_aIIEpPKK6YgJlK6zYWpd8V7fr-BVQD5kSXAt_fHCMTAtjL7SDOJmmsVHZeE2pNIiL7G3cG2URGeIgW2ZovcofPesJxDsfjnglbEPGiVTkv41CLSivBaK_1sj81hYCRJ9Vz13Yqm1MIdb4WHh35-RNd9VkK4gwK3V8fDDZLgLBNsw1WUuPNF1Ybt2w_GI6X94Mp3AFVMn7-cHjLHzbPpwlfuHF9ON1ST2wXy3aBudM536OqJAB27-HpHlQNa6qBnwB7yZLPx9SfI73fH8QXMlmYH1bNvW3Mkq_brvjJo8zxZ6ZK1kJmVaw855weNYIDaG-n9IEVNN9mXlSvRxWKCq5h-rWRfbpWxPJKWRSmu6cyXDRO0yEYmPNX4MK0Nh6JKn53QOvz4UurtAqoO4IYbFtTcl_1s9yvNBdmJdn6OebUiyGQfGcKY2vj6s5R820TOQ2HuaEGAuyLQMgKOg8MpG84eBvGlOknNGw6HFv6UF4dzlxVnpMvn6pPb0XW8hdYtlh8JHb4QTiDEeKTBsi-B6106lAbQ8k3tksAaxFTjBn_1eDKuuimFrs0nuwGjEEe8s_VMSrLTaAdfdI3R5Hb9b7VFDwy13WGn7vuUcUYToysX_xHuQrOfmGbgDT1X798oga-qG5RDbqvxCXBE1jyz8yutGQY-mZU01ThRdNdm54LEP57x24XEDOK815LEGNjIhb4b5-KbdzZ99XqNfWzpr0E3BSyCtyvoJNSVEyWvVYUnKHJ6gIgJlaVUPqQmHl-8IIApNt-UsTKNCLKTwKy9P2m9c5yABiMq7vfjxfynL0awimWi2rfZHrQ5ZpMzqC82bYXQM80bM0NDq0nqFGpf8uIBPnKddfqahLNrB9BFtBzaCVhJN4Tfi-fJDm3ba-9i1HSKR_qOh--cuCjyaKRZzCHTa12cMqkJSi2lZGOBVSVIA_qcWNwpidi3Im7wue0YFFAlngLysk2Lb1auTki_jgFQ7vxEjaIbMugcbQuUWrGZAnqCqv1mL8dM6FyHtKGKiKILOADjGmBhUJoSfsJuR9WnUxMEjxxfnCvmJZsPtke9kaJmaqErI7GtO7CB5t7siftrAIq1-_r9C1H6pizvJuifbl1I0NfleHdDX5nGjH2rjKspoPnbqwmEXl2wZfrtCTYJUiX1nadJWkuQzVmzi6w1wzZzjj72w&cid=CAQSPABpAlJWHrKgdaBj4V8o9LWK73duH3f9V_ogULWFbkat3DoOEwoSqSXDuC2wk2BDi5muYsm7xiTVPneJUhgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fintercelestial.com%2F&ds=l&xdt=1&iif=1&cor=16408240602340313000&adk=2265872549&idt=60&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d31230cd19efbb6bdb8084d8c645721f9e605e49254e0733cdc1bf039fbb3c12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40343
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame B568 34 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/Configurable_01_122.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 19:42:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57192
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 05 Aug 2023 19:42:25 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 691F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

28ms
26ms

Document
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:37 GMT
expires: Sat, 05 Aug 2023 11:35:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:37 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 l
www.google.com/ads/measurement/ Frame 335E 0
0 18ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTf6BPBJ_o5S5O2FViP-5yFUJ1z9usUAZj-W1tiezZ7SEVz5_jPBHZw9WSJjgUHK_0aivlr5w9rwiW7ZxT0RQwNbj1cwg
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 335E 179 KB
56 KB 49ms
47ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45b4eee66ac74743c86ea5a55ea614ddb12bc1407e4bfca8ff92c308c82795e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57430
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690976231057960"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
DATA 200
OK truncated
/ Frame 335E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b60d81c93737dcff0931609d11811e5792607b28520ec4db361f19d36487ed2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 9201 172 KB
60 KB 35ms
19ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Origin: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 05:22:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22393
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 06 Aug 2023 05:22:24 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/elements/html/ Frame 9201 11 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DoS7q9YYjhTuLjmvLWgHkewRDSJNbKfVQ2xlGuA2Cs7xaD8ZV7jCTggE3gkuCsXorax43RptByI5r9ZOtf0R1PB5yMdzFtBg09ElatdPV0ID1k8Rg&cry=1&dbm_d=AKAmf-DGjZS-1XRixL_j73-ENTMZrC4lreoMx4jhxliPmjK0Bc0FplxKiiYL1WiK8GstknO_HdkrXGHIwFOZXxv0jYQxEMlbRYMwfco5yosIxHRwhfqsBkb0NRgOgd24EzF8LvenFpLTaHnGxi6nSxHzyItiwPLGKcJ5nQMk9iz2zPsJTJCWJIwTYRTLWKImN6o5IxR3hgzDjAVOzDv1Uj4aMzVAOuErwuU-vF7g8xlp6RaXJI1uE966O2FPw2Bx2RlLyR4XKBGIHWfBBXVosdcvqoun_k88ofu7EMsGQ4O4RVmm08Yg2Xh9L5PrzaSdOJKMPm0aRQgBQ-CAgFxo_ji1sUXEMYc1XpZRoTQ4MxFNZpdZYQp7fe9Lkc1Mb1sRYvEiOqZ8DjoLNs0TubBZ9-XLad_BxjJQyXDCz603o5PQR98fTEu0Sf9Er-CJp5v6WDTQlz9hJBipsWa83tZvxG8cwZY3Sb_L76laWJ9KKi_C5uvxxsnprpsAHuqwObJr69WtT7Cayr0KUUAje7tTYtbh_7O5ObCk59jlTKNo7bFqAQ3VJKhSPbUz4rLkvBR-d-P40X9DiQ_62ZgVL2ddOGLD-LCVw-7XvkdzswXLt2bVXct5Oeg6W2vJ3iqw_PR_Hdzm1pFjijGyeFhTbypybFT6z7SMm07mX5yy8GaI2-eILncYckswBBqQIispl1TKqMaZc0Fzz55qU8At4S2JvoWxdoDVqjW_fXfNBlOZqyU-wchSB5FlD0joJ1QmVqPQwdGFiQ8cDTFV5YLnZ07VYMBANloj__vI6SnzJc4WybgxUJcmmJRELcovKe-fwj30M9n4-V8DMCtG8n5Cg0Gy06LZfPiETkd3epVpmnQdnFlykTnkpOHVMUKeqjsqkRlhfup0A52uYQRzU8dOejUeOQbZmY52gXRiCy6WFI0daXQ8I6uKk2U3lNeannnOf5X2rV4-Oy4v2jT89gOiDdu9cHDSMx_2VmONLPHG6NYYsvKkkY4vff7cg4-lVRw9k-3k9f-raZractpAeFGNzFJX-5hjV3udkZrq0v40wjxZbBcmtcN2IIJNEzvbX18dn35zAvCWYbZRYF4CbtYUO9dM_KIc8LnR23L3GGraSiwYNRzP3gJSEij3QhzewsSUVD1rSXINi14gALfFa1XroMNIzfANVJUgGrzRPeRoeANBEQ1KC2sYZ66rEumpLTLCqv_v8Xl0G9lwbJ0fmJptogWJXJZBqhDfgsVkxdu9vi0ujQHS3B8mHAZEHE0jvu0xF_ia9pT3n_YpuPbxEHQbPa3DgyiPHDDjIshZXwHlBMbSmOUlnpZUIg0BF0gjOi4qcSG2HrGHWH3haimr-Jss3fBHOVAVVeludeR1P7SxCVPhRFAs2x1q4qWKTYsjLiIFLFL6tSebn133XQ6-tGrjfw6g-DrQ9Qd1-Uofvqa9_3hF2ZpZyTB3YCTf6aKa9Tj_r9CMqmZ38a2E50Yd1q4jNldBWqWWMYEcuvZz7rwVVibENoZKfexu4tOD-rGdcQfGy-qkUlpReowraYtqYeqrlHzBaiyGHxW8SpwqS6QxA4GkkT6Qv1Cwj5aOM-2WB4c9dJ9--5DeIldg_Y2Xatnd9bRmtaxkQF9NksDb56Ysh0YMK4pHD8V0V1yQUB1jFwSl7b5ulGj7ic7X3qmaJaJZ8apPcOKv7DdNEJ-pUkm-CeTFUDqR1eoicU080GxCXlJW9d2BDSGGU6cKD1gSbwhHlOEWb0h6nnMB64entyAD888hpPKhgp1M_YG1IJ6_N_-9V01h9EHy5E12QhEIGh1i7fJzLGRGJgOpdbElEeIWZ6R2-CM1YSgYBdTaH9wjH5bSYBsC33ULjMONye3dc63OIgZnKZJG7_5HDWdqJtvN5JV8ZS9-xTM3dMDBpUU__rw4SKzGNZWT6jwelp7u6KQM051ZCzeqJgaG_9UyKQHNCMk61YnjNVI3j4MWe_uLbc2K5pey5I0kCAmBWkeCg35rdpkMGkKuU96r_hKNLDOMojmWmFj8RDgsPV2VoVJEVMB99HigFaN5zk85bVJ9-mPBA4OnMLSD7mzy387yAobIvkViUHYxH-uftcNXbcXXuWkCFbkbwUex5P6AEw5yYizg7xW0Ya3qe6fxL_VshHlGRfNMyPDTYgoO5_jlej8BLh6UhLvpTuIEvFUB-taV5_Is_v4npc3R3dqvrtvEj6ll2FA1IkFIacbq0XkI_IZXvtYQbDaAo_O8DqFdavkBkqVVHYlNyGCLKkIKQV30HmYEUfecrpg5KKSbYMCiKyMXMhtNfoQ2BiFVahVsU55AZR1RTChRW-KuvA80YWCOIP6cLE3x-gb8tQ2-xI-RODx_vksJd2IJe7LYEKcgjkbsZi72jD528yy6VDfVFqO5v0MWx1PLtwViOvjG6cEfZ4-Eqi-cft6sJXLQpDcGR4GfmkJJxqvTvZNuawMPjFYduAPfUqoweADysbyRMthPbDs48DmPjRd9eA5R2JzIdq_n4hg-XTslVaQi4N7zap6oIq7YiJdqXMen4TFppqy4OFIHvKxfhPDvX9rUYoWMwjInJyR0pynciP394kiFSZF8QeFrvltcX9Gipk1TGxvjJrEh4VKAxiAulOoCPDZ7TrEfQq1YrGExrhxm51wQgIsiZZ1792zJOrGPZ8WPikCa_Z4O699FL9Z4c4QTv6XgO4OBkPNvBm5aSVLV48TWuC6TUoOjBtVlHgDBwf3rbe9LoyXS0Vv0IhrgBf3XnP_F91xHyeeOA6TZUx3UzfPLh-N2qG1eLcWTWoCZQQiS8G_wk4yUkQXWfXsBJxMoQ6If2upO2pNOE7R3jrGCvnYMRI1q5iN6ZWJREA-Ew4xfSiV2jDlkiH9ll3JsamnCgw1zBX0NXtB0LVqHu_-xGR2qBnzJQegHu4KBjcbWyJjL6FWJZSKnn9OYWX1yrlfTWuGwaeoTd_Sx1VNuFaTLJXpUSukOXOTu-tE5O7Xerf_FrO8_YrqfdpRORUMQsuxcMGcCtlz4z-8AOUaWPydLcSoy7hyrP29QwQumCmTlqQKhy81redlgMB_031QynDquwMLNs6tBvnpgLsweIUUswoj72g5Mi8fwdzNV-Z6PDQyFtL5Jq4GgwTmtgSOSYrcitZSBxeCD5P0T4nfGrMXXxRDxSSJIKcI44VekHflO4d2amM58lKFuu4lzkwZrmeMfvcXNTLqKgCFkIDV8iXvae4UelsLu_ogeS-4VMmxpadS9pkZ-eYulk3MF_rAnSQX3R-dsQsV-0l7T1A2qJvnWgwvW_NNBfLKFmkEf6SScqjWOw1rqv7rtDgpUYGFROfkGAw8RPkIt7YiKAx0OoVogaH1O0flSErQs5MhSRz4lD_efD0TAHyq-bNCb63CVg4TsLs5Sqju40HMmCbPc7nszwQPWR9HiUvkX-zUQ7dD6oMsqocJvFXzrz5BhlWXiQkKAnLYzjCeFSzycNFR5NG9xG-LMiNRDqiWHQCKNjgSXlVrbi5KFbX5yLYZBvyAv_5bc4mTUqlvl&cid=CAQSPABpAlJWkRP8beGh5FN8jZL5K3ine2GpC1Je957OQBBG81BWJEaCG0KFrISoCCDm8FAKaivu6_QSp0ozZBgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fintercelestial.com%2F&ds=l&xdt=1&iif=1&cor=11801475402298968000&adk=2004672170&idt=140&cac=0&dtd=44

