www.educationmoney.com Open in urlscan Pro
2600:3c03::f03c:92ff:fe05:debc Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.educationmoney.com/
Effective URL:
https://www.educationmoney.com/
Submission Tags: falconsandbox
Submission: On July 02 via api (July 2nd 2022, 10:45:45 pm UTC) from US — Scanned from DE

Summary HTTP 139 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 23 IPs in 3 countries across 16 domains to perform 139 HTTP transactions. The main IP is 2600:3c03::f03c:92ff:fe05:debc, located in Cedar Knolls, United States and belongs to LINODE-AP Linode, LLC, US. The main domain is www.educationmoney.com.
TLS certificate: Issued by R3 on June 19th 2022. Valid for: 3 months.

This is the only time www.educationmoney.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 55	2600:3c03::f0... 2600:3c03::f03c:92ff:fe05:debc	63949 (LINODE-AP...) (LINODE-AP Linode)
12	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
9	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
2	104.20.228.67 104.20.228.67	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 14	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2006	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2016	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1 2	142.250.186.102 142.250.186.102	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2006	15169 (GOOGLE) (GOOGLE)
139	23

55 2600:3c03::f03c:92ff:fe05:debc (Cedar Knolls, United States) 1 redirects

ASN63949 (LINODE-AP Linode, LLC, US)

www.educationmoney.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.20.228.67 (None, )

ASN13335 (CLOUDFLARENET, US)

secure.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

jnn-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.102 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	educationmoney.com 1 redirects www.educationmoney.com	251 KB
32	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 120 tpc.googlesyndication.com — Cisco Umbrella Rank: 160	441 KB
16	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 static.doubleclick.net — Cisco Umbrella Rank: 436 ad.doubleclick.net — Cisco Umbrella Rank: 189	119 KB
9	youtube.com www.youtube.com — Cisco Umbrella Rank: 107	771 KB
6	googleapis.com jnn-pa.googleapis.com — Cisco Umbrella Rank: 330 fonts.googleapis.com — Cisco Umbrella Rank: 71	31 KB
6	google.com 2 redirects adservice.google.com — Cisco Umbrella Rank: 92 www.google.com — Cisco Umbrella Rank: 8	15 KB
6	gstatic.com fonts.gstatic.com www.gstatic.com	47 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 179	127 KB
2	google.de adservice.google.de — Cisco Umbrella Rank: 7751	914 B
2	statcounter.com secure.statcounter.com — Cisco Umbrella Rank: 15690 c.statcounter.com — Cisco Umbrella Rank: 8575	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 155	86 KB
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 276	49 KB
1	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 135	2 KB
1	ggpht.com yt3.ggpht.com — Cisco Umbrella Rank: 257	3 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 867	653 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	3 KB
139	16

	Domain	Requested by
55	www.educationmoney.com	1 redirects www.educationmoney.com
20	tpc.googlesyndication.com	googleads.g.doubleclick.net www.educationmoney.com tpc.googlesyndication.com pagead2.googlesyndication.com
13	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com www.youtube.com www.educationmoney.com googleads.g.doubleclick.net
12	pagead2.googlesyndication.com	www.educationmoney.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
9	www.youtube.com	www.educationmoney.com www.youtube.com
5	www.gstatic.com	www.youtube.com www.gstatic.com googleads.g.doubleclick.net
4	www.google.com	2 redirects www.youtube.com tpc.googlesyndication.com
4	jnn-pa.googleapis.com	www.youtube.com
3	www.googletagservices.com	googleads.g.doubleclick.net
2	ad.doubleclick.net	1 redirects googleads.g.doubleclick.net
2	fonts.googleapis.com	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	connect.facebook.net	www.educationmoney.com connect.facebook.net
1	s0.2mdn.net	tpc.googlesyndication.com
1	i.ytimg.com	www.youtube.com
1	yt3.ggpht.com	www.youtube.com
1	static.doubleclick.net	www.youtube.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.facebook.com	connect.facebook.net
1	fonts.gstatic.com	www.youtube.com
1	c.statcounter.com	secure.statcounter.com
1	secure.statcounter.com	www.educationmoney.com
139	23

This site contains links to these domains. Also see Links.

Domain
www.fafsa.ed.gov
alcorehab.org
collegescorecard.ed.gov

Subject Issuer	Validity	Valid
www.educationmoney.com R3	`2022-06-19` - `2022-09-17`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-04-11` - `2022-07-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
us-dallas.statcounter.com Sectigo RSA Domain Validation Secure Server CA	`2021-11-06` - `2022-12-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh

This page contains 17 frames:

Primary Page: https://www.educationmoney.com/
Frame ID: 0D339D80656795BA078EDC72905A4570
Requests: 69 HTTP requests in this frame

Frame: https://www.youtube.com/embed/U45lizyqIic
Frame ID: 50763A7B2568A8334BA095D90E2630C8
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20190131/zrt_lookup.html
Frame ID: 58BE657B657A6C30C0591F25DFC1F3C3
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df360a3a86bc6404%26domain%3Dwww.educationmoney.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.educationmoney.com%252Ff11ffdd6e68a904%26relation%3Dparent.parent&container_width=462&href=https%3A%2F%2Fwww.educationmoney.com%2F&locale=ru_RU&sdk=joey&send=false&show_faces=false&width=450
Frame ID: 9D837CB64D8830D8951D8884B8F0E756
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&adk=1812271804&adf=3025194257&lmt=1613484948&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.educationmoney.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801939148&bpp=3&bdt=199&idt=97&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2078575847748&frm=20&pv=2&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=115
Frame ID: E7B0DD9EB5A924AF2265D068E74AFDF9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801940101&bpp=2&bdt=1151&idt=2&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db4e0395403f3e1c3-221410e0c4cd0011%3AT%3D1656801939%3ART%3D1656801939%3AS%3DALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw&prev_fmts=0x0&nras=2&correlator=2078575847748&frm=20&pv=1&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qLzMzHQ6hr&p=https%3A//www.educationmoney.com&dtd=12
Frame ID: B4191F07CC9BA52259917940DE555DA8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1
Frame ID: 14D9AE880B460871FC2B2E876A1EED67
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1
Frame ID: 574C942BA88AC12DA14C1752D5438560
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: B2DCB811BCEB922AB32401571B14AFAC
Requests: 2 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 5F266E5C1E93B592A171C85095195C16
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js
Frame ID: FDCE293C2A192A9CAD388B8D4E2DD706
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js
Frame ID: 2AF38AA74D3BFE5844159C56D2C8D5CD
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html
Frame ID: 04E011413F3EA417A93CFE0A0BB9F0D1
Requests: 6 HTTP requests in this frame

Frame: https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B25991098.306365351;dc_pre=CIGgjZmk2_gCFQGXewodVp4K0Q;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=
Frame ID: C3C6A669DEC08A4C99102A2E66C40BFE
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: C0554024A2987B2D70FFCFB127D732E6
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 866A4B4ED122E6E04E5ED67AE39668F1
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 89F151D0DBC97D0645BF9E7877C1A1EF
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

An Insider's Guide to Outsmarting College Costs and Getting Free Scholarships and Grants!