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:45:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78590
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:45:47 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/ Frame 9201 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2166f0d302a1be49c618dbd4a9a7cfa47b7967f4bf9c4947d88419b89c98314d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:46:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78572
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11541
x-xss-protection: 0
server: cafe
etag: 12315695366903653922
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:46:05 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9201 41 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 10:37:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3512
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 10:37:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 07E7 1 KB
643 B 14ms
13ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 29427
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 03:25:10 GMT
etag: 48472445140208031
expires: Sun, 06 Aug 2023 03:25:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9201 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8488f71f15769bdf10c99dfa4fc94bacab3198f6a6d18a739001cad6c174c332

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 1C2A 0
0 54ms
54ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CYgkXCDTOZJCXJNDRgAeogLTgB8Ck-Yly4amF6bERtszmrYkCEAEgkeLkH2CVko2CmAegAeqv6JgDyAEJqQI1PdpABHeyPuACAKgDAcgDywSqBOsBT9Cu9_cRdqAuU-PQO-lYpfXNtHlNAKhQjy2EkGM4_zeB3FLppdj8yxpNyQDqFc6NsRczgJ-beMOtIAj4eFx3Fba6IEOKPIJJv_RsUplXU1Mtq_lnxHMkS17dK8LmXGFg9bsDk9f7toTqo4ijcdD1PMBoW8cgKdeio_SK98Tm1APDYSmTGtAIVTdBSA0lg1qw1TohXl396Got1Vuj4Nz3Vbc3YXsCyP3bMlDA2uG5_EKdKGYAfxaXIIvasskWOjH04lmyv8M4dV6lqkihe3-o-wddnF_mv4nJ3f2Omt1wr9Yc9s5SDR8uXBVcc8AE4ICyybsE4AQBkgUECAQYAZIFBAgFGASgBi6AB_7Pl2eoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAemvhvYBwDyBwQQhLAD0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tODI1ODMwNzExMDYwMDA5M4AKA8gLAaIMCCoGCgTDsLEC2BMC0BUBgBcBshceChwIABIUcHViLTE1NzA2NjE5NjI4NjY5ODEYkP0S&sigh=fHt90JmTzZY&uach_m=[UACH]&cid=CAQSPABpAlJWdS2OPolDEK4yszA1zb_jruBk2PXXTn-h740Mx6Dag0Ww454BgsYlUN6jJS_ArjYCHL2zVdXj-RgB&template_id=494&cbvp=2&vis=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame B363 5 KB
3 KB 38ms
38ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=175059&b=QMGH4fjfP2BJaxH5HYtGtbMzjF6S4TG6dTRB7b&f=24zt6fqfj2RWSVHWHktwC2JgGHxS7TgQXaEK68&c=320&d=50&e=&g=55be73c13a490642710a3cf910d674b6%2F15996707371263482972&i=65915&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1691235337316&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1hq50net5bnpg3fx59qnjw7dk58e9max2gzpf3775tdawgh78at58st0atmgsmm2zqjh8g7a20smjd58h5z7px000swv12ye362h1ebwavt2byf71wxbzfqv6sjsxt5w33w9fpb1eg7tmpjrhhq9akem5knk6s57wgbqtqg57pagsymh1fmmtbz0nmp6ccjnejvvjvkxy7nf94fr4gd782s9yk2epk3kysfz541g7qhmsj108r0rsaccfc87cbpmsys4xww0q33ea62cmf77ha8c08%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%2526client%253Dca-pub-3282547114800347%2526adurl%253D&y=1&s=&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c2278c8c3c6b9ccc5fc5f2bca84bf2f1687bb5d63f17d0ac7f21b4057d3cd39

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://as.ad4m.at/ad/dr?ed=1g6r27q48pg7jqeje7r4vhyv72t83kgmqx2cckezt4arnx807aanb4dq1151g60aqw8aw43tejkmb9b8h588es6s8kb2ykg9mmtmsyg6rdd383gf2fz7ed9g7d1vkc0f8rre6yczb56fx67jzpyat2yxz54p7y04ncr840etqasyw0mnpqf6t7mp310fh8h6qn3ja4z12xm0wydb6nceefspnhw32ay2502kx62m49rtwd3a67bng4hrg5g0dc5w63wvt72ewg1ndkaahz5tvbwyma5bbmnay0mqhfjf2satev1bkmcy77gvv1rby1mg6p827pysa3qf4cfkxnxc1xyj0rdxxmztmqsj1dxh0edz1k56n7ynchd0z535zy723pcaa7e9vax2604mw17qx1r23gftj7sehj12s6y273acm106w4qkpv6n7z9qgjvathseyxex0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%26client%3Dca-pub-3282547114800347%26adurl%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7f1ebcda9fe89b39-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:37 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 css
fonts.googleapis.com/ Frame 97A2 6 KB
706 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 05 Aug 2023 11:29:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/987057/61527017/ Frame FD0B 250 KB
75 KB 129ms
32ms Script
application/javascript 54.72.35.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/987057/61527017/skeleton.js?ias_dspID=3&ias_campId=1013380671&ias_pubId=pub-3282547114800347&ias_chanId=1&ias_placementId=20343401207&bidurl=https://intercelestial.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gyWChlg2vaD0PFdK-xMQWc
Requested by: Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.35.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-35-18.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a7ad3095209f93739bf65618ef87a5494a870b3e4d6354d64c66f6e02508dd88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame FD0B 111 KB
39 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Origin: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24245
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 06 Aug 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/elements/html/ Frame FD0B 11 KB
4 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aae_KY9cUfih77T3_681Y4F1UvcVPiFlH15tF4ZDUlbJdCm304uypSDTN0oRgz0ZNYXX7vAzSdnNEWWMFWjACDwwzWKgG9_gHMtkBQI_-WPDlo5_FWbzWNAM-IE51abuCfxg5hopW_aEJ1uajKMUn069smf0Bb3veJ4sY6orQ1D2hjcgE&dbm_d=AKAmf-BClFLTK4P7jZFdh1Lb34ujgB-IPIf7iXQqRe-zxJgKN8HLtqwPc4D4b7yZA8CzxBd_uyjwRWp855fihDHeoNu21vCxv6ZClIexlfbwpdpj9cwob7_Vh2TPBVzGrDG_v5c-lufz-rM443C1LUh0IjhJ8a8-gw2uof3OCYkNA29vuo7f2-k8kGG1jGIckF6tC5uAjUStQiagcmHERvpp72BZykXW_q2QHMXwPr6YnUKzWknRA0tljynYuy_pDfBfojoH6eHk59Qp692_QNHVi7amjbwaCEv-4BuiAhqmPk1l00vR0TQRzbFm-1oVH-baxIg0rCB2eeSxLWY6q3nd_Q0Xp-rF7UHR6udX5JoTTALRemX5w0Gz4f6w4wFKK7PfRM1vYfrqmFBQINgo4bOQiiy4aHa2UjsvtNw4SwUtte1MZfT6JcNkKb7xL8bxpSukrMC36202yI_hgGDgjIic7sYfgFICmKjGBi9HzSIemmIZ9pzwTsOaKWNP1kfpiE2ujKhNzkbMlOQmoTV23pNgGIf3Ewj-IZ_Z2SwGraiGLEDbVDB16rLnfxxDryN6H0a3Cgjp25AdkCT-7x4kyP_pwqqFCZ8SyBDUKKyLekgCkpy1vxg07YwMrrE-v9tepDyiOqDPtnqi9R52rM7vrjLpXnNOkmI8HikjKg1FWkIXbKrCMzbyPQwnpW6pQoiw_0uRHs67R3i-r6BECvFOiyW_YoiZ_w7OFtermZRw5cAkfOyOh9XjGD7rb950ZMc2reCHe9OBmRgSxWnY9lyKmMh_iiCVJnBXIsqkTXtBTk6kY4oiGBc_Wg8RGg-ZK4UbV8WTZt0ohrg93Pp2IB-QUFjJZkT7iuh7MPzviFPWEXzvbA6pvnVEHZ3wIp-uqvO9-oFXearzQILX6E_VuTqFSZc-Y0ExBiM9CwbBDICgbvShwnN9ljiXuAFwoDwe8F-ZXicS-hg-bJsryFkwdh1YE2Ltihg8RuV4ULks6G50aNCN8LlqIzGj5Y049C6nx6SL2jWvXQxxpo3SSyXBsFaTY96HIHuZIiKT5GVBcbyHDqwnBkw4NlKYTyK7cR_pxJaxua_nNfgVjnDVp6pZeHpG0iZZPQyh-F_cKjDsElmXsDn9qnj5mNwJ1kKCbnZJ98M7msM8o4qa0jCV0hPMRzrnIFyWwUt_DG9B7hF09zVdAsMtKE2yctAad0YXc-kibzh2FaRctO1EO2d8inD3sRpSZKKsi-ca1XOcAeulk2BzaYJsnZuVk_ZFGvU5bkltOHW6HlCWG0bjXr30wanyo3jl5h5buI3PO5gsx1HT1XP7XMvdH900qPIrWDaqA9ThCfPRpYc2pFIef2VscWnWuif4OuYkbBKeXHLWNv59K6EW7D9Hnrl0ukdG5MNa-pKUMNT2vv8VBOK85Vh89vlwafODDKK3-nGS9_PSITGQTVP9VcjyfbnH5WLGDOY5slL1HoiWLto-b0iW-3ViZeLzhxb6D0DEGRmTjHLaWVQTyP-YlOUVxSNdEd2cdsvUEY3XTEQnMHsPM3ry8oz6nmmN7WOIUb7Bb1JqfmnCNC7CX6CtD_-lBxA1sCN4Mclg3lMOHtp2709eQgKD_67vBZayIfyAwREYOn2jx_MqgIZPhS3gyXidsV55Ab015XWvjep9op1quk83MKCVxT4e6irS6TaoDB-utP9oMVoIIJfdkeVtX2YSR8Z1mgDRFcQtbNFvmQlimJTk0BhRccwGG_6NTrra0SgFHABhJw6sxbHQczzT7hrG6HUBng1J69PXAn2wrtYKgwHtsfjV2URb4UXFj4QN8PDhBoOSe-UlQSpECV5X47iiigfHUNVmFxcCA6pfLRdgEziWgxIbBVGCfXVUk7WO3Yf94EOESErPa25lkjs4RNhCTVX8fNQJXxhJWVB65fRmaVsYy_Q14hNYkhQirUCpYFealJ9Ntns7yiVbY4ip0JSp93lVnWzedJ32YxSZS_vH0ORc3Nynd81eYN6FgIC6fcjm9Fu2oY3vHpEK2Z4ZE4hH1lHCn6-zopDFBQnrHWcPNfN1NRH2T4ksYRLW7jgIaSMXhXCCtxQGYyoCk5e-qdkBSj6SnTbdNgKP0bu50DI4F90NaHC6wTGBrdWDxZYoKvK7Dam-W9sn95timjnUZoC_kKF-xIBBZxSAHuGgUWtUzOIO-f2C7zaOtKLyo5sIzZnzdejOsqbO1mCk_j-9N2ckdS_s5_CYoM0nFX-QAkEuRY0f1RTeE3SoPgleonVS8NIVBEtwDvz9HtvXGdmXlEBOammEjXHc5PSifnIo0fQHicbJKnLVJuvVX-gQqJxQNK5pRs1bNeyFk_E75Ad_kR5ddrAL-PjINztPBVLK0eVzSCsSCX5PwqJWeKiauSbRJOhuyKehjzrxNb4t5KQeyBp42BDZR9A3MnPcN-cGYb816zfIOTzD-JwanDpYeg4QF85BHSDzCAT2TkoGdlY6luceZGAIZSOi-NZN8aTj9XuRP_aIIEpPKK6YgJlK6zYWpd8V7fr-BVQD5kSXAt_fHCMTAtjL7SDOJmmsVHZeE2pNIiL7G3cG2URGeIgW2ZovcofPesJxDsfjnglbEPGiVTkv41CLSivBaK_1sj81hYCRJ9Vz13Yqm1MIdb4WHh35-RNd9VkK4gwK3V8fDDZLgLBNsw1WUuPNF1Ybt2w_GI6X94Mp3AFVMn7-cHjLHzbPpwlfuHF9ON1ST2wXy3aBudM536OqJAB27-HpHlQNa6qBnwB7yZLPx9SfI73fH8QXMlmYH1bNvW3Mkq_brvjJo8zxZ6ZK1kJmVaw855weNYIDaG-n9IEVNN9mXlSvRxWKCq5h-rWRfbpWxPJKWRSmu6cyXDRO0yEYmPNX4MK0Nh6JKn53QOvz4UurtAqoO4IYbFtTcl_1s9yvNBdmJdn6OebUiyGQfGcKY2vj6s5R820TOQ2HuaEGAuyLQMgKOg8MpG84eBvGlOknNGw6HFv6UF4dzlxVnpMvn6pPb0XW8hdYtlh8JHb4QTiDEeKTBsi-B6106lAbQ8k3tksAaxFTjBn_1eDKuuimFrs0nuwGjEEe8s_VMSrLTaAdfdI3R5Hb9b7VFDwy13WGn7vuUcUYToysX_xHuQrOfmGbgDT1X798oga-qG5RDbqvxCXBE1jyz8yutGQY-mZU01ThRdNdm54LEP57x24XEDOK815LEGNjIhb4b5-KbdzZ99XqNfWzpr0E3BSyCtyvoJNSVEyWvVYUnKHJ6gIgJlaVUPqQmHl-8IIApNt-UsTKNCLKTwKy9P2m9c5yABiMq7vfjxfynL0awimWi2rfZHrQ5ZpMzqC82bYXQM80bM0NDq0nqFGpf8uIBPnKddfqahLNrB9BFtBzaCVhJN4Tfi-fJDm3ba-9i1HSKR_qOh--cuCjyaKRZzCHTa12cMqkJSi2lZGOBVSVIA_qcWNwpidi3Im7wue0YFFAlngLysk2Lb1auTki_jgFQ7vxEjaIbMugcbQuUWrGZAnqCqv1mL8dM6FyHtKGKiKILOADjGmBhUJoSfsJuR9WnUxMEjxxfnCvmJZsPtke9kaJmaqErI7GtO7CB5t7siftrAIq1-_r9C1H6pizvJuifbl1I0NfleHdDX5nGjH2rjKspoPnbqwmEXl2wZfrtCTYJUiX1nadJWkuQzVmzi6w1wzZzjj72w&cid=CAQSPABpAlJWHrKgdaBj4V8o9LWK73duH3f9V_ogULWFbkat3DoOEwoSqSXDuC2wk2BDi5muYsm7xiTVPneJUhgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fintercelestial.com%2F&ds=l&xdt=1&iif=1&cor=16408240602340313000&adk=2265872549&idt=60&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:45:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78590
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:45:47 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/ Frame FD0B 30 KB
11 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230802/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2166f0d302a1be49c618dbd4a9a7cfa47b7967f4bf9c4947d88419b89c98314d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 13:46:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78572
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11541
x-xss-protection: 0
server: cafe
etag: 12315695366903653922
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 18 Aug 2023 13:46:05 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FD0B 41 KB
13 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 10:37:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3512
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 10:37:05 GMT

GET
H3 200 12869506505489293016
tpc.googlesyndication.com/simgad/ Frame 97A2 6 KB
6 KB 9ms
9ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12869506505489293016

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3ec7e69d3bc5ba15110618a2e45362c0126f0e05e46b0fe6e906c0e7db443c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 20:26:51 GMT
x-content-type-options: nosniff
age: 486526
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5982
x-xss-protection: 0
last-modified: Thu, 23 Dec 2021 14:43:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 29 Jul 2024 20:26:51 GMT

GET
H3 200 YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 97A2 37 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

616caa77f3b26bf752bc7e76e496c90f09e972978a16e9fd7111d8f23009f504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:27:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 488
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 04 Aug 2024 11:27:29 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.48/one-ad/ Frame B363 114 KB
14 KB 24ms
23ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.48/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=175059&b=QMGH4fjfP2BJaxH5HYtGtbMzjF6S4TG6dTRB7b&f=24zt6fqfj2RWSVHWHktwC2JgGHxS7TgQXaEK68&c=320&d=50&e=&g=55be73c13a490642710a3cf910d674b6%2F15996707371263482972&i=65915&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1691235337316&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1hq50net5bnpg3fx59qnjw7dk58e9max2gzpf3775tdawgh78at58st0atmgsmm2zqjh8g7a20smjd58h5z7px000swv12ye362h1ebwavt2byf71wxbzfqv6sjsxt5w33w9fpb1eg7tmpjrhhq9akem5knk6s57wgbqtqg57pagsymh1fmmtbz0nmp6ccjnejvvjvkxy7nf94fr4gd782s9yk2epk3kysfz541g7qhmsj108r0rsaccfc87cbpmsys4xww0q33ea62cmf77ha8c08%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%2526client%253Dca-pub-3282547114800347%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 032aee61923ef53fb2b9efbb5d55f771f780e9c2fce9c076638b809a9607eee3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=175059&b=QMGH4fjfP2BJaxH5HYtGtbMzjF6S4TG6dTRB7b&f=24zt6fqfj2RWSVHWHktwC2JgGHxS7TgQXaEK68&c=320&d=50&e=&g=55be73c13a490642710a3cf910d674b6%2F15996707371263482972&i=65915&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1691235337316&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1hq50net5bnpg3fx59qnjw7dk58e9max2gzpf3775tdawgh78at58st0atmgsmm2zqjh8g7a20smjd58h5z7px000swv12ye362h1ebwavt2byf71wxbzfqv6sjsxt5w33w9fpb1eg7tmpjrhhq9akem5knk6s57wgbqtqg57pagsymh1fmmtbz0nmp6ccjnejvvjvkxy7nf94fr4gd782s9yk2epk3kysfz541g7qhmsj108r0rsaccfc87cbpmsys4xww0q33ea62cmf77ha8c08%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%2526client%253Dca-pub-3282547114800347%2526adurl%253D&y=1&s=&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1687950287
age: 865349
cf-polished: origSize=117335
x-guploader-uploadid: ADPycdu7Pb84Y6vCPqpUShyJrQGb98f4yuF1LiyC2B7DeEN9kG_1SbpI2iXm6tsp7d5fI22nNzf0l66mXGhEIUVspATbXw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 28 Jun 2023 11:05:15 GMT
server: cloudflare
etag: W/"5d49535c2a84a9762127b3d9e77d7e02"
vary: Accept-Encoding
x-goog-generation: 1687950315098833
content-type: text/css
x-goog-hash: crc32c=aWAnwg==, md5=XUlTXCqEqXYhJ7PZ531+Ag==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F%2BaGdAkymS9Wxz5jJ%2B6SsDNRyPvz%2BkPqaZHZre7Je4XGTy74Lvbqvo1qY0ACWVtRWFaNpTAXqjEDno492HYdQvmtuAb1EI8WqIZUDICTZ4LbNv5JcXMC%2BIbK6qfBhPdedvVy2D8BZ0s%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 117335
cf-ray: 7f1ebcdb28859b39-FRA
expires: Sat, 05 Aug 2023 12:35:37 GMT