Page URL History Show full URLs

http://www.educationmoney.com/ HTTP 301
https://www.educationmoney.com/ Page URL

Detected technologies

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Statcounter (Analytics) Expand

Overall confidence: 100%
Detected patterns

statcounter\.com/counter/counter

Page Statistics

139
Requests

99 %
HTTPS

86 %
IPv6

16
Domains

23
Subdomains

23
IPs

3
Countries

1960 kB
Transfer

5832 kB
Size

8
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://www.fafsa.ed.gov/

Search URL Search Domain Scan URL

URL: https://alcorehab.org/scholarship/
Title: AlcoRehab.org

Search URL Search Domain Scan URL

URL: https://collegescorecard.ed.gov/
Title: The College Scorecard

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.educationmoney.com/ HTTP 301
https://www.educationmoney.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 112

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 116

https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B25991098.306365351;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B25991098.306365351;dc_pre=CIGgjZmk2_gCFQGXewodVp4K0Q;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 129

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

139 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.educationmoney.com/
Redirect Chain

http://www.educationmoney.com/
https://www.educationmoney.com/

25 KB
7 KB

266ms
83ms

Document
text/html

2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

d575fc14116b00adea0b06a786b3079d2fb3d7174804142b214d491e0afaa98a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 02 Jul 2022 22:45:38 GMT
etag: W/"602bd394-6511"
last-modified: Tue, 16 Feb 2021 14:15:48 GMT
server: nginx
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 169
Content-Type: text/html
Date: Sat, 02 Jul 2022 22:45:38 GMT
Location: https://www.educationmoney.com/
Server: nginx/1.18.0

GET
H2 200 0.homepage.js Show response
www.educationmoney.com/ 3 KB
845 B 85ms
84ms Script
application/javascript 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://www.educationmoney.com/0.homepage.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

bc0cc0e8efb7b2d2672900ebfde33fa1d7e1b6ef15e1bad166de8bf1289b592c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"6025605e-daa"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block

GET
H2 200 0.bookMark.js Show response
www.educationmoney.com/ 499 B
516 B 85ms
85ms Script
application/javascript 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://www.educationmoney.com/0.bookMark.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

e3be22d0d23fb10fdad928bdec027daf49e22f548a351b5cb703d710425656de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"6025605e-1f3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 162 KB
56 KB 70ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3069145d2117549e354d7e0a91e16141790a3de5e1453fc0f0603588251e2a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56438
x-xss-protection: 0
server: cafe
etag: 15785202031938733831
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 02 Jul 2022 22:45:39 GMT

GET
H2 200 thurs_logo.gif
www.educationmoney.com/states/graphics/ 7 KB
7 KB 83ms
82ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/states/graphics/thurs_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2c4980aefdce4dd6696edffc695f48187ce84a685af9be8cdd610111561a3283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1a43"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6723
x-xss-protection: 1; mode=block

GET
H2 200 red.spacer.gif
www.educationmoney.com/mouseovers/ 49 B
240 B 99ms
80ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/red.spacer.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

51bad96ab4260d466d16c758a6e88c08d6a5d3d153592c2b0212bac3d29b59d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-31"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 49
x-xss-protection: 1; mode=block

GET
H2 200 home.rollo.gif
www.educationmoney.com/mouseovers/ 616 B
808 B 104ms
81ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/home.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

819a7a475f6efb187a017babc236aeacd90fe602c4ce06c96f38d428ed67b3ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-268"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 616
x-xss-protection: 1; mode=block

GET
H2 200 state.mny.menu.gif
www.educationmoney.com/mouseovers/ 946 B
1 KB 104ms
82ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/state.mny.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

f43a2715c9ebde2ad7cf51d297378f038f1d04f42c58ae1a5046b186ea4335e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-3b2"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 946
x-xss-protection: 1; mode=block

GET
H2 200 fed.mny.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 105ms
82ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fed.mny.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

9bd229de4fcf0740584ff821ab4a0ca438fdd3da94c34ccf31b76617aa70d0b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-406"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1030
x-xss-protection: 1; mode=block

GET
H2 200 private.mny.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
2 KB 105ms
83ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/private.mny.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

1cd57716e44061e27878c07dbf5c3711aa08f97f0d03a3814a6439297ea72c7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-585"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1413
x-xss-protection: 1; mode=block

GET
H2 200 low.cc.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 105ms
84ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/low.cc.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2bb40a4ce957c08c50ab1ca4e0cdbf1572a6c368971e05d628c2193b29f35487

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-49e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1182
x-xss-protection: 1; mode=block

GET
H2 200 bookmark.gif
www.educationmoney.com/graphics/ 2 KB
2 KB 105ms
84ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/bookmark.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2380ad2259685cc9eaff048bfb6d79f5648b772e30f204d4427e42df680f0268

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-880"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 2176
x-xss-protection: 1; mode=block

GET
H2 200 link2us.gif
www.educationmoney.com/graphics/ 2 KB
2 KB 105ms
84ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/link2us.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

9594a2cd5ec38f47e385e1ee4a9eb2b50b15ea47c6f9d0c2cc695b3600393f82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-7a5"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1957
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_blu.gif
www.educationmoney.com/mouseovers/ 7 KB
7 KB 156ms
136ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

d01c3e1094da8e50d8246859ef5cf0214734464c43e3ead4e4922d47661e9b95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1c74"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 7284
x-xss-protection: 1; mode=block

GET
H2 200 stdnt.lns_blu.gif
www.educationmoney.com/graphics/ 5 KB
5 KB 156ms
136ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/stdnt.lns_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

dcbebae72894d33bdf61d3110d1beabad6463ff6bf48b0ef5ab6e8602da1dd4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-123d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 4669
x-xss-protection: 1; mode=block

GET
H2 200 state.mny_blu.gif
www.educationmoney.com/graphics/ 3 KB
3 KB 177ms
158ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/state.mny_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

203b18a2629a2ef035deb07d8c9e51424ca98f9315543e4acce3f08361c9ac76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-b8d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 2957
x-xss-protection: 1; mode=block

GET
H2 200 fed.mny_blu.gif
www.educationmoney.com/graphics/ 3 KB
3 KB 178ms
158ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/fed.mny_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8d2941546f89de0e1186029a4610caa720bd0c48783c8da44c4427e80112cc32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-c1f"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3103
x-xss-protection: 1; mode=block

GET
H2 200 prvte.mny_blu.gif
www.educationmoney.com/graphics/ 3 KB
3 KB 182ms
163ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/prvte.mny_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

c562ef70e7efe0e28cda98045bb466fe5ecee28ec8cd9cd53b4d515a1b0d48d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-c34"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3124
x-xss-protection: 1; mode=block

GET
H2 200 low.cost_blu.gif
www.educationmoney.com/graphics/ 3 KB
4 KB 183ms
164ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/low.cost_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

e844d9167fa2e6ff40c446e1e3563004d1bafe3026dbe4453d3878c9c9349a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-df5"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3573
x-xss-protection: 1; mode=block

GET
H2 200 copyright.gif
www.educationmoney.com/graphics/ 2 KB
2 KB 183ms
165ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/copyright.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

c7a9eedb197611dee3c7e4b95d2e0216741ba965ccf68fab86176ad405a177be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-779"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1913
x-xss-protection: 1; mode=block

GET
H2 200 mondy_logo.gif
www.educationmoney.com/graphics/ 6 KB
7 KB 184ms
165ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/mondy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

6b52d060a408513eeeb99563d13d1230a241fd18a7c9e3280ba644652d6ecec8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-19dd"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6621
x-xss-protection: 1; mode=block

GET
H2 200 tues_logo.gif
www.educationmoney.com/graphics/ 6 KB
6 KB 184ms
166ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/tues_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

6da3b4e91f69d7289094f5e91fe7da56ec159fb61a26e9c05c7fa593b4eb76a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-18d6"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6358
x-xss-protection: 1; mode=block

GET
H2 200 weds_logo.gif
www.educationmoney.com/graphics/ 6 KB
7 KB 184ms
167ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/weds_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

0fd5cf764972d1df9f1fb87a8bdd9e48787d890b2cb9661e55289923a6639e8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-195e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6494
x-xss-protection: 1; mode=block

GET
H2 200 thurs_logo.gif
www.educationmoney.com/graphics/ 7 KB
7 KB 237ms
220ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/thurs_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2c4980aefdce4dd6696edffc695f48187ce84a685af9be8cdd610111561a3283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1a43"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6723
x-xss-protection: 1; mode=block

GET
H2 200 fridy_logo.gif
www.educationmoney.com/graphics/ 5 KB
5 KB 238ms
221ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/fridy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

ce1e23eec62ea3c1b52e354a842e51ea07bedb24ee5ed6be100339dcdb1a9b22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1412"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 5138
x-xss-protection: 1; mode=block

GET
H2 200 satdy_logo.gif
www.educationmoney.com/graphics/ 6 KB
7 KB 238ms
221ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/satdy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

b4a584c3f5e03eeb8a22223ee5eaa8a8792573062da9dc58ba8bfc0675804eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-19e9"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6633
x-xss-protection: 1; mode=block