GET
H2 200 807FC0314300FD3D7EA2A3865EB887A86EFDAC77BDFCACB7C49E7904A10BC6EE8F804F370DD32A67945E13F906FCB6989AB80F264BEC5568EF9AABD964B68990
assets.ad4m.at/logo/ Frame B363 6 KB
6 KB 36ms
20ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/807FC0314300FD3D7EA2A3865EB887A86EFDAC77BDFCACB7C49E7904A10BC6EE8F804F370DD32A67945E13F906FCB6989AB80F264BEC5568EF9AABD964B68990
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=175059&b=QMGH4fjfP2BJaxH5HYtGtbMzjF6S4TG6dTRB7b&f=24zt6fqfj2RWSVHWHktwC2JgGHxS7TgQXaEK68&c=320&d=50&e=&g=55be73c13a490642710a3cf910d674b6%2F15996707371263482972&i=65915&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1691235337316&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1hq50net5bnpg3fx59qnjw7dk58e9max2gzpf3775tdawgh78at58st0atmgsmm2zqjh8g7a20smjd58h5z7px000swv12ye362h1ebwavt2byf71wxbzfqv6sjsxt5w33w9fpb1eg7tmpjrhhq9akem5knk6s57wgbqtqg57pagsymh1fmmtbz0nmp6ccjnejvvjvkxy7nf94fr4gd782s9yk2epk3kysfz541g7qhmsj108r0rsaccfc87cbpmsys4xww0q33ea62cmf77ha8c08%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%2526client%253Dca-pub-3282547114800347%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8aedce5ce280bf3c1e99fa9b36cb226e62cd39cf77c1f0c5660a6cab7bdece3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2468930
cf-polished: origFmt=png, origSize=11357
alt-svc: h3=":443"; ma=86400
content-length: 5848
cf-bgj: imgq:85,h2pri
last-modified: Fri, 09 Jun 2023 08:41:46 GMT
server: cloudflare
etag: "ccfbd2e3feb27487a1f6d1f6b03866aa"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DvQ29iVTy0DsRuHHxO86PQ57bdqz8ccZ2zWNmpq7Dlq%2Bj5TTxg7oihAUtEUhazCvcR%2FXc%2F7ibx3ASeWzK9B3dqwKGdqYipKgKYdgjkwj%2BgCQg1M9ojHl52NGzT25jv26T7BOfgeR%2BvaFgpy3"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7f1ebcdb389a9016-FRA
expires: Sun, 06 Aug 2023 11:35:37 GMT

GET
H3 200 2D65771C4E99642761C25D51AEBBCFD65B43B5413EF19697CC1FB2CD4144CA8006EDEBD7BBE3473EC0E77D5B95CFC345D27520E24E58F21FCA62F0BF53BC962B
assets.ad4m.at/ Frame B363 183 KB
184 KB 17ms
16ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/2D65771C4E99642761C25D51AEBBCFD65B43B5413EF19697CC1FB2CD4144CA8006EDEBD7BBE3473EC0E77D5B95CFC345D27520E24E58F21FCA62F0BF53BC962B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=175059&b=QMGH4fjfP2BJaxH5HYtGtbMzjF6S4TG6dTRB7b&f=24zt6fqfj2RWSVHWHktwC2JgGHxS7TgQXaEK68&c=320&d=50&e=&g=55be73c13a490642710a3cf910d674b6%2F15996707371263482972&i=65915&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1691235337316&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1hq50net5bnpg3fx59qnjw7dk58e9max2gzpf3775tdawgh78at58st0atmgsmm2zqjh8g7a20smjd58h5z7px000swv12ye362h1ebwavt2byf71wxbzfqv6sjsxt5w33w9fpb1eg7tmpjrhhq9akem5knk6s57wgbqtqg57pagsymh1fmmtbz0nmp6ccjnejvvjvkxy7nf94fr4gd782s9yk2epk3kysfz541g7qhmsj108r0rsaccfc87cbpmsys4xww0q33ea62cmf77ha8c08%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%2526client%253Dca-pub-3282547114800347%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64f88a75df6eeef2e778f967a36f861c2005c64fb8b567a17a8f98878e351255

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 754269
cf-polished: origFmt=png, origSize=289744
alt-svc: h3=":443"; ma=86400
content-length: 187558
cf-bgj: imgq:85,h2pri
last-modified: Fri, 23 Jun 2023 11:11:49 GMT
server: cloudflare
etag: "17decb4f4cab809ec8159433a7f13627"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d7%2BTAwbBYKMjvQ4ux3L%2Br4eTZ7Udj8AEcIr2q4OjVPG1LDs%2FCmZw4F8UNyY6wJ5ks7AhogO4v7ae3RiurZ1RUY0BMlb7KfE5dPomAhWIChfADhDCbCH4ilnA3dc%2FQTXLlbGINUMSchDsX7%2BT"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7f1ebcdb78fc9b39-FRA
expires: Sun, 06 Aug 2023 11:35:37 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 15B0 1 KB
643 B 7ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 29427
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 03:25:10 GMT
etag: 48472445140208031
expires: Sun, 06 Aug 2023 03:25:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame FD0B 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf74936b48521c7537daa347f37db0796d1354120a09f93617359c87734cf5cb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 97A2 15 KB
15 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 17:49:54 GMT
x-content-type-options: nosniff
age: 63943
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Aug 2024 17:49:54 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15415463092317913147/ Frame 7C0C 1 KB
767 B 17ms
16ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=HOKcj4laZW&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51c012cf2461bf8b29f345373366183c7fd121579b6178e942be0b61d8c7da14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 739
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 11:35:37 GMT
expires: Sun, 04 Aug 2024 11:35:37 GMT
last-modified: Thu, 27 Apr 2023 13:50:29 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9201 0
0 101ms
63ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXRgDvkpMV1hyL8sLDLo1MYH9KMq7uGh2kMjC--D-scfJgMBo-PmuoNaRTLydX6himalgadrDkaNMhtU6QN2I9p99Kafv_gnSn_9JfqCeDB8TnlUwtVdw3DjOuSrFc6gc2dtK2NC8VtiqXQCV6IakR310bSs-ZhcyAScpAIAAykDpZKnv0s8Dt2XEAiaR2jZmda-cr7wBc-u-EyY1Z0xym3AaCfuULjl2f4dKQo8vE9j8m35s1usUVeOf7B2nZ7fqYck-t3Kdex344RPVzAqfjOi_afRoA025b0YlP2kFH6iyxh5p5DTzVQkUCnkLFIULkf3JWrKkBj6NY3B7vFNI6v-91huWyMtXiYKSKcytkRn7YmIwGdtxGBB-v5ShwiONBj21eECv2wPJvORITqktmjo2o0vW3XC63t3UoVmhl5pKIxeF3idgI6hf_McmV4imN6F5iCIFGmkjxT4I6qDZRKM8DCUS8v01XR16r5tJcgiNp40948Hf1u1EZGCRy4JTPKC2ZOb3CcdTIaiPgm1D8IaSPFcir9sT6oKlHsu-gu9hlbsKDmpiisu6aZ-S4uGmU86VHrcdB-VSdNvWRLmHioJRrDCS57ag9Z0EmzQ4mVJB4FMz_pQU6dB9tDVwUBVstp0h133JC_sWFFT8j0PjF5Xzr2su2NvpMfJRKLsuBJ6PiMRhZFygWPsge0TjtpK0IDHd8u16WVKIS9i6dgT6ddAWU09oCw-MGstZJ16LSYFbofXkQiSyNVecZJPHRbcwZv89DWAD2jZCOjeqB6_Q6ERi2YZl5U_40YQZ7UNvj9T6VsNCCKxe9cWafWmB4SY6p-qoHz8V3E7q25dHyLCaVhlm9k53DqY-dnk7dRWYatVDkfdV9Urbjl_XHUzOrzIYtQB6QMhx1ezXafc3aJNE7NFsLZ1lmDWnvVbwguAF-htOWnQNAywkPAlCWVSa7m5V5LMwq3XlPYeBGeWn6Fd-hZHeP__x7c60jXH_6L4-aCO0AAA1SotCqTW3mMgGDn9DzzSHHBOJehrCu7lb3JyTONTYRklNt8Ho8W9_2fGkFyBuZqAcJ_AfP-qb2bRbCcTJDbaBxlG9yO-jifXY58v8cogl1OWzX30P738lNMTUbYXaRLQPZEewbXT6MJr1Rj2oiVNoU5EkD_OeSkokPxzc2VHRSeY2p1-4xvLTkKHyhgSUIUj5HMzsLnzkY0Cy1UYhykB8C1ymXjvsRn8_q__qZHhuUFsG_K_u3pUjv7FvPa-M9bDuQlv-rYUIiORKUCoersttCaIWERlvA1pIhtx-VLCuhSZG8j4DYVY9yYwbjlZ5DGQTX-cOzxrL49dk4dyPnc15edIZNA7H6V8qIB-zkIbuJ-zmUtgTKm_V8xs-TT2oMZ7QiRqg6nrPrmiy-isv37-K7&sai=AMfl-YQTY_Z50VmA7ihXuSQjGL4xlTFAsBsRW1CEuCw0iIK6PTjS4S73kZnoeMlMobu7eHpQz6dwHKvDLpMQmtxnffS8GqP3w_3xI9a977-uJAsZi1UgrURJpsJmHRq2Ouohu96Ok7FU1Ue--0XWUrtvQhWDOL0DUl9nx5KjQBPqBGtsOWdlXBCkoNcIHfcLW_pj_LpNIWh1bks_Q2hd_64gdp_gpdv3gpj9X5uRHZ68waLxFpqSxUNyxmxdsfTbCyqjIUD2sVM&sig=Cg0ArKJSzLZL7ZANuNeTEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=207&cbvp=1&cstd=194&cisv=r20230802.04751&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 9201 43 B
1 KB 107ms
15ms Image
image/gif 85.14.248.71
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=63&extPu=lh-mindshare&extProvApi=lh_de&extLi=26915561&extCr=180481255&extPm=361577754&gdpr_consent=&gdpr=

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Sat, 05 Aug 2023 11:35:36 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Sa, 05 Aug 2023 11:35:37 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1119
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 07E7 0
104 B 120ms
25ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEAJu6e7YK2HEUHiFvXbUZTQ&google_cver=1&google_push=AXcoOmS74A539cHYqLgibOquXrJDQGR9c5K3RBwb_olGZnsgMI9HEf0dHAje7_KEL79JATUaUNBQ9vyvCO6LeT2jJZqVKbVSwAKn
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 07E7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJOlDiaj3g-b9PEaKZe01uc&google_push=AXcoOmRFM7JhWVmxThYkqK-84hh3oerpYwo9LGaGAxZHiU9_xL6rdyj8iX...

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJOlDiaj3g-b9PEaKZe01uc&google_push=AXcoOmRFM7JhWVmxThYkqK-84hh3oerpYwo9LGaGAxZHiU9_xL6rdyj8iXhL2U1iUBlVTIsoLU990Qsc8sc4-jg8qorsWpGdKRh_

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230088-FRA
pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1691235338.565778,VS0,VE93
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJOlDiaj3g-b9PEaKZe01uc&google_push=AXcoOmRFM7JhWVmxThYkqK-84hh3oerpYwo9LGaGAxZHiU9_xL6rdyj8iXhL2U1iUBlVTIsoLU990Qsc8sc4-jg8qorsWpGdKRh_
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 07E7
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESEM6-IDvFQ-L0Ks0MCmhZqPE&google_cver=1&google_push=AXcoOmRYj7tvcUj4_600G1TVFGNGgZF9-xznlUSUNS6E_wINvyy0fmePm7G6NsWmbV1YxjyDKeKAp2N5rSHZ5Ts4Rf6JaGncvNE
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=bnpBZ0p6YThCdHlneDN6YUNqVE9aQQ%3D%3D&google_push=AXcoOmRYj7tvcUj4_600G1TVFGNGgZF9-xznlUSUNS6E_wINvyy0fmePm7G6NsWmbV1YxjyDKeKAp2N5rSHZ5...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=bnpBZ0p6YThCdHlneDN6YUNqVE9aQQ%3D%3D&google_push=AXcoOmRYj7tvcUj4_600G1TVFGNGgZF9-xznlUSUNS6E_wINvyy0fmePm7G6NsWmbV1YxjyDKeKAp2N5rSHZ5Ts4Rf6JaGncvNE

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 05 Aug 2023 11:35:38 GMT
server: nginx
accept-ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=bnpBZ0p6YThCdHlneDN6YUNqVE9aQQ%3D%3D&google_push=AXcoOmRYj7tvcUj4_600G1TVFGNGgZF9-xznlUSUNS6E_wINvyy0fmePm7G6NsWmbV1YxjyDKeKAp2N5rSHZ5Ts4Rf6JaGncvNE
content-type: text/html; charset=utf-8
cache-control: no-store
content-length: 242

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 07E7
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECsv3SLM482s0x_ZihczkTI&google_cver=1&google_push=AXcoOmSi5gtfy35w0LOLm2CuUfq26VQ0tirxX9DYKOTTITtMevqZuOQvqVgB0Fh9BCS6y0vD9WK...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtYWFVPVUUtUi1LNkFC&google_push=AXcoOmSi5gtfy35w0LOLm2CuUfq26VQ0tirxX9DYKOTTITtMevqZuOQvqVgB0Fh9BCS6y0vD9WKSvilMw74MxFeIickUIRfAAU2Z

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtYWFVPVUUtUi1LNkFC&google_push=AXcoOmSi5gtfy35w0LOLm2CuUfq26VQ0tirxX9DYKOTTITtMevqZuOQvqVgB0Fh9BCS6y0vD9WKSvilMw74MxFeIickUIRfAAU2Z

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtYWFVPVUUtUi1LNkFC&google_push=AXcoOmSi5gtfy35w0LOLm2CuUfq26VQ0tirxX9DYKOTTITtMevqZuOQvqVgB0Fh9BCS6y0vD9WKSvilMw74MxFeIickUIRfAAU2Z
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 07E7
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEB...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmSLXesmBM5wenD-B-0PMiQculVKktR4EfSKQikCU34-S1VN5Tkx6a5quqhvJflylaU63HxYSkrtnqwxtbO9QviS6qgmttZC&redir=https%3A%2F%2Fcm.g.doubl...
https://sync.targeting.unrulymedia.com/csync/RX-4765b601-5250-4f67-a8e3-d28e2706012b-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmSLXesmBM5wenD-B-0PM...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSLXesmBM5wenD-B-0PMiQculVKktR4EfSKQikCU34-S1VN5Tkx6a5quqhvJflylaU63HxYSkrtnqwxtbO9QviS6qgmttZC&google_hm=A0dltgFSUE9nqOPSjicGASs

170 B
188 B

19ms
19ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSLXesmBM5wenD-B-0PMiQculVKktR4EfSKQikCU34-S1VN5Tkx6a5quqhvJflylaU63HxYSkrtnqwxtbO9QviS6qgmttZC&google_hm=A0dltgFSUE9nqOPSjicGASs

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSLXesmBM5wenD-B-0PMiQculVKktR4EfSKQikCU34-S1VN5Tkx6a5quqhvJflylaU63HxYSkrtnqwxtbO9QviS6qgmttZC&google_hm=A0dltgFSUE9nqOPSjicGASs
date: Sat, 05 Aug 2023 11:35:37 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX4765b60152504f67a8e3d28e2706012b003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 07E7
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELe03hb45_eQHAVnfXT5uxc&google_cver=1&google_push=AXcoOmQjOAD4StH7SyjvtJjDeFKPYxoKq_fBurUG-PranUa-tLj4n1x-Fj7sKPchnXkyywaZIDOu8CakvusiVaYQLGKjL70_J5uq
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AXcoOmQjOAD4StH7SyjvtJjDeFKPYxoKq_fBurUG-PranUa-tLj4n1x-Fj7sKPchnXkyywaZIDOu8CakvusiVaYQLGKjL70_J5u...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwNzY3MjEyMjM4ODM2NDQzMTM5Mw%3D%3D&google_push=AXcoOmQjOAD4StH7SyjvtJjDeFKPYxoKq_fBurUG-PranUa-tLj4n1x-...

170 B
188 B

19ms
19ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwNzY3MjEyMjM4ODM2NDQzMTM5Mw%3D%3D&google_push=AXcoOmQjOAD4StH7SyjvtJjDeFKPYxoKq_fBurUG-PranUa-tLj4n1x-Fj7sKPchnXkyywaZIDOu8CakvusiVaYQLGKjL70_J5uq

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwNzY3MjEyMjM4ODM2NDQzMTM5Mw%3D%3D&google_push=AXcoOmQjOAD4StH7SyjvtJjDeFKPYxoKq_fBurUG-PranUa-tLj4n1x-Fj7sKPchnXkyywaZIDOu8CakvusiVaYQLGKjL70_J5uq
date: Sat, 05 Aug 2023 11:35:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 07E7
Redirect Chain

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEC2xvufMEbP3zHoa2JuWV2s&google_cver=1&google_push=AXcoOmT-SPxaPONtN2m9OqtR0G9t-nRsh4-JZNEPFMiGf4LtCYGUCeQ5HJZMBjfMAqbrB4b6hZAFF...
https://b1sync.zemanta.com/usersync/googleopenbidding/?google_cver=1&google_gid=CAESEC2xvufMEbP3zHoa2JuWV2s&google_push=AXcoOmT-SPxaPONtN2m9OqtR0G9t-nRsh4-JZNEPFMiGf4LtCYGUCeQ5HJZMBjfMAqbrB4b6hZAFF...
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmT-SPxaPONtN2m9OqtR0G9t-nRsh4-JZNEPFMiGf4LtCYGUCeQ5HJZMBjfMAqbrB4b6hZAFFBOLf_J-AxCMS0N1fLU1PwKhNQ&google_hm=cUc4dFZWSGRZR3...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmT-SPxaPONtN2m9OqtR0G9t-nRsh4-JZNEPFMiGf4LtCYGUCeQ5HJZMBjfMAqbrB4b6hZAFFBOLf_J-AxCMS0N1fLU1PwKhNQ&google_hm=cUc4dFZWSGRZR3EzZmlIS25USzk=

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:38 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmT-SPxaPONtN2m9OqtR0G9t-nRsh4-JZNEPFMiGf4LtCYGUCeQ5HJZMBjfMAqbrB4b6hZAFFBOLf_J-AxCMS0N1fLU1PwKhNQ&google_hm=cUc4dFZWSGRZR3EzZmlIS25USzk=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 242
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 07E7 0
12 B 16ms
15ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KYWXUzY3omnuK04oATuU9N6LTTS1L7aC-8GB0chjsQTIOrvgONzyqcPVtwcVqxKdXWgEoFXg

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8C64 22 KB
8 KB 8ms
8ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3512
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 10:37:05 GMT
expires: Sun, 04 Aug 2024 10:37:05 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 335E 0
0 55ms
55ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CxbWmCDTOZJa3JcXi-gbjgaz4AcCk-Yly4amF6bERtszmrYkCEAEgkeLkH2CVko2CmAegAeqv6JgDyAEJqQI1PdpABHeyPuACAKgDAcgDywSqBOsBT9DVqTGr9if5aJRbAbJykNeNk0JD3KpBEiYZW1zlJiXp1FhS2RSqofFPSPe-_IlxeqKeOv7DbJH1R8PbXTvoDsxfG9Sa7pPBzCvKPK0k0loXTuvFZVBswpplafW_QnaOoezxhxmkmuQFX2sCPN6SWhrxivK9jX0eo6IPTqWajLdhLtQKRUFXCcyc2miO-D3qyB18HQQQ-X0P_fCT29Z-nNgBLgLvPyP2ghI5k-qrcfL9Q5l87NIyF6sFTV5o2RPFL_4t6nNwlWAqpjFkZfNgFOmchY3N-Do-7aXWCADGgVHKO0Lcb2pUBHa-j8AE4ICyybsE4AQBkgUECAQYAZIFBAgFGASgBi6AB_7Pl2eoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAemvhvYBwDyBwQQi94C0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tODI1ODMwNzExMDYwMDA5M4AKA8gLAaIMCCoGCgTDsLEC2BMC0BUBgBcBshceChwIABIUcHViLTE1NzA2NjE5NjI4NjY5ODEYkP0S&sigh=2dUc72HTGeg&uach_m=[UACH]&cid=CAQSPABpAlJWlQXSmWtG8lHAvT7vCKYETOsXuGD2MP6uwfhDi4fHJ7wQvCaTOnbrfAu71_RvctTVZ0_BhuyehRgB&template_id=494&cbvp=2&vis=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

GET
H3 200 css
fonts.googleapis.com/ Frame B568 6 KB
706 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 05 Aug 2023 09:56:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 97A2 15 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:08:17 GMT
x-content-type-options: nosniff
age: 1640
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 11:08:17 GMT

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 97A2 15 KB
15 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 10:18:14 GMT
x-content-type-options: nosniff
age: 4643
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 10:18:14 GMT