GET
H2 200 sundy_logo.gif
www.educationmoney.com/graphics/ 6 KB
6 KB 238ms
222ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/sundy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

d6932842cb870f04e9e0069ff3bbd90b815679065bf754735e56a4893ec12c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-18d7"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6359
x-xss-protection: 1; mode=block

GET
H2 200 home.menu.gif
www.educationmoney.com/mouseovers/ 559 B
751 B 239ms
223ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/home.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

eb6bed8efafdc53a3c9b83d2e304419557c82e244b3b8e0448ee13ec4ac8b24f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-22f"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 559
x-xss-protection: 1; mode=block

GET
H2 200 state.mny.rollo.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 239ms
223ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/state.mny.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

396ca7f0dc5bc00a42de219e42e23267e49b5c22f84decccaeb717b84497b146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-442"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1090
x-xss-protection: 1; mode=block

GET
H2 200 fed.mny.rollo.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 239ms
224ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fed.mny.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

3b8886cb966a435c04bc978344dc4509d9eb1882b6b59d7a36b161163c2befc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-4a3"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1187
x-xss-protection: 1; mode=block

GET
H2 200 private.mny.rollo.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 239ms
224ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/private.mny.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

6f62a5aeb2c0209a6e4572098e112e00ce17c5f434de670e753388886804ffcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-660"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1632
x-xss-protection: 1; mode=block

GET
H2 200 low.cc.rollo.gif
www.educationmoney.com/mouseovers/ 1 KB
2 KB 255ms
240ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/low.cc.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

1b862a2ccbdafde414ca637050b73ab11f0a98c3572f890c0f84127846d517f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-565"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1381
x-xss-protection: 1; mode=block

GET
H2 200 edu.store.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
2 KB 260ms
245ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/edu.store.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

a517663dd344f46e553c1c881ee6b2b0cfb16541238b12cca5510c4ffe38e4f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-593"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1427
x-xss-protection: 1; mode=block

GET
H2 200 edu.store.rollo.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 260ms
246ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/edu.store.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

fc271185d48164cc6a67d2e55037fc22c2d5c65437f2a3e0e362b51e47099d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-773"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1907
x-xss-protection: 1; mode=block

GET
H2 404 site.search.gif
www.educationmoney.com/ 25 B
25 B 264ms
250ms Image
text/html 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.educationmoney.com/site.search.gif
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 404 site.search.grn.gif
www.educationmoney.com/ 25 B
25 B 264ms
250ms Image
text/html 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.educationmoney.com/site.search.grn.gif
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 404 site.search.red.gif
www.educationmoney.com/ 25 B
25 B 264ms
251ms Image
text/html 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.educationmoney.com/site.search.red.gif
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 fafsa_lght.blu.gif
www.educationmoney.com/mouseovers/ 8 KB
8 KB 259ms
246ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8497625687f46314eb285ba0f713e79b03056ad26e17b3edd7be97f29ad7397b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2115"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 8469
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_lght.blu2.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 260ms
247ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.blu2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

cfb757fb5c0e5e55aafab2aa9a594ee667086b03cbbf6f33dafc3541843ea34b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-292e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10542
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_red.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 260ms
247ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_red.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

975d333fe6a57fff1e0875a64b30e0697c13c159a6609972209bb2ae264c0349

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-28a7"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10407
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_red2.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 260ms
247ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_red2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

ba22d8ee62e97778c8f91bd8c598092ac232cc6b71fe65f7f1dc7ad5fe9ef079

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-265e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 9822
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_red3.gif
www.educationmoney.com/mouseovers/ 9 KB
9 KB 260ms
248ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_red3.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

4d7bedaacd206864014c516e46f0a43e83eb0c2df67f4e29f965398bb43dc383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-249d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 9373
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_grn.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 260ms
248ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_grn.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8b6a66805f21df2ad98b78a86e55ff06b295b0cfb3472196c8817edcd4c07da6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2692"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 9874
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_lght.grn.gif
www.educationmoney.com/mouseovers/ 10 KB
11 KB 260ms
248ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.grn.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

13842c351abcc3de5eafbf9b334afe1dde5ecfb9e3cc99d947bd06117af75ffc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-29b8"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10680
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_grn2.gif
www.educationmoney.com/mouseovers/ 11 KB
11 KB 260ms
249ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_grn2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

e95053b46c1a265698f234740eeb15e8866d8861207d1dd5477dea9f18c07fb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2aaf"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10927
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_lght.grn2.gif
www.educationmoney.com/mouseovers/ 10 KB
11 KB 259ms
249ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.grn2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

1728900dc776f9294dcb18eb8134bcc76b01e254ee5bf7787aedb0600ba8c768

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-29cd"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10701
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_xmas.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 259ms
249ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_xmas.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

3ea373e48512da0b7e630f00010bd25678b227c5a8ab3f63d521982beb4434f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2855"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10325
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_xmas2.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 259ms
249ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_xmas2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

77c1f2a9b939c40689d8ee0e8a75be3a426c9341148251a18e1f5a4d62070781

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-285f"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10335
x-xss-protection: 1; mode=block

GET
H2 200 help.undstnd.gif
www.educationmoney.com/mouseovers/ 3 KB
4 KB 259ms
250ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/help.undstnd.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8570444d2e7c1cc2987f60d037acbcc97c7880e46c506af990083ac0114f6c6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-d40"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3392
x-xss-protection: 1; mode=block

GET
H2 200 help.undstnd2.gif
www.educationmoney.com/mouseovers/ 3 KB
3 KB 259ms
250ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/help.undstnd2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

10134df69ad2394f6374d310f19bb368937289afeb6e81c73ac2268a6f6dd4e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-c94"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3220
x-xss-protection: 1; mode=block

GET
H2 200 wrte.fedprpsl.gif
www.educationmoney.com/mouseovers/ 4 KB
4 KB 260ms
251ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/wrte.fedprpsl.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

894762fd1d25c68a85c57d69af7e567456d50188a41a729cb3f066c398cb339c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-e7e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3710
x-xss-protection: 1; mode=block

GET
H2 200 wrte.fedprpsl2.gif
www.educationmoney.com/mouseovers/ 3 KB
3 KB 260ms
251ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/wrte.fedprpsl2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

adf4fb6407c8b87973b5192907086d7c20d550747cdbdefa8948614107701172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-d2d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3373
x-xss-protection: 1; mode=block

GET
H2 200 contact_info.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 260ms
252ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/contact_info.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

cce1b1c09bc6bd319b474f4a09df3f00d1793fe32dd150723aa1b420314a5a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-72d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1837
x-xss-protection: 1; mode=block

GET
H2 200 contact_info.rollo.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 260ms
252ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/contact_info.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

0edefdbb2d9960f296b516b9217645a1c71416db3052c4c458d3c6526ef11f87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-6d8"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1752
x-xss-protection: 1; mode=block

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 35ms
10ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5e2d9e8e6e7c1c69f4a024f59113b4b8193dd7e388fffce4a3fbafe679fa84bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: tzv/mlUW9cSoj+FTKjYmyQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: UyiOQJPPJPhm+RYdajiN9ZUSQg3ce8oLK8AYZA7IE9O8Ivusefh94pUC85ReHi2lRbudtn8XBSZTYbImtS6Riw==
x-fb-trip-id: 917726464
x-fb-content-md5: 55a7a4e97c387bf47d053515f10a7b9f
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 02 Jul 2022 22:45:39 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "d3bf1fce67dddf7ac0777bd16a41e67b"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 02 Jul 2022 23:05:34 GMT

GET
H2 200 saturday.jpg
www.educationmoney.com/ 14 KB
14 KB 250ms
250ms Image
image/jpeg 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/saturday.jpg

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

3923f9aa6c70bdf15232597fbd0dca746565bea064b1f7cd71a8cba183106d6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-37e5"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
accept-ranges: bytes
content-length: 14309
x-xss-protection: 1; mode=block

GET
H2 200 U45lizyqIic Show response
www.youtube.com/embed/ Frame 5076 62 KB
27 KB 93ms
54ms Document
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/U45lizyqIic

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

04ba8b12eb0b48629dd7b81601330fdb6296e24bd3158656eebf176cb38f1317

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
date: Sat, 02 Jul 2022 22:45:39 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 counter.js Show response
secure.statcounter.com/counter/ 42 KB
14 KB 44ms
16ms Script
application/javascript 104.20.228.67
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.statcounter.com/counter/counter.js
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.228.67 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0bd9bfaf4def6656a9233d93df518c01be681326e72cd9e00aa73fd29702b83