GET
H2 429 link.html
track.webgains.com/ Frame B363 0
0 128ms
30ms Script
text/html 35.177.233.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3756941&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1jhvvkh9pzsf3tns9bqa2gfavjvn60d35j63mzmjd6m082ytjd4560k7vxp35erpzf2dy9h0hdtby4vre9wg622pezhbvht89y2ccsmeh19hgyy6w8zx6wdqcgkmqjmga7dnccfcdsx02c24daaccwxx2qsf4rhqgmbahjf17c35qtdf133b4783n2qdy1wqe1qb9ddphgvx0k1ac0ev9b2d1zxg3x7593m7rcrdhwx5ymttbyy9r0dkzrap4jqg0dh44%26a%3Dhttps%253A%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq50net5bnpg3fx59qnjw7dk58e9max2gzpf3775tdawgh78at58st0atmgsmm2zqjh8g7a20smjd58h5z7px000swv12ye362h1ebwavt2byf71wxbzfqv6sjsxt5w33w9fpb1eg7tmpjrhhq9akem5knk6s57wgbqtqg57pagsymh1fmmtbz0nmp6ccjnejvvjvkxy7nf94fr4gd782s9yk2epk3kysfz541g7qhmsj108r0rsaccfc87cbpmsys4xww0q33ea62cmf77ha8c08%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%252526client%25253Dca-pub-3282547114800347%252526adurl%25253D&clickref=oneid24zt6fqfj2RWSVHWHktwC2JgGHxS7TgQXaEK68oneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&viewref=oneidQMGH4fjfP2BJaxH5HYtGtbMzjF6S4TG6dTRB7boneid__suite_Netmix_Reach128_WEBGAINSMOSTLY
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=175059&b=QMGH4fjfP2BJaxH5HYtGtbMzjF6S4TG6dTRB7b&f=24zt6fqfj2RWSVHWHktwC2JgGHxS7TgQXaEK68&c=320&d=50&e=&g=55be73c13a490642710a3cf910d674b6%2F15996707371263482972&i=65915&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1691235337316&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1hq50net5bnpg3fx59qnjw7dk58e9max2gzpf3775tdawgh78at58st0atmgsmm2zqjh8g7a20smjd58h5z7px000swv12ye362h1ebwavt2byf71wxbzfqv6sjsxt5w33w9fpb1eg7tmpjrhhq9akem5knk6s57wgbqtqg57pagsymh1fmmtbz0nmp6ccjnejvvjvkxy7nf94fr4gd782s9yk2epk3kysfz541g7qhmsj108r0rsaccfc87cbpmsys4xww0q33ea62cmf77ha8c08%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCHb_wCDTOZOb7BILE7gPY7YaIApDhgYRctqjCivACwI23ARABIABglZKNgpgHggEXY2EtcHViLTMyODI1NDcxMTQ4MDAzNDfIAQmpAjU92kAEd7I-4AIAqAMByAMCqgT-AU_QFtDPLyI_X2H9qKDrxomnR0IMUqeLJYconqfsm13McneVRXh0BZFJ0pYtYoYSKwz7A6RivtfHHQ6dYJM4_4-IbnWiFqTIup6pNpde7f0Zmgx6ZIwsNT1tzKpk2US0OywNpRwppLIHRH4nWn9b8YaPBSreE5BAIk6_xDgDAtgczes7Qd1Ws2va1dOuELtCU_5YwDu0GEg1UPNbbun-DL62L3Du_5I63rJZBWSWQLAb7qRh1rNwiTFLg_r2O47feuyDzjcTRywsbMS_XEWF4O0f9qN3LFvrVclm1aGsXPBQ0cGEKCNfPty3p2Yt3dPnkefQsAbGLDzMBbQrLLgT4AQBgAaxwonZoOnVy5ABoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi04MjU4MzA3MTEwNjAwMDkz-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_38mGnomVBRr6bLnKdwPLUVRKApBA%2526client%253Dca-pub-3282547114800347%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.177.233.254 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-177-233-254.eu-west-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
server: awselb/2.0
content-length: 45
content-type: text/html

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7C0C 113 KB
38 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=HOKcj4laZW&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=HOKcj4laZW&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 7C0C 118 KB
40 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=HOKcj4laZW&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=HOKcj4laZW&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 04:01:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27267
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 06 Aug 2023 04:01:10 GMT

GET
H3 200 12869506505489293016
tpc.googlesyndication.com/simgad/ Frame B568 6 KB
6 KB 13ms
12ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12869506505489293016

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3ec7e69d3bc5ba15110618a2e45362c0126f0e05e46b0fe6e906c0e7db443c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 20:26:51 GMT
x-content-type-options: nosniff
age: 486526
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5982
x-xss-protection: 0
last-modified: Thu, 23 Dec 2021 14:43:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 29 Jul 2024 20:26:51 GMT

GET
H3 200 YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js Show response
pagead2.googlesyndication.com/bg/ Frame B568 37 KB
14 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

616caa77f3b26bf752bc7e76e496c90f09e972978a16e9fd7111d8f23009f504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:27:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 488
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 04 Aug 2024 11:27:29 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 15B0
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEM295IDrQ1KEXT7OaEucvd0&google_cver=1&google_push=AXcoOmQTzfPWj2T3-zK-7M9ETSYItBHBmA_4b6yBa8zMFYxB1Y7ciZxmRTyHT1M7iE8G1B7IlFe_FcA62Z_d5j_33TYBk1MNabs
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A7433661CB254AFE8CD8FF1157CE0397&google_push=AXcoOmQTzfPWj2T3-zK-7M9ETSYItBHBmA_4b6yBa8zMFYxB1Y7ciZxmRTyHT1M7iE8G1B7IlFe_FcA62Z_d5j_...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A7433661CB254AFE8CD8FF1157CE0397&google_push=AXcoOmQTzfPWj2T3-zK-7M9ETSYItBHBmA_4b6yBa8zMFYxB1Y7ciZxmRTyHT1M7iE8G1B7IlFe_FcA62Z_d5j_33TYBk1MNabs

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 05 Aug 2023 11:35:37 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A7433661CB254AFE8CD8FF1157CE0397&google_push=AXcoOmQTzfPWj2T3-zK-7M9ETSYItBHBmA_4b6yBa8zMFYxB1Y7ciZxmRTyHT1M7iE8G1B7IlFe_FcA62Z_d5j_33TYBk1MNabs
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 04 Aug 2023 11:35:37 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 15B0
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEOS_rnfLFpJwHMXrXKkTiwE&google_cver=1&google_push=AXcoOmQ_0ig4OlvdGcmrkZZs1F8UjIxML2-6Wqn2XwyP5Zvx7Zz2PQLkeHVi77OVS5etmvfbUDY3lN_wNahZYvycKnH8OBfuHqbf
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=ODUwQjkyMDkzMzRDRTYxQw==

170 B
188 B

23ms
22ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=ODUwQjkyMDkzMzRDRTYxQw==

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=ODUwQjkyMDkzMzRDRTYxQw==
date: Sat, 05 Aug 2023 11:35:37 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 15B0
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESED1tBCUp3sXqh93lJj7lElU&google_cver=1&google_push=AXcoOmQ-3YfR1DNejmFDU0BUiNQbvV1h3KWqzyms1o0bpk1nNEUXyWrIUXgvP31cGXg62JoHhXoyuLTjYc2gpA...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI2MzgwMDQ2MjI3NTYzOTQ1MQ%3D%3D&google_push=AXcoOmQ-3YfR1DNejmFDU0BUiNQbvV1h3KWqzyms1o0bpk1nNEUXyWrIUXgvP31cGXg62JoHhXoyuLTjYc2gpAxYdh...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI2MzgwMDQ2MjI3NTYzOTQ1MQ%3D%3D&google_push=AXcoOmQ-3YfR1DNejmFDU0BUiNQbvV1h3KWqzyms1o0bpk1nNEUXyWrIUXgvP31cGXg62JoHhXoyuLTjYc2gpAxYdhguUMDvrb8

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI2MzgwMDQ2MjI3NTYzOTQ1MQ%3D%3D&google_push=AXcoOmQ-3YfR1DNejmFDU0BUiNQbvV1h3KWqzyms1o0bpk1nNEUXyWrIUXgvP31cGXg62JoHhXoyuLTjYc2gpAxYdhguUMDvrb8
Date: Sat, 05 Aug 2023 11:35:37 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 15B0
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPXZHpqh7NxrxnhntVa1vyI&google_cver=1&google_push=AXcoOmQ_slanhzwGNfI_k07B5NSSS7GG0B14jkyL2xmKObc7rjaI5PYi4OBNtOzNMmE7EJAFMBiq7rKT...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA2NTg5NTYwMTEyMzg5NDUwNg&google_push=AXcoOmQ_slanhzwGNfI_k07B5NSSS7GG0B14jkyL2xmKObc7rjaI5PYi4OBNtOzNMmE7EJAFMBiq7r...

170 B
188 B

23ms
22ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA2NTg5NTYwMTEyMzg5NDUwNg&google_push=AXcoOmQ_slanhzwGNfI_k07B5NSSS7GG0B14jkyL2xmKObc7rjaI5PYi4OBNtOzNMmE7EJAFMBiq7rKTpMRn750W3jUjX9JeSQNV

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA2NTg5NTYwMTEyMzg5NDUwNg&google_push=AXcoOmQ_slanhzwGNfI_k07B5NSSS7GG0B14jkyL2xmKObc7rjaI5PYi4OBNtOzNMmE7EJAFMBiq7rKTpMRn750W3jUjX9JeSQNV
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 15B0
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESELpAqoHAUH0B6GEPH1yMUDg&google_cver=1&google_push=AXcoOmQyGhhvEV_oKSbruHjZCFDlSBWk3LE4UC1U-AELKLUtBISXjpfwjJNApFGL0nys3X1v0j7ZlibKIA6Vq...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESELpAqoHAUH0B6GEPH1yMUDg&google_push=AXcoOmQyGhhvEV_oKSbruHjZCFDlSBWk3LE4UC1U-AELKLUtBISXjpfwjJNApFGL0nys3X1v0j7ZlibKIA6Vq...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQyGhhvEV_oKSbruHjZCFDlSBWk3LE4UC1U-AELKLUtBISXjpfwjJNApFGL0nys3X1v0j7ZlibKIA6VqMw3diLlvenNnv-W&google_hm=cUc4dFZWSGRZR3EzZmlI...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQyGhhvEV_oKSbruHjZCFDlSBWk3LE4UC1U-AELKLUtBISXjpfwjJNApFGL0nys3X1v0j7ZlibKIA6VqMw3diLlvenNnv-W&google_hm=cUc4dFZWSGRZR3EzZmlIS25USzk=

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:38 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQyGhhvEV_oKSbruHjZCFDlSBWk3LE4UC1U-AELKLUtBISXjpfwjJNApFGL0nys3X1v0j7ZlibKIA6VqMw3diLlvenNnv-W&google_hm=cUc4dFZWSGRZR3EzZmlIS25USzk=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 15B0
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEGkUgps2OdPiu9OAnNaMp8M&google_cver=1&google_push=AXcoOmTqr_IhFti1x3agwYTcXylfjw20LTk0YRWNhWcirwnBTzM6qBRXnKuSCWtGOVQwH0zo8XlmqX7vBf7r0p1wHdexNJ2KeR4H
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzM0MjM2OTM3ODE3MzQyMDAwMFYxMA%3d%3d&mn_hm=MzM0MjM2OTM3ODE3MzQyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmTqr_IhFti1x3agwYTcXylfjw2...