Request headers

Referer: https://www.educationmoney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 01 Jul 2022 14:55:34 GMT
server: cloudflare
age: 1437
etag: W/"62bf0ae6-a7ae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 724ae9b78eeb993f-FRA
expires: Sun, 03 Jul 2022 10:21:42 GMT

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 297 KB
84 KB 19ms
8ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=ef6cf2e95893acb3422d214e6fa5c8fe

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

da204463cc41a2a31008c394e4c63016c5fb782da2de35eb612485f2b0f050b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.educationmoney.com/
Origin: https://www.educationmoney.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: tXdbR7Ts56+VBWi0nAp8gg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85938
x-fb-rlafr: 0
x-fb-debug: IW6hnK6npT0OK+uAYE6uumdGUz3PFNWKDdZEnVhImrDqZOkOK/RxUXfP/KT9nuwI9BNewlcD5XnTUOPESkiasg==
x-fb-content-md5: 08a34f6fb66f56372a0b2fe6467d44df
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 02 Jul 2022 22:45:39 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "06f7a99135b177eb573815b18e7bdc78"
timing-allow-origin: *
priority: u=3,i
expires: Sun, 02 Jul 2023 22:03:58 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/ 339 KB
119 KB 55ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8258884324894592&plah=www.educationmoney.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ff8d031e894322b1708346eea1b94a8df8f0f0a3adbe2b4cbe490e37f3d4dc31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122217
x-xss-protection: 0
server: cafe
etag: 2873140954086901074
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 02 Jul 2022 22:45:39 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220629/r20190131/ Frame 58BE 10 KB
5 KB 31ms
7ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220629/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24189
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Jul 2022 16:02:30 GMT
etag: 10429905676100781186
expires: Sat, 16 Jul 2022 16:02:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 t.php Show response
c.statcounter.com/ 192 B
576 B 152ms
142ms XHR
application/json 104.20.228.67
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.statcounter.com/t.php?sc_project=11275568&u1=C05C6FDECF914FA83B3BAEF6597CAFE4&java=1&security=317a7536&sc_snum=1&sess=5e022a&p=0&rcat=d&rdom=d&rdomg=new&bb=1&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=https%3A//www.educationmoney.com/&t=An%20Insider%27s%20Guide%20to%20Outsmarting%20College%20Costs%20and%20Getting%20Free%20Scholarships%20and%20Grants!&invisible=1&sc_rum_e_s=834&sc_rum_e_e=839&sc_rum_f_s=0&sc_rum_f_e=802&get_config=true
Requested by: Host: secure.statcounter.com
URL: https://secure.statcounter.com/counter/counter.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.228.67 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 724ae9b7ef3f993f-FRA
p3p: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
access-control-allow-origin: https://www.educationmoney.com
access-control-allow-credentials: true
content-type: application/json
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 www-player.css
www.youtube.com/s/player/0e7373c2/ Frame 5076 339 KB
47 KB 25ms
9ms Stylesheet
text/css 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0e7373c2/www-player.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11148ace6157cd94751922d3c17557609a94b6c2a56ebbf7efcfe1eefba2f27a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 21:14:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5453
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47687
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 00:22:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 02 Jul 2023 21:14:46 GMT

GET
H3 200 www-embed-player.js Show response
www.youtube.com/s/player/0e7373c2/www-embed-player.vflset/ Frame 5076 302 KB
93 KB 38ms
21ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0e7373c2/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70a64c9912aae092f9cc15fd4015d474e13b9a08b018c0e761ee183cae873bfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 21:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4762
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95369
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 00:22:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 02 Jul 2023 21:26:17 GMT

GET
H3 200 base.js Show response
www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/ Frame 5076 2 MB
556 KB 39ms
22ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16bd75e506b6109e4f50ea8e0b221b1c405be69c0073700247ce7a780e545c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 02:24:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 159672
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 569701
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 00:22:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sat, 01 Jul 2023 02:24:27 GMT

GET
H3 200 fetch-polyfill.js Show response
www.youtube.com/s/player/0e7373c2/fetch-polyfill.vflset/ Frame 5076 9 KB
3 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0e7373c2/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 07:55:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53409
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2786
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 00:22:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 02 Jul 2023 07:55:30 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5076 15 KB
16 KB 36ms
7ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 17:06:41 GMT
x-content-type-options: nosniff
age: 365938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 28 Jun 2023 17:06:41 GMT

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 9D83 0
3 KB 59ms
27ms Document
text/html 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df360a3a86bc6404%26domain%3Dwww.educationmoney.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.educationmoney.com%252Ff11ffdd6e68a904%26relation%3Dparent.parent&container_width=462&href=https%3A%2F%2Fwww.educationmoney.com%2F&locale=ru_RU&sdk=joey&send=false&show_faces=false&width=450

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ef6cf2e95893acb3422d214e6fa5c8fe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 02 Jul 2022 22:45:39 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=3,i
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: K6S4QKaXH4ypZJ+I02DL7ZEAyltqxNPIwVkI3kU2UxSvQzWQyOL8aMK6FCCQUS3b0H1Ffy/CTPXHePrCl+o7NQ==
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 222 B
653 B 59ms
15ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.educationmoney.com&callback=_gfp_s_&client=ca-pub-8258884324894592

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8258884324894592&plah=www.educationmoney.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e854c25eaa09baaba9fd9f459ae58055945c249d571489462b190fbfb45a7176

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 209
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 41ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 42ms
17ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E7B0 225 KB
60 KB 559ms
542ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&adk=1812271804&adf=3025194257&lmt=1613484948&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.educationmoney.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801939148&bpp=3&bdt=199&idt=97&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2078575847748&frm=20&pv=2&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=115

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a8b0dfedd379d2170d654d193bf09ed9f97f7bb4330ba8891c69b070e131535

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 61357
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Jul 2022 22:45:39 GMT
expires: Sat, 02 Jul 2022 22:45:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame 5076
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

100 B
146 B

15ms
14ms

XHR
application/json

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f77cf9eb949ec051ac9360bb364f3fc659eb77dfda2e622356076cefe97e3c07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame 5076 29 B
588 B 51ms
8ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:39:29 GMT
x-content-type-options: nosniff
age: 370
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Jul 2022 22:54:29 GMT

OPTIONS
H2 200 Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 63ms
15ms Preflight
text/html 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Sat, 02 Jul 2022 22:45:39 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 Create Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 5076 63 KB
29 KB 38ms
22ms XHR
application/json+protobuf 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b594003d6d6015ab52949800e14c2436aca8b60c9d43818c35778025ddb1bd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 30013
x-xss-protection: 0

GET
H3 200 remote.js Show response
www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/ Frame 5076 119 KB
37 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7cc06a08320a714a331f843708a667aa53ac4962e45cc89a1ac7e02d8e59753

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 02:24:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 159671
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37799
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 00:22:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sat, 01 Jul 2023 02:24:28 GMT

GET
H2 200 Fyy9NKOEZUovEf5L4E9U-uUwP892TWsRqtk1FTh3Py4.js Show response
www.google.com/js/th/ Frame 5076 36 KB
14 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:800::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/Fyy9NKOEZUovEf5L4E9U-uUwP892TWsRqtk1FTh3Py4.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

172cbd34a384654a2f11fe4be04f54fae5303fcf764d6b11aad9351538773f2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 09:11:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48850
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13846
x-xss-protection: 0
last-modified: Tue, 21 Jun 2022 16:30:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 02 Jul 2023 09:11:29 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/ Frame 5076 27 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

133a0196abac3c595767baee508cd6d237e432c7b2ff39b4f5a7aa47d93ef6fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 02:24:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 159662
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8109
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 00:22:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sat, 01 Jul 2023 02:24:37 GMT

GET
DATA 200
OK truncated
/ Frame 5076 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 AKedOLRI9aRExOV6rupkeb_DzRKGVQi4LFp3IrlQj9V7WA=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 5076 2 KB
3 KB 59ms
21ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AKedOLRI9aRExOV6rupkeb_DzRKGVQi4LFp3IrlQj9V7WA=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b3da98f42adfeb19d9c8fb50881c70c0969317d30e33fc7f2f643952ee7d929b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2378
x-xss-protection: 0
server: fife
etag: "v8c"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 25 Jun 2022 15:16:22 GMT

GET
H2 200 default.webp
i.ytimg.com/vi_webp/U45lizyqIic/ Frame 5076 2 KB
2 KB 86ms
57ms Image
image/webp 2a00:1450:4001:800::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi_webp/U45lizyqIic/default.webp

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

444bec6366aeb81167594870416b55b59036c9152d9f4e2c2ddd1a22ff191713

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
x-content-type-options: nosniff
server: sffe
etag: "1443621475"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/webp
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1734
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 03 Jul 2022 00:45:39 GMT

GET
H3 204 generate_204
www.youtube.com/ Frame 5076 0
9 B 7ms
7ms Image
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?k5rEQw
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 5076 4 KB
3 KB 40ms
16ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 22:45:39 GMT

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/103/ Frame 5076 52 KB
15 KB 23ms
7ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/103/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b04181139e0ce3b79b3fa9095394070d16ab4a1b6bb8419c4d523c05712b3a95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 10:15:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45004
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15123
x-xss-protection: 0
last-modified: Mon, 02 May 2022 15:04:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Sun, 03 Jul 2022 10:15:35 GMT

POST
H3 200 GenerateIT Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 5076 98 B
142 B 19ms
18ms XHR
application/json+protobuf 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f1490b6a728d735e886193d2e6a89e3dbd2beea480f79425f23c59f63f01b6ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Sat, 02 Jul 2022 22:45:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 118
x-xss-protection: 0

OPTIONS
H3 200 GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 14ms
14ms Preflight
text/html 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Sat, 02 Jul 2022 22:45:39 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/ 149 KB
53 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a598965c04cee1855a2ef8079ed6c435bc7ee1a80d5a7562c0c0a1d6f7784469

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54415
x-xss-protection: 0
server: cafe
etag: 15382179997954943777
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 35ms
18ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 33ms
17ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B419 132 KB
43 KB 484ms
483ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801940101&bpp=2&bdt=1151&idt=2&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db4e0395403f3e1c3-221410e0c4cd0011%3AT%3D1656801939%3ART%3D1656801939%3AS%3DALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw&prev_fmts=0x0&nras=2&correlator=2078575847748&frm=20&pv=1&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qLzMzHQ6hr&p=https%3A//www.educationmoney.com&dtd=12

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5c759d018e2b925ce55d8dd6d73a396ce705075ef9fb0715e7cd134507393d5b

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMSu7Jik2_gCFQiVGAod8qsD-A&gqi=lMrAYrTHB5WQrASq2aTwBg&layout=/sadbundle/%24csp%253Der3%24/3081134375928665192/300x250.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 44336
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMSu7Jik2_gCFQiVGAod8qsD-A&gqi=lMrAYrTHB5WQrASq2aTwBg&layout=/sadbundle/%24csp%253Der3%24/3081134375928665192/300x250.html
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Jul 2022 22:45:40 GMT
expires: Sat, 02 Jul 2022 22:45:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/ Frame 14D9 10 KB
4 KB 8ms
8ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 19838
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Jul 2022 17:15:02 GMT
etag: 10429905676100781186
expires: Sat, 16 Jul 2022 17:15:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/ Frame 574C 10 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 19838
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Jul 2022 17:15:02 GMT
etag: 10429905676100781186
expires: Sat, 16 Jul 2022 17:15:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 14D9 4 KB
1 KB 41ms
17ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 02 Jul 2022 22:09:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 02 Jul 2022 22:45:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 14D9 205 B
229 B 8ms
8ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:38:40 GMT
x-content-type-options: nosniff
age: 420
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 02 Jul 2023 22:38:40 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 14D9 604 B
628 B 9ms
8ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 21:09:17 GMT
x-content-type-options: nosniff
age: 5783
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 02 Jul 2023 21:09:17 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/ Frame 14D9 19 KB
8 KB 38ms
15ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae2e1dc0161fa05e80b225682868a9bfbab08c503b2429f06339d4487f160ac2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 21:36:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4129
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8263
x-xss-protection: 0
server: cafe
etag: 17157773748623750166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 21:36:51 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 574C 0
0 55ms
55ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C6uG3k8rAYr2ZEoHE3gPJ263oDomP5elomJnjuLEP2tkeEAEgy-bGP2CVuomCmAegAemfpsgDyAECqQJNlg0hW36xPqgDAcgDyQSqBIoCT9CBw7HZ-3V9z7oL6hm-okkoG-Ahsk0UmdfzmPHuFwj3bQlcrxt7IpBgDY_WtTmfy74T_0xd1fcWGaCeUfbVzvpQpV9aqBaPlR8GlitV6jxosRT-OkLhoAxYOT9Skf9hXPoroYrRR9KkD43OBc_sFx6COh6a4ywfwGaMTF7_Y0JUdQVOw72_iZw6YnSfYVn8zJbbOBbgAXbfW75zcr9uB_tZJkpBCO3qNet35vWCEnI6a-dpmIumt1S-jK6812ZwUn2tl-9GmI3CYwwJw2lKiLKAA6fvfjmTf_ZhrFq_f0ehVXWqhqTlD7oGP15F79Gmenzp2tO-qsNi6Tq70FXaxNFKvlSXHE-fLPfABPTo_MzpA5IFBAgEGAGSBQQIBRgEoAYCgAf_39k3qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwUQjfroA9IIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTgyNTg4ODQzMjQ4OTQ1OTIYAA&sigh=4ErCeu4SxF0&uach_m=[UACH]

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Jul 2022 22:45:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/ Frame 574C 21 KB
9 KB 26ms
9ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:40:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 295
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:40:45 GMT

GET
H2 200 11394368318563599047
tpc.googlesyndication.com/simgad/ Frame 574C 17 KB
17 KB 33ms
16ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11394368318563599047?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm3weKm812gqdRdQJoTt4rJJ_vMqA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

962be9f7a5207f8b086c4423b3a4ffcb1e7d93201b0db4a69a5689630eac1657

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 26 Jun 2022 08:57:29 GMT
x-content-type-options: nosniff
age: 568091
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17285
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 14:39:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 26 Jun 2023 08:57:29 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 574C 3 KB
1 KB 26ms
10ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:24:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1269
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:24:31 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 574C 17 KB
8 KB 23ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:09:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2174
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:09:26 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 574C 138 KB
43 KB 47ms
20ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 574C 31 KB
13 KB 26ms
10ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9085e1f699b839818a039641053e183e0b22407d6bfaef8d5a3866ec42d682b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:07:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12985
x-xss-protection: 0
server: cafe
etag: 7466239315051897255
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:07:59 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B2DC 143 B
163 B 10ms
8ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3292
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Sat, 02 Jul 2022 21:50:48 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 5F26 8 KB
893 B 33ms
17ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 02 Jul 2022 21:37:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 02 Jul 2022 22:45:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 5F26 2 KB
902 B 28ms
10ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:36:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 559
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:36:21 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/ Frame 5F26 21 KB
8 KB 26ms
9ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:33:27 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 5F26 3 KB
1 KB 24ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:09:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:09:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 5F26 17 KB
7 KB 24ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:09:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2174
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:09:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5F26 138 KB
42 KB 36ms
18ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H3 200 21b2dfe42abab24529e209ac1efa07c6.js Show response
www.gstatic.com/mysidia/ Frame 5F26 31 KB
13 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/21b2dfe42abab24529e209ac1efa07c6.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b97d2c98f8bac4ee72d075d577db22903f83ae9a2742b9caef94f0842b459348

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 15:47:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 111467
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13060
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 20:43:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 29 Sep 2022 15:47:53 GMT

GET
DATA 200
OK truncated
/ Frame 574C 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 868fe06c84104fd6f3699b93463ab375e35d9fb6ff55569abca4144cc234207c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B2DC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

58ms
58ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 02 Jul 2022 22:45:40 GMT
expires: Sat, 02 Jul 2022 22:45:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 02 Jul 2022 22:45:40 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js Show response
pagead2.googlesyndication.com/bg/ Frame FDCE 36 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79db9ed714dce58ba264e8498b854803f736d027ad66de53f72ed0ddc367ad30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 07:04:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142869
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13936
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 01 Jul 2023 07:04:31 GMT

GET
H3 200 edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js Show response
pagead2.googlesyndication.com/bg/ Frame 2AF3 36 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79db9ed714dce58ba264e8498b854803f736d027ad66de53f72ed0ddc367ad30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 07:04:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142869
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13936
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 01 Jul 2023 07:04:31 GMT

GET
H3 200 300x250.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/ Frame 04E0 2 KB
1 KB 8ms
8ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

665fb53d688433850297e329f934226168a77843d9494ef2a8b335905e7ee915

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 261839
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1166
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Jun 2022 22:01:41 GMT
expires: Thu, 29 Jun 2023 22:01:41 GMT
last-modified: Thu, 17 Jun 2021 15:17:16 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3

200

B25991098.306365351;dc_pre=CIGgjZmk2_gCFQGXewodVp4K0Q;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= Show response
ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/ Frame C3C6
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B25991098.306365351;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfu...
https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B25991098.306365351;dc_pre=CIGgjZmk2_gCFQGXewodVp4K0Q;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag...

42 B
63 B

43ms
26ms

Fetch
image/gif

142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B25991098.306365351;dc_pre=CIGgjZmk2_gCFQGXewodVp4K0Q;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801940101&bpp=2&bdt=1151&idt=2&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db4e0395403f3e1c3-221410e0c4cd0011%3AT%3D1656801939%3ART%3D1656801939%3AS%3DALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw&prev_fmts=0x0&nras=2&correlator=2078575847748&frm=20&pv=1&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qLzMzHQ6hr&p=https%3A//www.educationmoney.com&dtd=12

Protocol

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Jul 2022 22:45:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Jul 2022 22:45:40 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B25991098.306365351;dc_pre=CIGgjZmk2_gCFQGXewodVp4K0Q;dc_trk_aid=498955199;dc_trk_cid=152931923;ord=3814745585;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C3C6 0
0 53ms
52ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CdkxtlMrAYsSUCYiqYvLXjsAPmNu9_2mHgebmyQ6SvJHimyQQASDL5sY_YJW6iYKYB6AB9Li_xQPIAQmoAwHIA0iqBPwBT9Cml1q1m1MEZLYGNAyPyRyO0YT8X6DVyxwEmxwLfsTbOGtISgkTJ2gpnq4Lse7VJTyuv92O-78_r4tiRkc78czwWNm6rcb7c0rf1pcx_8HSA5jekbQ6I0aWhSRBq2L4sG6fE18NofKBPVjRWQVmga1Ifos3AXFHJg9b4-ZFWMt5ovGrskJUcpukMSWCgC8lLETkR1_eprxkrVtj0KFPlbROlqKUC84BEwox909KN_7-NhjnAlF_bYYOGroq31uHEf1Wrti58GC4BezwUKN7Pbb3eVhV6eQ9R1nt7e1DfUqWM8hN1ZNOeJ4CzDWVn5gHk3H41ZJTYf2au_mtwATpyqKJkQOSBQQIBBgBkgUECAUYBKAGLoAH7KGopgGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBRDoiJcB0ggRCIDhgBAQARgfMgKqAjoCgECACgHICwGiDAgqBgoEz6exAtgTDdAVAYAXAbIXHAoaCAASFHB1Yi04MjU4ODg0MzI0ODk0NTkyGAA&sigh=7wWZh-neLNo&uach_m=[UACH]&template_id=419

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801940101&bpp=2&bdt=1151&idt=2&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db4e0395403f3e1c3-221410e0c4cd0011%3AT%3D1656801939%3ART%3D1656801939%3AS%3DALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw&prev_fmts=0x0&nras=2&correlator=2078575847748&frm=20&pv=1&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qLzMzHQ6hr&p=https%3A//www.educationmoney.com&dtd=12
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Jul 2022 22:45:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/ Frame C3C6 21 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:33:27 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame C3C6 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:09:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:09:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C3C6 138 KB
42 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame C3C6 17 KB
7 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:09:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2174
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Jul 2022 22:09:26 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 04E0 9 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 09:36:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47366
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 03 Jul 2022 09:36:14 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 04E0 26 KB
10 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 16:13:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23518
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 03 Jul 2022 16:13:42 GMT

GET
H2 200 createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 04E0 186 KB
49 KB 64ms
17ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49100
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H3 200 300x250.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/ Frame 04E0 145 KB
31 KB 9ms
9ms Script
application/x-javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3081134375928665192/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63116d2390694db6f928c3e3e827fe7f7307ecfb47e237b8ca50a9034cc92eed

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 261838
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31895
x-xss-protection: 0
last-modified: Thu, 17 Jun 2021 15:17:16 GMT
server: sffe
date: Wed, 29 Jun 2022 22:01:42 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 29 Jun 2023 22:01:42 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C055 143 B
163 B 7ms
7ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801940101&bpp=2&bdt=1151&idt=2&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db4e0395403f3e1c3-221410e0c4cd0011%3AT%3D1656801939%3ART%3D1656801939%3AS%3DALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw&prev_fmts=0x0&nras=2&correlator=2078575847748&frm=20&pv=1&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qLzMzHQ6hr&p=https%3A//www.educationmoney.com&dtd=12
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3292
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Sat, 02 Jul 2022 21:50:48 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame C3C6 0
20 B 57ms
41ms Other
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMSu7Jik2_gCFQiVGAod8qsD-A&gqi=lMrAYrTHB5WQrASq2aTwBg&layout=/sadbundle/%24csp%253Der3%24/3081134375928665192/300x250.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Sat, 02 Jul 2022 22:45:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame C3C6 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c76de2ea6452855c3e443e755f69540af0f59fb5b919da0a86256989ae32f0f7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C055
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

60ms
59ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 02 Jul 2022 22:45:40 GMT
expires: Sat, 02 Jul 2022 22:45:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 02 Jul 2022 22:45:40 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js Show response
pagead2.googlesyndication.com/bg/ Frame 04E0 36 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79db9ed714dce58ba264e8498b854803f736d027ad66de53f72ed0ddc367ad30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 07:04:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142869
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13936
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 01 Jul 2023 07:04:31 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 22ms
22ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220629&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4506e59f2a78df74f392712f4c3e383e766617e1568c9babcca2f46b289df59a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10587
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 22:45:40 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 866A 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 17503
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Jul 2022 17:53:57 GMT
expires: Sun, 02 Jul 2023 17:53:57 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 89F1 783 B
535 B 17ms
17ms Document
text/html 2a00:1450:4001:800::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e3b0be28d55848bdcc4bf625b431e73c39cf5c81e2aa1661691501ce9efcf142

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WSuVmUCBn2qfO2ZXkjIOSQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-WSuVmUCBn2qfO2ZXkjIOSQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 02 Jul 2022 22:45:40 GMT
expires: Sat, 02 Jul 2022 22:45:40 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js Show response
pagead2.googlesyndication.com/bg/ Frame 866A 36 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/edue1xTc5YuiZOhJi4VIA_c20CetZt5T9y7Q3cNnrTA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79db9ed714dce58ba264e8498b854803f736d027ad66de53f72ed0ddc367ad30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 01 Jul 2022 07:04:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142869
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13936
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 01 Jul 2023 07:04:31 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 89F1 0
0 48ms
47ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220629&jk=1740186431651568&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 866A 0
9 B 7ms
7ms Image
text/plain 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?V30NYA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 22:45:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 59ms
58ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220629&jk=1740186431651568&bg=!Dg2lDUnNAAaLlKKnq5Q7ACkAdvg8WoGPdqYxvKviraqQkANpXgNQJdfYSZMH8sT-xm0bLEWoqvg_MQIAAABKUgAAAAFoAQcKACDfR1lR9SkugbG7GNBeLaq-xln9gnml2Ow7HXIpQKbARZkCm4gZyAwUTn4EBgpGiiHbeOnz8lBoNRzrsDdFychQNVV4V5hkMpyReOkGcNva0yjm9AJ_5Yi7ZsXSkCHeos08DnOdDhazPLIlV-soxcpMM3rdTzV-sFp4M9gOk56sNxzunOVar21NlOQZ_lepSmTvrh2FORUx4wCn6MH1hMp07ic3aX4QVtkpGSVojkuGQoN9dAsacwKC1V-4ppG7k4xi4q2azWOUnYGUcI6mpyqcV5gO5GOGQpSL_F-YvIP-UfmT2Zz4YwzI86MKDxCP6x2msDEBRYAlWoWdzB54OIxZRSzsRNMj_OVWR4jSydh61lyYempEjPgX8U7mgJaAl546NAOrHvnYZMblwFKzmx2cE5-CDRad14SE5hD37WAkIOlBaU_bU7g8yeNG7j0jpF3uiFecrLnz7oC69P15jP0a2f9ZFd0gSJXp7sPqZoAAOEJ-mFzu7a9mlUj79rsUxi_iQwfxOj0kGLvNdZjSmNhNproZPtQrv7bf9P32gY1fzBiffof3xAp5zkgg9x8EN9u-iS_09y2of6E8ZkzfXgitHFISkDkUQC9Bxu00moz7Wyt292PW1U9PUzc7TQkVrqXH2AZUmUnnaIXwW_ZO9itlcMBzlAOUDoRd_mCtUCaO50dD3wAD9U_SLCrqz3RHonq18gWcXH8co8tSjh8ZbV2XXUAk6C78SpBaFLPEaB8wNJEUt4gNZLylZtd2D8RVl8JK6kGRpTDehnEo0G5PvQk8kWALvgPIMBt9OCXNzf26nu0zGH7HRIqJcL49jkW8Z2wTFZAGnL3EngtayQ5I0PYA9bxN_MxF2nY-A3b-cqSvr1q1bj_kuqXH8c2sVObE2Zuh-_RA6x49ZwZeaILOr4E1Z_IGRHUZwEO3ixurHTk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 574C 42 B
64 B 43ms
43ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsut1U9C0aDRgx_UmaF9KagIqu1fHf7ggpKpGIZgT04VzdWAbEkDTYtatgWBJD1pTM1RHRy5pBCYJOnrj3EDtFpvpttfglYPv2-dn90nzsjWRzoJYJZ37lXLadco3IEgNmOLctUbcA&sai=AMfl-YQ1BwqVygniNebZP3ctqCytEa4ASOOFFDtIR2bKVWW9pfOf3V0hj2nXBcu5FTprYt5D8DkLs0iPOVfY&sig=Cg0ArKJSzIMu7e8Z4CkeEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=83,767,1000,1080,1254&tos=83,684,233,80,174&v=20220627&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1656801940147&rpt=132&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Jul 2022 22:45:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame 5076 28 B
54 B 21ms
21ms XHR
application/json 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0e7373c2/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/U45lizyqIic
X-YouTube-Client-Version: 1.20220629.01.00
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgtSV2xYcF9FNjZiVSiTlYOWBg%3D%3D
X-YouTube-Ad-Signals: dt=1656801939369&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C230%2C173&vis=1&wgl=true&ca_type=image

Response headers

date: Sat, 02 Jul 2022 22:45:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Sat, 02 Jul 2022 22:45:41 GMT

Verdicts & Comments Add Verdict or Comment

91 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: MJz3LcAU2qc
.youtube.com/	1970-01-20 08:32:33	Name: VISITOR_INFO1_LIVE Value: RWlXp_E66bU
.educationmoney.com/	1970-01-20 21:44:33	Name: sc_is_visitor_unique Value: rx11275568.1656801939.C05C6FDECF914FA83B3BAEF6597CAFE4.1.1.1.1.1.1.1.1.1
.educationmoney.com/	1970-01-20 13:34:57	Name: __gads Value: ID=b4e0395403f3e1c3-221410e0c4cd0011:T=1656801939:RT=1656801939:S=ALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw
.statcounter.com/	1970-01-22 00:01:07	Name: is_unique Value: sc11275568.1656801939.0
.statcounter.com/	1970-01-20 21:44:19	Name: is_visitor_unique Value: 1656801939156930445
.doubleclick.net/	1970-01-20 04:13:25	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 13:34:57	Name: IDE Value: AHWqTUlEU2Q4eDjRTZcVSVOOJ-Ft4KA-eIjzh87UBIs-kxQaM1G6UcEHwsoELj-KVPE

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.educationmoney.com/(Line 822) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://secure.statcounter.com/counter/counter.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.educationmoney.com/(Line 822) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://secure.statcounter.com/counter/counter.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://www.educationmoney.com/site.search.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.educationmoney.com/site.search.grn.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.educationmoney.com/site.search.red.gif Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801940101&bpp=2&bdt=1151&idt=2&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db4e0395403f3e1c3-221410e0c4cd0011%3AT%3D1656801939%3ART%3D1656801939%3AS%3DALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw&prev_fmts=0x0&nras=2&correlator=2078575847748&frm=20&pv=1&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qLzMzHQ6hr&p=https%3A//www.educationmoney.com&dtd=12 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/3081134375928665192/300x250.html".
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656801940101&bpp=2&bdt=1151&idt=2&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db4e0395403f3e1c3-221410e0c4cd0011%3AT%3D1656801939%3ART%3D1656801939%3AS%3DALNI_MakU8WbWJBE2Z1qZ65076mn2Uj_Kw&prev_fmts=0x0&nras=2&correlator=2078575847748&frm=20&pv=1&ga_vid=730198943.1656801939&ga_sid=1656801939&ga_hid=1905906573&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44766559%2C42531608&oid=2&pvsid=1740186431651568&tmod=633881194&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qLzMzHQ6hr&p=https%3A//www.educationmoney.com&dtd=12 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/3081134375928665192/300x250.html".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.com
adservice.google.de
c.statcounter.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.ytimg.com
jnn-pa.googleapis.com
pagead2.googlesyndication.com
partner.googleadservices.com
s0.2mdn.net
secure.statcounter.com
static.doubleclick.net
tpc.googlesyndication.com
www.educationmoney.com
www.facebook.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
104.20.228.67
142.250.186.102
172.217.18.2
2600:3c03::f03c:92ff:fe05:debc
2a00:1450:4001:800::2004
2a00:1450:4001:800::2016
2a00:1450:4001:802::2002
2a00:1450:4001:806::200a
2a00:1450:4001:80b::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::200a
2a00:1450:4001:811::2001
2a00:1450:4001:812::2006
2a00:1450:4001:813::2002
2a00:1450:4001:813::2006
2a00:1450:4001:828::2001
2a00:1450:4001:829::2002
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2003
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
04ba8b12eb0b48629dd7b81601330fdb6296e24bd3158656eebf176cb38f1317
0a8b0dfedd379d2170d654d193bf09ed9f97f7bb4330ba8891c69b070e131535
0edefdbb2d9960f296b516b9217645a1c71416db3052c4c458d3c6526ef11f87
0fd5cf764972d1df9f1fb87a8bdd9e48787d890b2cb9661e55289923a6639e8d
10134df69ad2394f6374d310f19bb368937289afeb6e81c73ac2268a6f6dd4e4
11148ace6157cd94751922d3c17557609a94b6c2a56ebbf7efcfe1eefba2f27a
133a0196abac3c595767baee508cd6d237e432c7b2ff39b4f5a7aa47d93ef6fe
13842c351abcc3de5eafbf9b334afe1dde5ecfb9e3cc99d947bd06117af75ffc
16bd75e506b6109e4f50ea8e0b221b1c405be69c0073700247ce7a780e545c9c
1728900dc776f9294dcb18eb8134bcc76b01e254ee5bf7787aedb0600ba8c768
172cbd34a384654a2f11fe4be04f54fae5303fcf764d6b11aad9351538773f2e
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1b862a2ccbdafde414ca637050b73ab11f0a98c3572f890c0f84127846d517f7
1cd57716e44061e27878c07dbf5c3711aa08f97f0d03a3814a6439297ea72c7d
203b18a2629a2ef035deb07d8c9e51424ca98f9315543e4acce3f08361c9ac76
2380ad2259685cc9eaff048bfb6d79f5648b772e30f204d4427e42df680f0268
29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb
2bb40a4ce957c08c50ab1ca4e0cdbf1572a6c368971e05d628c2193b29f35487
2c4980aefdce4dd6696edffc695f48187ce84a685af9be8cdd610111561a3283
3069145d2117549e354d7e0a91e16141790a3de5e1453fc0f0603588251e2a16
3923f9aa6c70bdf15232597fbd0dca746565bea064b1f7cd71a8cba183106d6f
396ca7f0dc5bc00a42de219e42e23267e49b5c22f84decccaeb717b84497b146
3b8886cb966a435c04bc978344dc4509d9eb1882b6b59d7a36b161163c2befc1
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3ea373e48512da0b7e630f00010bd25678b227c5a8ab3f63d521982beb4434f2
444bec6366aeb81167594870416b55b59036c9152d9f4e2c2ddd1a22ff191713
4506e59f2a78df74f392712f4c3e383e766617e1568c9babcca2f46b289df59a
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4d7bedaacd206864014c516e46f0a43e83eb0c2df67f4e29f965398bb43dc383
51bad96ab4260d466d16c758a6e88c08d6a5d3d153592c2b0212bac3d29b59d3
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c759d018e2b925ce55d8dd6d73a396ce705075ef9fb0715e7cd134507393d5b
5e2d9e8e6e7c1c69f4a024f59113b4b8193dd7e388fffce4a3fbafe679fa84bc
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63116d2390694db6f928c3e3e827fe7f7307ecfb47e237b8ca50a9034cc92eed
665fb53d688433850297e329f934226168a77843d9494ef2a8b335905e7ee915
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6b52d060a408513eeeb99563d13d1230a241fd18a7c9e3280ba644652d6ecec8
6da3b4e91f69d7289094f5e91fe7da56ec159fb61a26e9c05c7fa593b4eb76a1
6f62a5aeb2c0209a6e4572098e112e00ce17c5f434de670e753388886804ffcb
70a64c9912aae092f9cc15fd4015d474e13b9a08b018c0e761ee183cae873bfa
75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2
77c1f2a9b939c40689d8ee0e8a75be3a426c9341148251a18e1f5a4d62070781
79db9ed714dce58ba264e8498b854803f736d027ad66de53f72ed0ddc367ad30
819a7a475f6efb187a017babc236aeacd90fe602c4ce06c96f38d428ed67b3ad
8497625687f46314eb285ba0f713e79b03056ad26e17b3edd7be97f29ad7397b
84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30
8570444d2e7c1cc2987f60d037acbcc97c7880e46c506af990083ac0114f6c6f
868fe06c84104fd6f3699b93463ab375e35d9fb6ff55569abca4144cc234207c
894762fd1d25c68a85c57d69af7e567456d50188a41a729cb3f066c398cb339c
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8b6a66805f21df2ad98b78a86e55ff06b295b0cfb3472196c8817edcd4c07da6
8d2941546f89de0e1186029a4610caa720bd0c48783c8da44c4427e80112cc32
9085e1f699b839818a039641053e183e0b22407d6bfaef8d5a3866ec42d682b3
9594a2cd5ec38f47e385e1ee4a9eb2b50b15ea47c6f9d0c2cc695b3600393f82
962be9f7a5207f8b086c4423b3a4ffcb1e7d93201b0db4a69a5689630eac1657
975d333fe6a57fff1e0875a64b30e0697c13c159a6609972209bb2ae264c0349
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
9bd229de4fcf0740584ff821ab4a0ca438fdd3da94c34ccf31b76617aa70d0b5
a0bd9bfaf4def6656a9233d93df518c01be681326e72cd9e00aa73fd29702b83
a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a517663dd344f46e553c1c881ee6b2b0cfb16541238b12cca5510c4ffe38e4f8
a598965c04cee1855a2ef8079ed6c435bc7ee1a80d5a7562c0c0a1d6f7784469
a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc
adf4fb6407c8b87973b5192907086d7c20d550747cdbdefa8948614107701172
ae2e1dc0161fa05e80b225682868a9bfbab08c503b2429f06339d4487f160ac2
b04181139e0ce3b79b3fa9095394070d16ab4a1b6bb8419c4d523c05712b3a95
b3da98f42adfeb19d9c8fb50881c70c0969317d30e33fc7f2f643952ee7d929b
b4a584c3f5e03eeb8a22223ee5eaa8a8792573062da9dc58ba8bfc0675804eeb
b594003d6d6015ab52949800e14c2436aca8b60c9d43818c35778025ddb1bd45
b7cc06a08320a714a331f843708a667aa53ac4962e45cc89a1ac7e02d8e59753
b97d2c98f8bac4ee72d075d577db22903f83ae9a2742b9caef94f0842b459348
ba22d8ee62e97778c8f91bd8c598092ac232cc6b71fe65f7f1dc7ad5fe9ef079
bc0cc0e8efb7b2d2672900ebfde33fa1d7e1b6ef15e1bad166de8bf1289b592c
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c562ef70e7efe0e28cda98045bb466fe5ecee28ec8cd9cd53b4d515a1b0d48d4
c76de2ea6452855c3e443e755f69540af0f59fb5b919da0a86256989ae32f0f7
c7a9eedb197611dee3c7e4b95d2e0216741ba965ccf68fab86176ad405a177be
cce1b1c09bc6bd319b474f4a09df3f00d1793fe32dd150723aa1b420314a5a58
ce1e23eec62ea3c1b52e354a842e51ea07bedb24ee5ed6be100339dcdb1a9b22
cfb757fb5c0e5e55aafab2aa9a594ee667086b03cbbf6f33dafc3541843ea34b
d01c3e1094da8e50d8246859ef5cf0214734464c43e3ead4e4922d47661e9b95
d575fc14116b00adea0b06a786b3079d2fb3d7174804142b214d491e0afaa98a
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d6932842cb870f04e9e0069ff3bbd90b815679065bf754735e56a4893ec12c66
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
da204463cc41a2a31008c394e4c63016c5fb782da2de35eb612485f2b0f050b2
dcbebae72894d33bdf61d3110d1beabad6463ff6bf48b0ef5ab6e8602da1dd4a
e3b0be28d55848bdcc4bf625b431e73c39cf5c81e2aa1661691501ce9efcf142
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3be22d0d23fb10fdad928bdec027daf49e22f548a351b5cb703d710425656de
e844d9167fa2e6ff40c446e1e3563004d1bafe3026dbe4453d3878c9c9349a00
e854c25eaa09baaba9fd9f459ae58055945c249d571489462b190fbfb45a7176
e95053b46c1a265698f234740eeb15e8866d8861207d1dd5477dea9f18c07fb6
eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415
eb6bed8efafdc53a3c9b83d2e304419557c82e244b3b8e0448ee13ec4ac8b24f
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1490b6a728d735e886193d2e6a89e3dbd2beea480f79425f23c59f63f01b6ac
f43a2715c9ebde2ad7cf51d297378f038f1d04f42c58ae1a5046b186ea4335e8
f77cf9eb949ec051ac9360bb364f3fc659eb77dfda2e622356076cefe97e3c07
fc271185d48164cc6a67d2e55037fc22c2d5c65437f2a3e0e362b51e47099d47
ff8d031e894322b1708346eea1b94a8df8f0f0a3adbe2b4cbe490e37f3d4dc31

www.educationmoney.com Open in urlscan Pro 2600:3c03::f03c:92ff:fe05:debc Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

139 Requests

99 %HTTPS

86 %IPv6

16 Domains

23 Subdomains

23 IPs

3 Countries

1960 kBTransfer

5832 kBSize

8 Cookies

3 Outgoing links

Page URL History

Redirected requests

139 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.educationmoney.com Open in urlscan Pro
2600:3c03::f03c:92ff:fe05:debc Public Scan

Screenshot
Live screenshot

Full Image

139
Requests

99 %
HTTPS

86 %
IPv6

16
Domains

23
Subdomains

23
IPs

3
Countries

1960 kB
Transfer

5832 kB
Size

8
Cookies

139 HTTP transactions
3 data transactions