170 B
188 B

19ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzM0MjM2OTM3ODE3MzQyMDAwMFYxMA%3d%3d&mn_hm=MzM0MjM2OTM3ODE3MzQyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmTqr_IhFti1x3agwYTcXylfjw20LTk0YRWNhWcirwnBTzM6qBRXnKuSCWtGOVQwH0zo8XlmqX7vBf7r0p1wHdexNJ2KeR4H&gdpr=&gdpr_consent=

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 05 Aug 2023 11:35:37 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzM0MjM2OTM3ODE3MzQyMDAwMFYxMA%3d%3d&mn_hm=MzM0MjM2OTM3ODE3MzQyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmTqr_IhFti1x3agwYTcXylfjw20LTk0YRWNhWcirwnBTzM6qBRXnKuSCWtGOVQwH0zo8XlmqX7vBf7r0p1wHdexNJ2KeR4H&gdpr=&gdpr_consent=
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 15B0 0
45 B 193ms
17ms Image
text/plain 185.86.139.103
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEEu-7Voa-ea3dWrirkzeWq4&google_cver=1&google_push=AXcoOmTYOG5BGR_tkRcDgdLrH6f4gWmNgRhOYNG8eLrQzYJRsaVY7gThbQQm0x_Ta4byEb4fSf2YLBtw44_Brac3v8r9oA2NP98
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.103 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 15B0 0
12 B 16ms
15ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LhoohDjVlEYQGdSpAChnv5axqnjWc7hvNCMLEoy0JFXC40wT91NxY8AC2sMG2gbAgrJAHE

Requested by

Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame B568 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 17:49:54 GMT
x-content-type-options: nosniff
age: 63943
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Aug 2024 17:49:54 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 46B3 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3512
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 10:37:05 GMT
expires: Sun, 04 Aug 2024 10:37:05 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12784067222800087067/ Frame 3D6A 141 KB
22 KB 10ms
9ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12784067222800087067/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4f828bd932e3d2cfc41828f719a08047655f9572c4cc79828fc336c23a6f2ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 15894
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 22859
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Aug 2023 07:10:43 GMT
expires: Sun, 04 Aug 2024 07:10:43 GMT
last-modified: Wed, 09 Feb 2022 10:31:32 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FD0B 0
0 51ms
50ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvdwhyWpp2xTwOWuw9VJTrSZIuSVjO6nDTYchuwscVh4wCLUn02IQ33spRMaDmnlnEns06AvSJ98ggly9aUSHfLdxu9XwwcjJ0MH0OAfPqooXjKhbD-Y2An6vpAFEF5rbobi4A4Ka2V4pE3tHQv8ArikyWJVJzn2XvcEki0GEaNO8nbOTjZEIPsc8JPGvL7c3L5eS3HutH_OHUNzUIhlz4qbsLFWIsGAYJHQBbzfs2d1rLJZhhNPZfKrx-_GIuqsVjSs60QGSoUYZ5kDqk7HgHqRZKnVWWPYcJTWjMnl70Pjgp8cE46daCxg--cuAKuxa-2fEGlrmYieUivb7xEFLsQDTZHDfKUPqKEphh8geHBqjKFaJy8RykoZw-2CxnDD95IoxRnC52d_LORTVN1Ly5c6X2RsCNp1lPa_vX1wMn-zuRaaDTRcZlOy7u1-JZdFyElkWcsJENxMeNddzdXTRtfVrLik9dRcCqjtajvse_1SLgQV2A76lFMcMF55ogA13qYhnXOKvEchi2FmeAEHGHPttruAf7GAGE2b-OBZrQGN5ytJNIY8LpcNVB03a06RLraVo6arnIFWDl59kop2nOdCJmoJJxYUa3OcnjCVO0KEMsUywetqghMGdhxziwtMSgQ4K4YezDuG9xnS6lBJW6er4UYSo4-1zqVm-nn9MZct7cHczMWZl0gmDvihG5bsDO5krw6OdaQPz4CFE1s28SxtoeaeK5anGTk_Fv4OogtKEXAfo0o-f5eBabKVUtkeduHLg2UKMHdREgU7D6UurP-vDzdB2YWo7anhohSbriJ5lCos0MniuI25K_-79DomUUv4CZGRXsv2fP8KoGkFPgx9N1yTPXrRJCcwSqy_XPdcGzRO74zMBk8CNg-2GrtoskxZPEDnXtZQl-CrVo-ed9yMkzXNYWCHm1CqBh4y0-7L6QkqcaLpLnLX5TV4nkSWfAoDW2tPcR14LDcmdNakdhfbgU9vXyc05b1SR944dwOyne9s7brGgtjKnNNBIJPk8dJBI5FFg9PQe-UzqPuPI9Asb7IdOrOct7Z7U5i1_4gU_fooM5GY1oS9k9ggIHdO7j-ge1K7jE3ujFLNgtP9hSolXHdvBg-3Vd9fSyK9FMpOoi2PAkitf-gPRHFgPojTdhSDnHcdN6LwG0BfIow0ZvMvd4b3XAi50yO6SkdcGox55LqwP34zOThVkR5zAFyUReQlgFCfTtlUbJDoEII0dgZqKqaXx9S0nShmUNDTN75GF7D3L8zV9xAheQDa39AGvr93rR0g_02lFx8IPxte9Z9X7OaFbKUBLD-Pf8pvhDs7z3e_UdX1udzuYROeqmGxOXryp8flJHzKYJX6SJ9IXxtsgqlpRnlAUY8aTSEA2sOQv4H78oR&sai=AMfl-YRpcHpvGHilfJTEUn7AUcPXJ9rqPl5cjgfDp3ypSbFXmdG-hp2nw1WaIyN6lS93ZPaQ_eWWyaWqdgb2VRHTWJVVh3ytZwvXd2C3C8UzhvL9kXwjNododVi9rPl5zOtWPSDDay0nfvm0ymOCCst_6UIP_X4k0mFDfI7SHPhrtLlmVlCWKI9QjZQZcaoPiNtTiR_S9YGB77qbYN5atpyCl3cLfl24pHtQzIX6E38jpkEfEjQSJARdaeB2HVdCoo0qJ4JkwWw&sig=Cg0ArKJSzPjoPemi4rFpEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=271&cbvp=1&cstd=268&cisv=r20230802.58117&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame FD0B
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/987057/61527017/4.js?ias_dspID=3&ias_campId=1013380671&ias_pubId=pub-3282547114800347&ias_chanId=1&ias_placementId=20343401207&bidurl=https://intercelestial.co...
https://static.adsafeprotected.com/4a.js

2 KB
2 KB

12ms
12ms

Script
application/javascript

2600:9000:238d:b000:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:238d:b000:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbead98319b2bee5757af35b4eacf615df3e45da2f69cb999cd4694a26bfb90f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: GhIpPdkXc8Y8o13QvOK0nUkv02TeqfvN
content-encoding: gzip
via: 1.1 d6029710111dc7ad6216b4063753d630.cloudfront.net (CloudFront)
date: Mon, 31 Jul 2023 19:17:27 GMT
x-amz-cf-pop: AMS1-P1
age: 404291
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 24 Jul 2023 19:17:25 GMT
server: AmazonS3
etag: W/"589d8955c4906ab1b8e63a2f92d932d3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: fgaw8PhpDnXd-HqMh3pAPZqZA6toIh-ktGnfDNJ7a2odh2y9Pun4fg==

Redirect headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
server: nginx
x-server-name: app08.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame D9A1 91 KB
23 KB 97ms
14ms Script
application/javascript 2600:9000:238d:b000:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:b000:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 29 Mar 2023 13:56:00 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 d6029710111dc7ad6216b4063753d630.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 11137178
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: vp-5-tVNvQqNxn2ICIRHy5gbBNJxCRxSFqtknC8qyfSw_rDhop96Rg==

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame B568 15 KB
16 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:08:17 GMT
x-content-type-options: nosniff
age: 1640
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 11:08:17 GMT

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame B568 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,300&subset=latin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 10:18:14 GMT
x-content-type-options: nosniff
age: 4643
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 10:18:14 GMT

GET
H3 200 YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 8C64 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

616caa77f3b26bf752bc7e76e496c90f09e972978a16e9fd7111d8f23009f504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:27:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 488
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 04 Aug 2024 11:27:29 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 3D6A 29 KB
10 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12784067222800087067/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12784067222800087067/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 05:02:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23561
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 06 Aug 2023 05:02:56 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FD0B 43 B
216 B 315ms
91ms Image
image/gif 2600:1f18:1aca:4280:821:6904:d4d8:e46b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=987057&asId=8864983d-8eed-e01f-9ce2-df847780d153&tv=%7Bc:kpOEGD,pingTime:-3,time:138,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:33%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:138,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:32,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B131~0%5D,as:%5B131~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tM3F7DP+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b1%7C1c%7C1d%7C1e111%7C1e112%7C1e12%7C1f%7C1g1%7C1g2%7C1g3%7C1g4%7C1h1%7C1h2%7C1h3%7C1i1%7C1i2%7C1i3%7C1j*.987057-61527017%7C1j1%7C1j2%7C1j3%7C1j4,idMap:1j*,rmeas:1,rend:0,renddet:DIV,siq:34%7D&br=c
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:821:6904:d4d8:e46b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:38 GMT
server: nginx
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FD0B 43 B
215 B 316ms
93ms Image
image/gif 2600:1f18:1aca:4280:821:6904:d4d8:e46b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=987057&asId=8864983d-8eed-e01f-9ce2-df847780d153&tv=%7Bc:kpOEGE,pingTime:-6,time:139,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:139,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:32,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B133~0%5D,as:%5B133~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tM3F7DP+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b1%7C1c%7C1d%7C1e111%7C1e112%7C1e12%7C1f%7C1g1%7C1g2%7C1g3%7C1g4%7C1h1%7C1h2%7C1h3%7C1i1%7C1i2%7C1i3%7C1j*.987057-61527017%7C1j1%7C1j2%7C1j3%7C1j4,idMap:1j*,rmeas:1,rend:0,renddet:DIV,siq:34%7D&tpiLookup=ao:intercelestial.com*&br=c
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:821:6904:d4d8:e46b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:38 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FD0B 43 B
215 B 293ms
92ms Image
image/gif 2600:1f18:1aca:4280:821:6904:d4d8:e46b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=987057&asId=8864983d-8eed-e01f-9ce2-df847780d153&tv=%7Bc:kpOEH2,pingTime:-2,time:163,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:673,beZ:674,mfA:676,cmA:677,inA:677,inZ:682,prA:682,prZ:700,si:706,poA:707,poZ:728,cmZ:728,mfZ:728,loA:812,loZ:813,ltA:835,ltZ:835%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:33%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:163,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:32,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B156~0%5D,as:%5B156~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tM3F7DP+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b1%7C1c%7C1d%7C1e111%7C1e112%7C1e12%7C1f%7C1g1%7C1g2%7C1g3%7C1g4%7C1h1%7C1h2%7C1h3%7C1i1%7C1i2%7C1i3%7C1j*.987057-61527017%7C1j1%7C1j2%7C1j3%7C1j4,idMap:1j*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:DIV,siq:34,sinceFw:128,readyFired:true%7D&br=c
Requested by: Host: 687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com
URL: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:821:6904:d4d8:e46b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:38 GMT
server: nginx
x-server-name: dt02.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9201 0
0 43ms
43ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXRgDvkpMV1hyL8sLDLo1MYH9KMq7uGh2kMjC--D-scfJgMBo-PmuoNaRTLydX6himalgadrDkaNMhtU6QN2I9p99Kafv_gnSn_9JfqCeDB8TnlUwtVdw3DjOuSrFc6gc2dtK2NC8VtiqXQCV6IakR310bSs-ZhcyAScpAIAAykDpZKnv0s8Dt2XEAiaR2jZmda-cr7wBc-u-EyY1Z0xym3AaCfuULjl2f4dKQo8vE9j8m35s1usUVeOf7B2nZ7fqYck-t3Kdex344RPVzAqfjOi_afRoA025b0YlP2kFH6iyxh5p5DTzVQkUCnkLFIULkf3JWrKkBj6NY3B7vFNI6v-91huWyMtXiYKSKcytkRn7YmIwGdtxGBB-v5ShwiONBj21eECv2wPJvORITqktmjo2o0vW3XC63t3UoVmhl5pKIxeF3idgI6hf_McmV4imN6F5iCIFGmkjxT4I6qDZRKM8DCUS8v01XR16r5tJcgiNp40948Hf1u1EZGCRy4JTPKC2ZOb3CcdTIaiPgm1D8IaSPFcir9sT6oKlHsu-gu9hlbsKDmpiisu6aZ-S4uGmU86VHrcdB-VSdNvWRLmHioJRrDCS57ag9Z0EmzQ4mVJB4FMz_pQU6dB9tDVwUBVstp0h133JC_sWFFT8j0PjF5Xzr2su2NvpMfJRKLsuBJ6PiMRhZFygWPsge0TjtpK0IDHd8u16WVKIS9i6dgT6ddAWU09oCw-MGstZJ16LSYFbofXkQiSyNVecZJPHRbcwZv89DWAD2jZCOjeqB6_Q6ERi2YZl5U_40YQZ7UNvj9T6VsNCCKxe9cWafWmB4SY6p-qoHz8V3E7q25dHyLCaVhlm9k53DqY-dnk7dRWYatVDkfdV9Urbjl_XHUzOrzIYtQB6QMhx1ezXafc3aJNE7NFsLZ1lmDWnvVbwguAF-htOWnQNAywkPAlCWVSa7m5V5LMwq3XlPYeBGeWn6Fd-hZHeP__x7c60jXH_6L4-aCO0AAA1SotCqTW3mMgGDn9DzzSHHBOJehrCu7lb3JyTONTYRklNt8Ho8W9_2fGkFyBuZqAcJ_AfP-qb2bRbCcTJDbaBxlG9yO-jifXY58v8cogl1OWzX30P738lNMTUbYXaRLQPZEewbXT6MJr1Rj2oiVNoU5EkD_OeSkokPxzc2VHRSeY2p1-4xvLTkKHyhgSUIUj5HMzsLnzkY0Cy1UYhykB8C1ymXjvsRn8_q__qZHhuUFsG_K_u3pUjv7FvPa-M9bDuQlv-rYUIiORKUCoersttCaIWERlvA1pIhtx-VLCuhSZG8j4DYVY9yYwbjlZ5DGQTX-cOzxrL49dk4dyPnc15edIZNA7H6V8qIB-zkIbuJ-zmUtgTKm_V8xs-TT2oMZ7QiRqg6nrPrmiy-isv37-K7&sai=AMfl-YQTY_Z50VmA7ihXuSQjGL4xlTFAsBsRW1CEuCw0iIK6PTjS4S73kZnoeMlMobu7eHpQz6dwHKvDLpMQmtxnffS8GqP3w_3xI9a977-uJAsZi1UgrURJpsJmHRq2Ouohu96Ok7FU1Ue--0XWUrtvQhWDOL0DUl9nx5KjQBPqBGtsOWdlXBCkoNcIHfcLW_pj_LpNIWh1bks_Q2hd_64gdp_gpdv3gpj9X5uRHZ68waLxFpqSxUNyxmxdsfTbCyqjIUD2sVM&sig=Cg0ArKJSzLZL7ZANuNeTEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=564&vt=11&dtpt=357&dett=3&cstd=194&cisv=r20230802.04751&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 05 Aug 2023 11:35:37 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 33F0 42 B
64 B 117ms
115ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssHXzmo1PpVrcAvznh45JaGpbXJ3MpzGE7-CcgAniqqbzh3RYfkRcKeTZB4GzMRGauDTdmADvf6xwH2ZzCWfSXab5ry8gJHCADMxwFAja4jyFL941ToigLFkEB3gOhiYEEC8FGagsCA8tGr&sai=AMfl-YTH2nL4kAFY6fmg9GdZ8OjGhuXikE0pfgje8ehexBbj3NZCwitmtid2XZbmmu1dOpOUuqcEjn4KEOfm-LevhUyG0G-wPlJVBO2ExYlem9atZLd-wNYsOPuPmRAe&sig=Cg0ArKJSzMMAr-lVSt1jEAE&cid=CAQSPABpAlJW5VkkpwIA_58M0gTaPyliGJviA5SlDYmfy0rJbWrNBYs3ytBsKG8Nnmpc0iRDF7gz4NFGQbvPpRgB&id=ampim&o=632,382&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1023&mtos=0,0,1023,1023,1023&tos=0,0,1023,0,0&tfs=347&tls=1370&g=100&h=100&tt=1370&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intercelestial.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 46B3 37 KB
14 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YWyqd_Oya_dSvH525JbJDwnpcpeKFun9cRHY8jAJ9QQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

616caa77f3b26bf752bc7e76e496c90f09e972978a16e9fd7111d8f23009f504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:27:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 488
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 04 Aug 2024 11:27:29 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FD0B 0
0 45ms
44ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvdwhyWpp2xTwOWuw9VJTrSZIuSVjO6nDTYchuwscVh4wCLUn02IQ33spRMaDmnlnEns06AvSJ98ggly9aUSHfLdxu9XwwcjJ0MH0OAfPqooXjKhbD-Y2An6vpAFEF5rbobi4A4Ka2V4pE3tHQv8ArikyWJVJzn2XvcEki0GEaNO8nbOTjZEIPsc8JPGvL7c3L5eS3HutH_OHUNzUIhlz4qbsLFWIsGAYJHQBbzfs2d1rLJZhhNPZfKrx-_GIuqsVjSs60QGSoUYZ5kDqk7HgHqRZKnVWWPYcJTWjMnl70Pjgp8cE46daCxg--cuAKuxa-2fEGlrmYieUivb7xEFLsQDTZHDfKUPqKEphh8geHBqjKFaJy8RykoZw-2CxnDD95IoxRnC52d_LORTVN1Ly5c6X2RsCNp1lPa_vX1wMn-zuRaaDTRcZlOy7u1-JZdFyElkWcsJENxMeNddzdXTRtfVrLik9dRcCqjtajvse_1SLgQV2A76lFMcMF55ogA13qYhnXOKvEchi2FmeAEHGHPttruAf7GAGE2b-OBZrQGN5ytJNIY8LpcNVB03a06RLraVo6arnIFWDl59kop2nOdCJmoJJxYUa3OcnjCVO0KEMsUywetqghMGdhxziwtMSgQ4K4YezDuG9xnS6lBJW6er4UYSo4-1zqVm-nn9MZct7cHczMWZl0gmDvihG5bsDO5krw6OdaQPz4CFE1s28SxtoeaeK5anGTk_Fv4OogtKEXAfo0o-f5eBabKVUtkeduHLg2UKMHdREgU7D6UurP-vDzdB2YWo7anhohSbriJ5lCos0MniuI25K_-79DomUUv4CZGRXsv2fP8KoGkFPgx9N1yTPXrRJCcwSqy_XPdcGzRO74zMBk8CNg-2GrtoskxZPEDnXtZQl-CrVo-ed9yMkzXNYWCHm1CqBh4y0-7L6QkqcaLpLnLX5TV4nkSWfAoDW2tPcR14LDcmdNakdhfbgU9vXyc05b1SR944dwOyne9s7brGgtjKnNNBIJPk8dJBI5FFg9PQe-UzqPuPI9Asb7IdOrOct7Z7U5i1_4gU_fooM5GY1oS9k9ggIHdO7j-ge1K7jE3ujFLNgtP9hSolXHdvBg-3Vd9fSyK9FMpOoi2PAkitf-gPRHFgPojTdhSDnHcdN6LwG0BfIow0ZvMvd4b3XAi50yO6SkdcGox55LqwP34zOThVkR5zAFyUReQlgFCfTtlUbJDoEII0dgZqKqaXx9S0nShmUNDTN75GF7D3L8zV9xAheQDa39AGvr93rR0g_02lFx8IPxte9Z9X7OaFbKUBLD-Pf8pvhDs7z3e_UdX1udzuYROeqmGxOXryp8flJHzKYJX6SJ9IXxtsgqlpRnlAUY8aTSEA2sOQv4H78oR&sai=AMfl-YRpcHpvGHilfJTEUn7AUcPXJ9rqPl5cjgfDp3ypSbFXmdG-hp2nw1WaIyN6lS93ZPaQ_eWWyaWqdgb2VRHTWJVVh3ytZwvXd2C3C8UzhvL9kXwjNododVi9rPl5zOtWPSDDay0nfvm0ymOCCst_6UIP_X4k0mFDfI7SHPhrtLlmVlCWKI9QjZQZcaoPiNtTiR_S9YGB77qbYN5atpyCl3cLfl24pHtQzIX6E38jpkEfEjQSJARdaeB2HVdCoo0qJ4JkwWw&sig=Cg0ArKJSzPjoPemi4rFpEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=502&vt=11&dtpt=231&dett=3&cstd=268&cisv=r20230802.58117&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://687bfcb96b96b353f6d7cf5ec0f4aa77.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:35:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 05 Aug 2023 11:35:37 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FD0B 0
26 B 45ms
44ms Ping
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvVghTZNcjAy0AHK1FqHEJicHzdOcRUNa_AWFx7WjX63nb_e97_XnsLy9Ej35oWl1EodeMY2xWeIiTDEuwcvOchEXBCe9I5QrIdQh-0gQCTcsXAs18mMnC0nQZTCeQVR5nd1tsW0ksWK4xq1iuvmCA3MygxrwigWxNb_DI8d4pt_OD7&sai=AMfl-YTUYJotktgrpg1DfVeKEHT0F14E9jQ2Dz2kIvI_631xhUfmfv3Q2wwxlN92XS1Z1jTCG19Um3ZgvBuW63lJaBIuRwqkHJcgi3PZ1uaohsigWl8FWtDeZUq9c_0-Jbw&sig=Cg0ArKJSzDnqi5Sg8LP6EAE&uach_m=[UACH]&urlfix=1&vt=13&adurl=

Requested by

Host: pahe.li
URL: https://pahe.li/?e2b669daaf=WkhvakxJQjUvbHd4My9HOTBsdk9oTFRrVmhFQ0JjSlVmYXRkaW90OFNpSmh5Z1VkdXJuY3FvZVNvR015MXY5dzBCZDBib3NUYTVjVG9UTDlaREtZYXc9PQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS