www.thespoof.com Open in urlscan Pro
185.24.73.192 Public Scan

Software

cafe /

Resource Hash

e65733735556bb227a5d938d4587fff57cd1947630423c6dcb61213f914c3df2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50943
x-xss-protection: 0
server: cafe
etag: 7427306087292280904
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 19 Oct 2021 08:43:57 GMT

GET
H2 200 2007101.bob.js Show response
d1kx0jsb8xwkwf.cloudfront.net/tss/js/ 834 B
970 B 16ms
10ms Script
application/javascript 143.204.101.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.bob.js
Requested by: Host: d1kx0jsb8xwkwf.cloudfront.net
URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.117 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-117.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: ae56fe9cb8bbae078f86502f3f9fbc76313d3c733055caac2b1c8a3faecd5db1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 07 Feb 2021 01:25:40 GMT
content-encoding: gzip
age: 21971897
x-cache: Hit from cloudfront
content-length: 500
access-control-allow-origin: https://www.thespoof.com
last-modified: Fri, 10 Jul 2020 16:33:16 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 9X_m0t_rncqt0FFRXBoyRbtvxSHsrbvN126b2gwrPjBdp_swFt2mWg==
expires: Mon, 07 Feb 2022 01:25:40 GMT

GET
H2 200 2003090.fonts.br.css
d1kx0jsb8xwkwf.cloudfront.net/tss/css/ 118 KB
90 KB 18ms
18ms Stylesheet
text/css 143.204.101.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/css/2003090.fonts.br.css
Requested by: Host: d1kx0jsb8xwkwf.cloudfront.net
URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.117 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-117.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 49735924a44ed8e5dccafa926c3b0bed27784e5a5eb698869900d21a33764c62

Request headers

Referer: https://www.thespoof.com/
Origin: https://www.thespoof.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 05:46:22 GMT
content-encoding: gzip
age: 22733855
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.thespoof.com
last-modified: Mon, 09 Mar 2020 10:29:09 GMT
server: Apache
vary: Accept-Encoding
content-language: br
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: text/css; charset=utf-8
x-amz-cf-id: Iiyzx0yAOXFxIVaJdGa8VVSWCEL2Kq_QwtlzZozzNP8-9pha9J2YHw==
expires: Sat, 29 Jan 2022 05:46:22 GMT

GET
H2 200 2007100.offload.css
d1kx0jsb8xwkwf.cloudfront.net/tss/css/ 5 KB
2 KB 14ms
14ms Stylesheet
text/css 143.204.101.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/css/2007100.offload.css
Requested by: Host: d1kx0jsb8xwkwf.cloudfront.net
URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.117 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-117.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 1cb2caef06c5c762f551f74aadd620867c757aa4559a30e472ea4301317bff3d

Request headers

Referer: https://www.thespoof.com/
Origin: https://www.thespoof.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 04:14:46 GMT
content-encoding: gzip
age: 21702551
x-cache: Hit from cloudfront
content-length: 2058
access-control-allow-origin: https://www.thespoof.com
last-modified: Fri, 10 Jul 2020 16:29:25 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: d-g1uGr828CgGuUAyrLY3T1JqUkmk9BNTL9HcKXAoF3bnnqHVX4AYw==
expires: Thu, 10 Feb 2022 04:14:46 GMT

GET
H2 200 190214.articlefooter.css
d1kx0jsb8xwkwf.cloudfront.net/tss/css/ 8 KB
2 KB 19ms
19ms Stylesheet
text/css 143.204.101.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/css/190214.articlefooter.css
Requested by: Host: d1kx0jsb8xwkwf.cloudfront.net
URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.117 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-117.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 0d277a3904f45353d05bd49f53cd00e1bfb5df1727c1658edff93169423ef139

Request headers

Referer: https://www.thespoof.com/
Origin: https://www.thespoof.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 07:46:10 GMT
content-encoding: gzip
age: 15555467
x-cache: Hit from cloudfront
content-length: 1478
access-control-allow-origin: https://www.thespoof.com
last-modified: Thu, 14 Feb 2019 17:32:27 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: CGwEprGPYnkwDQ2TOcN0NEkB9Z97JTATyL6Vlf2_h_y7fpqCKhORZQ==
expires: Fri, 22 Apr 2022 07:46:10 GMT

GET
H2 200 30159
d1kx0jsb8xwkwf.cloudfront.net/ts/690x388/28/ 26 KB
26 KB 13ms
13ms Image
image/jpeg 143.204.101.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1kx0jsb8xwkwf.cloudfront.net/ts/690x388/28/30159
Requested by: Host: d1kx0jsb8xwkwf.cloudfront.net
URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.117 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-117.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 7a74b4295482fb4f6941b7d2d88e28ac9fe50d378a9d17f396dfad75749b5842

Request headers

Referer: https://www.thespoof.com/
Origin: https://www.thespoof.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 19:19:47 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified: Sat, 06 Mar 2021 20:27:05 GMT
server: Apache
age: 48250
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.thespoof.com
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 26698
x-amz-cf-id: fGxKPIyhJk1QC4CrOgnc-5rnQcrBSpcECv7ruX79YilFusP4fV1k3g==
expires: Tue, 18 Oct 2022 19:19:47 GMT

GET
H2 200 30159
d1kx0jsb8xwkwf.cloudfront.net/ts/690x388/28/ 26 KB
26 KB 21ms
21ms Image
image/jpeg 143.204.101.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1kx0jsb8xwkwf.cloudfront.net/ts/690x388/28/30159
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.117 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-117.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 7a74b4295482fb4f6941b7d2d88e28ac9fe50d378a9d17f396dfad75749b5842

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 19:19:47 GMT
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
last-modified: Sat, 06 Mar 2021 20:27:05 GMT
server: Apache
age: 48250
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.thespoof.com
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 26698
x-amz-cf-id: jEsTLdo9Nc1FbtPko0yc2I5QhUAw4OQPWMnlDYq0kRmZhLaRvfGwPA==
expires: Tue, 18 Oct 2022 19:19:47 GMT

GET
H2 200 bob.cfm Show response
www.thespoof.com/ajax/ 3 KB
1 KB 23ms
23ms XHR
application/json 185.24.73.192
DEFAULTROUTE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thespoof.com/ajax/bob.cfm?s=2

Requested by

Host: d1kx0jsb8xwkwf.cloudfront.net
URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.24.73.192 , United Kingdom, ASN61081 (DEFAULTROUTE, GB),

Reverse DNS

mail.spoof-media.com

Software

Apache /

Resource Hash

22edc4b25cb853b579650f45f57b3f60056bb70f4ef270d6afa4e2e493037fd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains; preload

Request headers

sec-fetch-mode: cors
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
x-requested-with: XMLHttpRequest
cookie: cfid=9fe51097-e173-41ce-af99-1a8218f17165; cftoken=0; EU=1
:path: /ajax/bob.cfm?s=2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
x-serve: cache
:authority: www.thespoof.com
referer: https://www.thespoof.com/spoof-news/us/152694/fauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.thespoof.com/spoof-news/us/152694/fauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs
X-Serve: cache
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:57 GMT
content-encoding: gzip
last-modified: Tue, 19 Oct 2021 08:40:02 GMT
server: Apache
etag: "a58169b6771033da166e16c73ee5b9043eaa90e6"
vary: Accept-Encoding
content-type: application/json;charset=UTF-8
cache-control: max-age=0, s-maxage=600, proxy-revalidate, stale-while-revalidate
strict-transport-security: max-age=300; includeSubDomains; preload
expires: Tue, 19 Oct 2021 11:43:57 GMT

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 61b00c4cede7a5c3a15f3dd9ec408e7a4e4606e62dd3add4e290a2173a837933

Request headers

Referer
Origin: https://www.thespoof.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 70 KB
70 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dd8a706f05ab8bad9ebfa923d1e66c1ff189077c85e2ddbac950877ebfff49cb

Request headers

Referer
Origin: https://www.thespoof.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 462 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4b8b52dc81779c9756929122da5db63c2447349871da5dddf40af73d1f0a07e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 331 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62da98d5acd946a597521a5dfcb4744fab46145d701d3d589fa4abf110b276f0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 645 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 20fa27a2c44110d0936772c21ea720dd45c5625330500d58984d4b915a6a2e1c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 267 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9901a1bd291a5771df947a083baa7b31c394871163cf3a3e8a45ceb6e03c67c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 446 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 36b8283665402d2eb3ad60f47615eb89e3f741ff7dea2027aed2794f9969bde6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 265 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fefadd0594dc47ee0d6dca40c62f56c37d2a05dc0c8ba2e34d490b1b09585d77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 451 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5b152f04ac9999b26332529404f1773162621330f2c58724de4623f4adc32bd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 490 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abf8ab4b9e0b26d9a47e792dbdc11d847d903897d672a9c2c4754463c694e8cb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 490 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ccddf60b0deee6144707ab33981db1e9ca33c4b99a0ada89fcf894b285a34d2b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 578 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 32809cdddf32e939ee06f4afdc23bc72edd482895d2192b055493cb8c0f3a028

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 771 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d449a892fe829e8b37ea8d48a2ba31c3adca3ac1a6373b2445eef515494d841

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 465 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7295612e48e5f726f2780c3e479c076b85955ad1f8803e01a5997416f5a31610

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 389 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f69a1bfce49a7890ea1b6ff273b719b2b2bf7088f1057a5149d3ae4eb766c18a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 30159
d1kx0jsb8xwkwf.cloudfront.net/ts/690x388/28/ 26 KB
26 KB 9ms
9ms Image
image/jpeg 143.204.101.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1kx0jsb8xwkwf.cloudfront.net/ts/690x388/28/30159
Requested by: Host: d1kx0jsb8xwkwf.cloudfront.net
URL: https://d1kx0jsb8xwkwf.cloudfront.net/tss/js/2007101.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.117 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-117.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 7a74b4295482fb4f6941b7d2d88e28ac9fe50d378a9d17f396dfad75749b5842

Request headers

Referer: https://www.thespoof.com/
Origin: https://www.thespoof.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 19:19:47 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified: Sat, 06 Mar 2021 20:27:05 GMT
server: Apache
age: 48250
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.thespoof.com
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 26698
x-amz-cf-id: zsOsIBqmnwAniXGBTSn3FPN2hCuTLurcUEzQv_9KmFBqWuJShUMOGw==
expires: Tue, 18 Oct 2022 19:19:47 GMT

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/ 271 KB
97 KB 48ms
48ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32c37d3ef21fb4793c7a9f4f6adf7e5d597e7fd0d7b8a89f793bb0b34c44ee53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99348
x-xss-protection: 0
server: cafe
etag: 17165115455200885443
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Oct 2021 08:43:57 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211013/r20190131/ Frame 5054 10 KB
5 KB 28ms
7ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211013/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f297a42c731c5e6412ef47dff5d7697e142a28abe98d34b515951d40e5e9f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211013/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 18 Oct 2021 21:22:20 GMT
expires: Mon, 01 Nov 2021 21:22:20 GMT
content-type: text/html; charset=UTF-8
etag: 9069739545958607985
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4691
x-xss-protection: 0
age: 40897
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 202 B
660 B 38ms
16ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.thespoof.com&callback=_gfp_s_&client=ca-pub-9552315955068675

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fa573240b1933735ca23bd4712a2565e65c23721331203bcf625d517f61e184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 194
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 68ms
27ms Script
application/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thespoof.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 08:43:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C6AF 140 KB
41 KB 496ms
482ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&adk=1812271804&adf=3025194257&lmt=1616194329&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633037756&bpp=2&bdt=233&idt=86&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=528618447351&frm=20&pv=2&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e3c460a635157ce041664103c866007a4082c9a90552783d283198114d3b9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9552315955068675&output=html&adk=1812271804&adf=3025194257&lmt=1616194329&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633037756&bpp=2&bdt=233&idt=86&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=528618447351&frm=20&pv=2&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=101
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 19 Oct 2021 08:43:58 GMT
server: cafe
content-length: 42340
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 19-Oct-2021 08:58:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:58 GMT
cache-control: private

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 44ms
29ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211013&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

988e4fc979234e791f5a91a712ed67830ce9eff7df54420deaa44f0982f3edb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 08:43:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8720
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 164ms
128ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 19 Oct 2021 08:43:58 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame ADAB 12 KB
5 KB 35ms
13ms Document
text/html 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Tue, 19 Oct 2021 00:48:43 GMT
expires: Wed, 19 Oct 2022 00:48:43 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 28515
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A483 783 B
1 KB 39ms
17ms Document
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f4.1e100.net

Software

GSE /

Resource Hash

45ca5eba480005e9ac50a4fb448c264f82a95c64de9be9a90b99fa1b4659aea5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Cjf9V4lZXKp6aTAGKSqEfw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 19 Oct 2021 08:43:58 GMT
date: Tue, 19 Oct 2021 08:43:58 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-Cjf9V4lZXKp6aTAGKSqEfw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A483 0
0 61ms
60ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211013&jk=1199803616806719&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame ADAB 35 KB
13 KB 6ms
6ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1982
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 08:10:56 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 48ms
47ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211013&jk=1199803616806719&bg=!ubqluv7NAAao6lBpqOo7ACkAdvg8Wu8MvSkAaBRaweRplRzhDUmLGNPx2bz9bGnc0EfzKMgILaHx0AIAAABRUgAAAAxoAQeZAr5S_JAfR8H-4C_N-6VL9Eybcu-XLSXu9Z7ImfM1Usn49646ODBTnzT6dMSMAaGTvsZTwwusnIMwONazlF8X7qWfMYA2zE7JqAClRd5DoQ2gAQkEIW-qDk0u8oTHEGmc_QtlDC34F8UFBaPiIgqC54Ta8eRxBditltNtLNKsZCwehdYBdmjS6VOux0N6oqzHDCQUJG5ds0iBbziO6thZMR0ksvryRpbxHzxEB_buT9J9zTxLAA36zkrre2zmdVpxEva7xs03hrtYuS9vCchbX6yp3_n1DeLkPxiqZ_OX72xgr9JYYvJQrAAsrMxgmeNelSrxAZ9Sa3bQGaVU713dNvzFnuN5LgROV7SqQoS0iei3Mp_J6snX4wcQL3UiuMHeI_imnAGwrYUZCLm31uHCJPBUMbINinFYDonxWR_896IYU4prHA2mxm_-CeLDk39kc1HwpQDTN7CfADlKGmsops4UdOQ3W4qrE95QjzpiGSVCOLa5f7EQgMj27mzRuvRpaJ2SBqEyNIRaNqwQa1pgZniD6do2IeVnx5Hz5IfgpWRf51lhf9ZojQxWMHjtB4loZY-SsL6hh_akyVHai5T0gAnRPDIAGHUhov0T0E2Dv51NhXPOXL_nszqQk6ln3R888YpiFw54n_jZRxH67aeyivcQKMZm-eO9CcCJu8GK8IgJd-jqNdO2w1Rz4mpO8KHsqsGOB_TyUCZPbv58qFW28WiVkpiBn1_I1ZVG1iaVPa3jncQwHUAhYC4Suv2-txmi8KcFiWix3sY6TSU0BGnfeJecfrzGf5pnC-6kqhZ0SXhzY78aWuLK29G9HUQz1RgDXystPgb3adakX2v5ljt2r3zcVRmX1VqJlFFxuARVWKvT2wpyMZnhhipB1mkHLZkHSBY2NIjYAo0nY7WRL2lEUElrC9cnjiDWIdHU-ilKwL8

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/ 143 KB
51 KB 45ms
45ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/reactive_library_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f467e41f5f5fdbf912d21cc7bb928b585f802ae48738266d46e5519c7f7735f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52649
x-xss-protection: 0
server: cafe
etag: 8186639351790934550
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Oct 2021 08:43:58 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 30ms
16ms Script
application/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thespoof.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 08:43:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DA2D 92 KB
30 KB 669ms
668ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

828eda38419cabd1ccc87648422dc8a2b320248de1adc346342393ff8fc0a9f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 19 Oct 2021 08:43:59 GMT
server: cafe
content-length: 30194
x-xss-protection: 0
set-cookie: IDE=AHWqTUlfjVUwUzQdNfjcKXto1MFPfwKciQJjiLUgZEygz3vUYMwwcxQkrdVXPgbpyXY; expires=Thu, 19-Oct-2023 08:43:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9343 86 KB
29 KB 545ms
545ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2940297478&pi=t.aa~a.1708805249~i.10~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280&nras=3&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1586&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=RyApMLVh5n&p=https%3A//www.thespoof.com&dtd=20

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

727eb127c06e6f40b103547ec271d995e901b1d084b9b6e53e4db2b2a5404ad2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2940297478&pi=t.aa~a.1708805249~i.10~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280&nras=3&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1586&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=RyApMLVh5n&p=https%3A//www.thespoof.com&dtd=20
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 19 Oct 2021 08:43:58 GMT
server: cafe
content-length: 29472
x-xss-protection: 0
set-cookie: IDE=AHWqTUmZsCq5HLKmgdUik3bCGBawt0bNhdTEK9xPyVJuFPLFDV9MsDtTtkO4o9VwK9U; expires=Thu, 19-Oct-2023 08:43:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:58 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 38A7 90 KB
29 KB 679ms
678ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37e1ec819c080395cd80a8f5171b655ffc42a8ba45b641b8f2d8f0dfecd70a20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 19 Oct 2021 08:43:59 GMT
server: cafe
content-length: 29931
x-xss-protection: 0
set-cookie: IDE=AHWqTUn_tNHViza6jSXIyRCghrxOlkRM8yEIQVKsydswlpG79Ug35f0upMt8AyJ8xqI; expires=Thu, 19-Oct-2023 08:43:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5BAF 93 KB
30 KB 704ms
703ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47d974bd701fb8d1ae4d00779ee2515a15f87dab7ad4c4f438c24bf6bdb77c4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 19 Oct 2021 08:43:59 GMT
server: cafe
content-length: 30519
x-xss-protection: 0
set-cookie: IDE=AHWqTUngz1jPTV_hseBU4SLd0-W6KJyWS690bacjrm8qpF2A_6W3b_sJis9rKqcdAx4; expires=Thu, 19-Oct-2023 08:43:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4F47 137 KB
37 KB 650ms
650ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0fd68ec2fb994120be63b7a351d39eae59648059119c5c60948317ba1b82d59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 19 Oct 2021 08:43:59 GMT
server: cafe
content-length: 38025
x-xss-protection: 0
set-cookie: IDE=AHWqTUkh_4apy4pwyaHRCkhdUWTxf5AjpkHGNrEezX9RIoYabBNqdz6zhYXeIDYFYeA; expires=Thu, 19-Oct-2023 08:43:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thespoof.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 08:43:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/ Frame 8F90 10 KB
5 KB 7ms
6ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f297a42c731c5e6412ef47dff5d7697e142a28abe98d34b515951d40e5e9f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thespoof.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thespoof.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 19 Oct 2021 00:26:23 GMT
expires: Tue, 02 Nov 2021 00:26:23 GMT
content-type: text/html; charset=UTF-8
etag: 9069739545958607985
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4691
x-xss-protection: 0
age: 29855
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/ Frame 4893 43 KB
6 KB 14ms
14ms Document
text/html 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/index.html

Requested by

Host: www.thespoof.com
URL: https://www.thespoof.com/spoof-news/us/152694/fauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a7e50722ac34f1cf1b33bd93bcce2513287b4247667f19e71e6dad48a15f01c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/13181429727457768964/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
date: Mon, 18 Oct 2021 04:38:10 GMT
expires: Tue, 18 Oct 2022 04:38:10 GMT
last-modified: Tue, 22 Jun 2021 15:16:19 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 6606
age: 101148
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8F90 0
0 50ms
50ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CcAeeTYVuYYyrNtmRrASs2ZawCNn2vLtl8468_qMO2tkeEAEg49CDBmDJBqAB-6rY0QPIAQmpArKcXQiKLKs-qAMByANIqgTJAk_QlASc8aL9Lv9340DTRMgWYJlKUM93gaB7IaTYIfEwEegLkooCD1pngs60wcmv1LBCenWbbAzXeYIYbl7P7lOGCn1psXhbKKLWDMFRRUbo1wVE1Di6y59z3bPwGuLxR7PiM2GrbQ2vZdRR6eg7ScfMquIjB6jB6xhTCsQAmCXd7ItRNh92MuwMFpveqOBWvLYRqESNNOpXYwTzhBy-DuRGDW0RIHbrYiaTp2IMGwmO5YBCEWJ2MXfdPyFZwB0QEayfE9EebElKW20BTb9NHfhJY2k7svmswvI10G-PC4a0f8KVpWJIpukwAz6vCI1EWmTHV9ws5MhTKgNmLLWfex7-j519GU2y2Na39xYB4CeO1yXgwQhF1W2lp8-oTrlCTDY0SlwY7hZok-03UT3GDxguBF3fzdr1alsrQLgGp5hVtdJrtTCsN0EIwAT6scbKuwOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH7dSnLqgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhvYBwDyBwQQ4_Fn0ggHCIBhEAEYX4AKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi05NTUyMzE1OTU1MDY4Njc1GAA&sigh=-8Tm5GBpuvk&template_id=419

Requested by

Host: www.thespoof.com
URL: https://www.thespoof.com/spoof-news/us/152694/fauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 19 Oct 2021 08:43:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 19 Oct 2021 08:43:58 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 8F90 18 KB
8 KB 14ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2ec3db0c3ffe01385ebd2fa36b83708e505fada5609f9859a8e04a9cbdcaefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7691
x-xss-protection: 0
server: cafe
etag: 14402072889669646931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:43:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 8F90 3 KB
1 KB 17ms
17ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 168
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:41:10 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8F90 123 KB
38 KB 52ms
23ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 08:43:58 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 8F90 14 KB
6 KB 14ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:37:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:37:25 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A668 143 B
163 B 7ms
6ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 19 Oct 2021 08:00:15 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2623
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 4893 9 KB
3 KB 14ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 01:24:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 26360
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 20 Oct 2021 01:24:38 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 4893 26 KB
10 KB 14ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 23:30:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 19 Oct 2021 23:30:30 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 4893 8 KB
1 KB 38ms
16ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Dosis:700%7cLato%7cLato%7cDosis%7cOpen+Sans:300,700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bc5d6f079f3dd93d386824e774f8c700aabc48f353466df5a1c62520b1a05d1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 08:43:58 GMT
server: ESF
date: Tue, 19 Oct 2021 08:43:58 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 08:43:58 GMT

GET
H3 200 capture-728x90.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/ Frame 4893 6 KB
6 KB 14ms
13ms Image
image/jpeg 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/capture-728x90.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4af13d4e47af500f1bc26029ca121adf49d4a21cb5603646658a32abb2d46134

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 101147
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6596
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 15:16:19 GMT
server: sffe
date: Mon, 18 Oct 2021 04:38:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 18 Oct 2022 04:38:11 GMT

GET
H3 200 Auvik-logo-white-bg.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/ Frame 4893 10 KB
10 KB 14ms
13ms Image
image/png 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/Auvik-logo-white-bg.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13181429727457768964/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

544d76fc8711dedd2d0799872726b9584b3547f6da40ec71e91ae2555adcdbf0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 359859
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9996
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 15:16:19 GMT
server: sffe
date: Fri, 15 Oct 2021 04:46:19 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 15 Oct 2022 04:46:19 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A668
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

85ms
85ms

Document
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUksmb5AinimNJBGSVgG_RIoJzHECI86Y1FwgYKtzGzgjdH7nQdy45YSKINRy-Y
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 19 Oct 2021 08:43:58 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 19-Oct-2021 09:43:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:58 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 19 Oct 2021 08:43:58 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 8F90 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1928ddb1fa27aac6823539ac28bcf21fbe590804a0819ba9778480b6200bc712

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ Frame 4893 44 KB
44 KB 27ms
6ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Dosis:700%7cLato%7cLato%7cDosis%7cOpen+Sans:300,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 17:04:31 GMT
x-content-type-options: nosniff
age: 401967
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44760
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 16:50:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 14 Oct 2022 17:04:31 GMT

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 4893 35 KB
13 KB 7ms
7ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1982
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 08:10:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9343 6 KB
671 B 47ms
24ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2940297478&pi=t.aa~a.1708805249~i.10~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280&nras=3&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1586&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=RyApMLVh5n&p=https%3A//www.thespoof.com&dtd=20

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 06:50:43 GMT
server: ESF
date: Tue, 19 Oct 2021 08:43:59 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 9343 2 KB
914 B 17ms
17ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 284
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 885
x-xss-protection: 0
server: cafe
etag: 638833322182864030
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:39:14 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 9343 18 KB
8 KB 13ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2ec3db0c3ffe01385ebd2fa36b83708e505fada5609f9859a8e04a9cbdcaefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7691
x-xss-protection: 0
server: cafe
etag: 14402072889669646931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:43:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 9343 3 KB
1 KB 13ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 168
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:41:10 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9343 123 KB
37 KB 30ms
15ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 9343 14 KB
6 KB 14ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:37:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:37:25 GMT

GET
H2 200 94b9e9edb15b7c220f12fa63d878a5af.js Show response
www.gstatic.com/mysidia/ Frame 9343 27 KB
12 KB 26ms
6ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 12:52:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71519
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11213
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 03:34:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sun, 16 Jan 2022 12:52:00 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/17137242044715288093/ Frame 9343 13 KB
13 KB 14ms
14ms Image
image/jpeg 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17137242044715288093/downsize_200k_v1?w=400&h=209

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b14220bdce036275705b8330815381d7716f70e18751a325082099d0de962fd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:18:35 GMT
x-content-type-options: nosniff
age: 1523
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12993
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 20:24:18 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Oct 2022 08:18:35 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13421138559168888078/ Frame 9343 2 KB
3 KB 14ms
14ms Image
image/png 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13421138559168888078/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc54fdd73bf8d2ca083bef1a7c2493bd1000d01c76853f18f39d35fd2b19e39e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 11:12:02 GMT
x-content-type-options: nosniff
age: 77516
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2556
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 20:21:36 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 Oct 2022 11:12:02 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9343 0
0 53ms
52ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C8lk6ToVuYcW_GoiFjuwP8uaDKOWWyOZln6SgiMIOlda1z78pEAEg49CDBmDJBqABrcipvgPIAQmoAwHIA8sEqgTgAk_Ql-9XCTPBjHHE-_5InX_jQ6cm_SkJjh67UDuWreVJ_HYPOGBuPPBa0s_zl_s6XM4ft4bWJnHKFvaXWcFxff4dFM_dqfP6b6UfViXAzeyrug7GqnV9qd59ATcYQUReCOxkD70zCv4nM_KyrHK9aDuedwiRVq_Vi4P02gzoGJ2uWYU4IeFrDJkKvujptyKZdhnObwpc3DeAhSvEvNp-bu3r10JjfZaJ4MvmmfzSKbjvHP4uh1H5Z4_g5N0Jj0GGfcbvgQhfvCaDdPHjUTI0dir6BH79CMs3vuAV5zz-ZRfPxiOiJQSQbcZaR0_8EaIuuR-zcmx7RNjtr3y2piCdBvQeV59Y-8Js08FZMjzFRJ8n1esXNWWBBZbD2oDcA7EzQtHpD8sH-6nioEOAcL2XyuWKS9_l9siNd5pl3zrFHtXQExy2uKMb2RuD0G-72jklSSmpxgaCIAULA4z7ygp_PjTABOOF7KHlA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAe7t9ZBqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBD-zw7SCAcIgGEQARhfgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTk1NTIzMTU5NTUwNjg2NzUYAA&sigh=i7j83eXr63Y&uach_m=[UACH]&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2940297478&pi=t.aa~a.1708805249~i.10~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280&nras=3&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1586&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=RyApMLVh5n&p=https%3A//www.thespoof.com&dtd=20
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 94FC 1 KB
749 B 7ms
6ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 18 Oct 2021 08:58:57 GMT
expires: Tue, 19 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85502
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 9343 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3cd77424702dff58d534fdc1b70a00bf05330c7de1b0c0651db081dbf07cd6a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9343 15 KB
15 KB 22ms
6ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 14:59:32 GMT
x-content-type-options: nosniff
age: 150267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 17 Oct 2022 14:59:32 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9343 15 KB
15 KB 22ms
10ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:31:40 GMT
x-content-type-options: nosniff
age: 490339
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 13 Oct 2022 16:31:40 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9343 15 KB
15 KB 17ms
8ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 54982
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 18 Oct 2022 17:27:37 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 94FC
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEMC9qKxAn4yI5jlNR18SDpw&google_cver=1&google_push=AYg5qPJnYPFgmDWJ99U16cI5mWcASImODoclxDqK7s2aQkINqGo9XXNTNh8s3rcmjze5qvcaB3x8f7V-8vnujF9Ytx96IEJW5-jV
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJnYPFgmDWJ99U16cI5mWcASImODoclxDqK7s2aQkINqGo9XXNTNh8s3rcmjze5qvcaB3x8f7V-8vnujF9Ytx96IEJW5-jV&google_hm=Q0FFU0VNQzlxS3hBbjR5S...

170 B
329 B

26ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJnYPFgmDWJ99U16cI5mWcASImODoclxDqK7s2aQkINqGo9XXNTNh8s3rcmjze5qvcaB3x8f7V-8vnujF9Ytx96IEJW5-jV&google_hm=Q0FFU0VNQzlxS3hBbjR5STVqbE5SMThTRHB3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 08:43:58 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJnYPFgmDWJ99U16cI5mWcASImODoclxDqK7s2aQkINqGo9XXNTNh8s3rcmjze5qvcaB3x8f7V-8vnujF9Ytx96IEJW5-jV&google_hm=Q0FFU0VNQzlxS3hBbjR5STVqbE5SMThTRHB3
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94FC
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPJ9kmyP0Rv3q7RxqYCs0HbH44crwMK6WslDG9SreNxhpC5vMoGgoU98V2ZNp79qLnzw0UnCSzXk-wWsPLZdoWjs8dJWqTkE&google_gid=CAESELYKaN8wd9wu9hP6WU9puTI&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCM-KuosGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBKOWtteVAwUnYzcTdSeHFZQ3MwSGJINDRjcndNSzZXc2xERzlTcmVOeGhwQzV2TW9HZ29VOThWMlpOcDc5cUxuencwVW5DU3pYay13V3NQTF...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwLWhZa2YzSnJUZTg3TEQwUjFNV2lUTGFaT1B4bWN0WTFpYmt6VjZXc01KUQ==&google_push

170 B
188 B

47ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwLWhZa2YzSnJUZTg3TEQwUjFNV2lUTGFaT1B4bWN0WTFpYmt6VjZXc01KUQ==&google_push

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 19 Oct 2021 08:43:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwLWhZa2YzSnJUZTg3TEQwUjFNV2lUTGFaT1B4bWN0WTFpYmt6VjZXc01KUQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94FC
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIHT-NK...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIHT-NK...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMTkwODQzNTkwMDA2NDcyOTA5Nzg4Nw%3D%3D&google_push=AYg5qPIHT-NK5P7sR9Ptocz4Su0p43q4K_IgiDCjehOQEl0NcVF1uvSUMqL2De6dn7Xdy8...

170 B
188 B

26ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMTkwODQzNTkwMDA2NDcyOTA5Nzg4Nw%3D%3D&google_push=AYg5qPIHT-NK5P7sR9Ptocz4Su0p43q4K_IgiDCjehOQEl0NcVF1uvSUMqL2De6dn7Xdy8nFLatIEhvAtBto8L2HoJ2oUplcb7g

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMTkwODQzNTkwMDA2NDcyOTA5Nzg4Nw%3D%3D&google_push=AYg5qPIHT-NK5P7sR9Ptocz4Su0p43q4K_IgiDCjehOQEl0NcVF1uvSUMqL2De6dn7Xdy8nFLatIEhvAtBto8L2HoJ2oUplcb7g
pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94FC
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

26ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKTeiZVJaJ6dsvTxfU_SzSi7fGjrMplkcz8SSjC-TN47BCLBZRMrFh3p8BGArnsXbrJaCHDlHL9R9-FDcrDJz-m_V4uEyaY

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKTeiZVJaJ6dsvTxfU_SzSi7fGjrMplkcz8SSjC-TN47BCLBZRMrFh3p8BGArnsXbrJaCHDlHL9R9-FDcrDJz-m_V4uEyaY
date: Tue, 19 Oct 2021 08:43:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94FC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH2r_pZU2AfTOb8QhAeEJb4&google_cver=1&google_push=AYg5qPJGNNzdnbWMcmsoei1zD7deH9OgkUlz3-CHbUMaRApF4SrIyc-h84_UyzlMT3O3fUhrvHG...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxTlItQy1FM09N&google_push=AYg5qPJGNNzdnbWMcmsoei1zD7deH9OgkUlz3-CHbUMaRApF4SrIyc-h84_UyzlMT3O3fUhrvHGh8pN2baBvZ4oUufVlAilU3oo

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxTlItQy1FM09N&google_push=AYg5qPJGNNzdnbWMcmsoei1zD7deH9OgkUlz3-CHbUMaRApF4SrIyc-h84_UyzlMT3O3fUhrvHGh8pN2baBvZ4oUufVlAilU3oo

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxTlItQy1FM09N&google_push=AYg5qPJGNNzdnbWMcmsoei1zD7deH9OgkUlz3-CHbUMaRApF4SrIyc-h84_UyzlMT3O3fUhrvHGh8pN2baBvZ4oUufVlAilU3oo
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Expires: 0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 94FC 0
44 B 706ms
231ms Image
text/plain 54.250.62.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEApEXXmNd795p2z2EYOeuzk&google_cver=1&google_push=AYg5qPK8k7X02ABsVQFN0pe3ZfSVpi3q1CVA-AvGs4KVrNtW-8NPnlKqjXv6toBr2yUqp9FKZXpX0zi8JstaZ_hi9yUwcYVJqjbj
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2940297478&pi=t.aa~a.1708805249~i.10~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280&nras=3&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1586&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=RyApMLVh5n&p=https%3A//www.thespoof.com&dtd=20
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.250.62.115 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-250-62-115.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: awselb/2.0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 94FC
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESELd1dSsPZH7BnHSI6FkANPE&google_cver=1&google_push=AYg5qPLByy5rBEYVQGszAWLo...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLByy5rBEYVQGszAWLofKihI0ArCmfVHyTHbbSDlUQkkXwD-exOaYDhxIrvxx49VSKNkMWnlBoyEV-nzOm9yhvUqBBq8D5skA&google_hm=

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLByy5rBEYVQGszAWLofKihI0ArCmfVHyTHbbSDlUQkkXwD-exOaYDhxIrvxx49VSKNkMWnlBoyEV-nzOm9yhvUqBBq8D5skA&google_hm=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLByy5rBEYVQGszAWLofKihI0ArCmfVHyTHbbSDlUQkkXwD-exOaYDhxIrvxx49VSKNkMWnlBoyEV-nzOm9yhvUqBBq8D5skA&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Mon, 18 Oct 2021 08:43:59 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 94FC 0
253 B 74ms
24ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ka8eqrcfYtm7rc9vDcPORKZUtJlly9nc5LZpaBJByxFwynM9YhSjZ8xHrR0a3ZAeLrpDAl9Q

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 e8e197e378ee874e03267c2064571e79.js Show response
www.gstatic.com/mysidia/ Frame 4F47 7 KB
3 KB 24ms
7ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e8e197e378ee874e03267c2064571e79.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ce8fde1e19d45e140ba1f2e2756d7e564eb85c8888cc49547ee6a7cf87bc081

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 19:52:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132699
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3152
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 03:34:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sat, 15 Jan 2022 19:52:20 GMT

GET
H3 200 2154e5c8e4a6a4bc826dabd8464a02f2.js Show response
www.gstatic.com/mysidia/ Frame 4F47 130 KB
48 KB 24ms
8ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/2154e5c8e4a6a4bc826dabd8464a02f2.js?tag=video_mra/web_raspberry

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c07310dc603c9f1d75582922ecda85a92a84411ff41b21c9f8dd79305bd33063

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 19:52:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132699
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48785
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 03:34:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sat, 15 Jan 2022 19:52:20 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4F47 3 KB
580 B 25ms
25ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 08:40:45 GMT
server: ESF
date: Tue, 19 Oct 2021 08:43:59 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4F47 5 KB
617 B 25ms
25ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%2C700

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1c733809a15b6fd666d9c4e02e6fbf1382e73b5fbbba07d4cf8c5f33046c035a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 08:33:08 GMT
server: ESF
date: Tue, 19 Oct 2021 08:43:59 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 6094 35 KB
13 KB 6ms
6ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1983
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 08:10:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame DA2D 6 KB
671 B 25ms
25ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 08:00:13 GMT
server: ESF
date: Tue, 19 Oct 2021 08:43:59 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 4F47 2 KB
916 B 14ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 885
x-xss-protection: 0
server: cafe
etag: 638833322182864030
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:39:14 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 4F47 18 KB
8 KB 14ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2ec3db0c3ffe01385ebd2fa36b83708e505fada5609f9859a8e04a9cbdcaefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7691
x-xss-protection: 0
server: cafe
etag: 14402072889669646931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:43:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 4F47 3 KB
1 KB 15ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:41:10 GMT

GET
H3 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 4F47 67 B
97 B 15ms
14ms Image
image/png 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 18 Oct 2021 18:14:57 GMT
x-content-type-options: nosniff
server: cafe
age: 52142
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Tue, 19 Oct 2021 18:14:57 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame DA2D 2 KB
916 B 15ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 885
x-xss-protection: 0
server: cafe
etag: 638833322182864030
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:39:14 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame DA2D 18 KB
8 KB 15ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2ec3db0c3ffe01385ebd2fa36b83708e505fada5609f9859a8e04a9cbdcaefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7691
x-xss-protection: 0
server: cafe
etag: 14402072889669646931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:43:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame DA2D 3 KB
1 KB 15ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:41:10 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DA2D 123 KB
37 KB 27ms
26ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame DA2D 14 KB
6 KB 16ms
15ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:37:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 394
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:37:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DA2D 0
0 22ms
21ms Image
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTvXisfAVcGXWC2pbMhCiithkFjJ1qs-oS6oCRF1DupxAh0pgWZvq8syU_eEtcgm9YewJZQkD9V24t1bR4RoBXLMMriGw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 94b9e9edb15b7c220f12fa63d878a5af.js Show response
www.gstatic.com/mysidia/ Frame DA2D 27 KB
11 KB 10ms
9ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 12:52:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71519
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11213
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 03:34:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sun, 16 Jan 2022 12:52:00 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 4F47 14 KB
6 KB 13ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:37:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 394
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:37:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4F47 0
0 22ms
21ms Image
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaStwlCdUIK1olIwZkUWDnXdottWks5BJ8XQTUPdBX46FN8CsgrfrrvFdtnXmqF6uQX7nOAiL_gVZN9IFC2eP063Fv2r-A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4F47 123 KB
37 KB 19ms
18ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 94b9e9edb15b7c220f12fa63d878a5af.js Show response
www.gstatic.com/mysidia/ Frame 4F47 27 KB
11 KB 7ms
6ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 12:52:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71519
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11213
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 03:34:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sun, 16 Jan 2022 12:52:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 38A7 6 KB
671 B 25ms
24ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 06:54:06 GMT
server: ESF
date: Tue, 19 Oct 2021 08:43:59 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/14033136923120080826/ Frame DA2D 10 KB
10 KB 17ms
15ms Image
image/jpeg 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14033136923120080826/downsize_200k_v1?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30463257fe1d90841fc59e37f8f3159869b5d25d783a8591995c69115582389c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 15:36:47 GMT
x-content-type-options: nosniff
age: 493632
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10543
x-xss-protection: 0
last-modified: Thu, 08 Apr 2021 15:47:57 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 13 Oct 2022 15:36:47 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/17130935227522362997/ Frame DA2D 2 KB
2 KB 18ms
16ms Image
image/png 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17130935227522362997/downsize_200k_v1?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5920c85fb035951583dd613873bb2d5686ab076a22477fb40767dc255faa56dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 23:22:05 GMT
x-content-type-options: nosniff
age: 552114
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1599
x-xss-protection: 0
last-modified: Fri, 14 May 2021 15:48:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 12 Oct 2022 23:22:05 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DA2D 0
0 57ms
57ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CQA8SToVuYduUGpWorASgnqTwC4ewxcRl9b3B1rANloLNhYgWEAEg49CDBmDJBqABr-jPzwHIAQmoAwHIA8sEqgTTAk_QX6dafWZy8U3v9K7KVILIF8GRvxhRrValiIFaI25Xa8felT17Uufiv8tTplIhWAYz8cD3hZQu8rFgwIxuRlXJIB3TI2Quziv3ako8p2EzoZ_SkKvsAyVpZq5tt4jBjNerKxGIwTTI4k6UKZGSRRH9ymzJBr4cqIq3aFPxAuq4M874CVMWaSOhAvDLCTle0Ge8ZDVyei00kBvBzKd0mD4nT7IyauvZjG7PR9_zXpcgMyPhpq4o1BbT7yxHTyauaZvCtcM3VGY-ytqssWQcGu6wYkfcNx8b66HI97kWPLsDvdaAQiJ3fAm4b__S73vFIpjlMzFAZUieywsgeiQen6pV0nIvIzx8x1xI5xrl0BPxl0jo93OKH9afLAsR-DoIAJlaA0MhAXu_ASExvg984YdHuPu0WzwV3oFVGzzlAfQ2PZNBD2gtbVmCG2lFpfY0PBMcrcAEx5y22LsDkgUECAQYAZIFBAgFGASgBi6AB7mXsLACqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBBDEnkbSCAcIgGEQARhfgAoByAsB2BMNiBQH0BUBmBYBgBcBshccChoIABIUcHViLTk1NTIzMTU5NTUwNjg2NzUYAA&sigh=fp4QEs87aRs&template_id=484

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 38A7 2 KB
916 B 15ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 885
x-xss-protection: 0
server: cafe
etag: 638833322182864030
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:39:14 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 38A7 18 KB
8 KB 15ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2ec3db0c3ffe01385ebd2fa36b83708e505fada5609f9859a8e04a9cbdcaefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7691
x-xss-protection: 0
server: cafe
etag: 14402072889669646931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:43:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 38A7 3 KB
1 KB 15ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:41:10 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 38A7 123 KB
37 KB 20ms
18ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 38A7 14 KB
6 KB 15ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:37:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 394
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:37:25 GMT

GET
H3 200 94b9e9edb15b7c220f12fa63d878a5af.js Show response
www.gstatic.com/mysidia/ Frame 38A7 27 KB
11 KB 8ms
6ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 12:52:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71519
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11213
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 03:34:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sun, 16 Jan 2022 12:52:00 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/14033136923120080826/ Frame 38A7 10 KB
10 KB 13ms
13ms Image
image/jpeg 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14033136923120080826/downsize_200k_v1?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30463257fe1d90841fc59e37f8f3159869b5d25d783a8591995c69115582389c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 15:36:47 GMT
x-content-type-options: nosniff
age: 493632
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10543
x-xss-protection: 0
last-modified: Thu, 08 Apr 2021 15:47:57 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 13 Oct 2022 15:36:47 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/17130935227522362997/ Frame 38A7 2 KB
2 KB 14ms
13ms Image
image/png 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17130935227522362997/downsize_200k_v1?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5920c85fb035951583dd613873bb2d5686ab076a22477fb40767dc255faa56dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 23:22:05 GMT
x-content-type-options: nosniff
age: 552114
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1599
x-xss-protection: 0
last-modified: Fri, 14 May 2021 15:48:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 12 Oct 2022 23:22:05 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 38A7 0
0 49ms
49ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cb0v4ToVuYc3jGtWZ3gPm172oDoewxcRl9b3B1rAN0uHS4LIBEAEg49CDBmDJBqABr-jPzwHIAQmoAwHIA8sEqgTNAk_Qeja8XOekvCwlCaWBFxoZJg0KkOGLgsxNdZuUMLJmtR8eBXZX542lfbLZFGGYvQnnxRXuH3b9KNDHXLpf97T-6VYTjRNp_mSDxmJFmGuIqgfYLiMDSjJtqPn3rY6jBDR3-1BvTd7gw1Yk6ZIVZKvN9bGkLfX6fT8YBOaCoIHxWWhekSrMMgfoOK3mX2Mnfh7Q8BTQZyI2T66U9X-IJVURRK8oR-rDHp611XtLHugZ65EV--aBVQUpQc2ylOtH0L_CZBjhtrq73O06SbRYeImBOkrM3S6NG67xcyLjfv8DGHNjB4l8UfeYZxzvO5K56GWDpblN2hSR_PVB3j4hV_V2hVLiD9lKqgxuiN7_tXCZsBLZQp2pjMdfjNnVtAYRiEVe4ZL-Cp737hcFZt5pL_QxF6f6rUZvV9m80SRcv_5aqWg0axzK3wa7zkbd2cAEx5y22LsDkgUECAQYAZIFBAgFGASgBi6AB7mXsLACqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBBDzzT7SCAcIgGEQARhfgAoByAsB2BMNiBQH0BUBmBYBgBcBshccChoIABIUcHViLTk1NTIzMTU5NTUwNjg2NzUYAA&sigh=p65G2GygYUY&template_id=484

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4F47 216 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81cacd6b187878c8eb795e61e66c648ee76c410dafc63852de35290c1e56f9f1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5598 143 B
163 B 8ms
6ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14
accept-encoding: gzip, deflate, br
cookie: DSID=NO_DATA; IDE=AHWqTUngz1jPTV_hseBU4SLd0-W6KJyWS690bacjrm8qpF2A_6W3b_sJis9rKqcdAx4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 19 Oct 2021 08:43:02 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 57
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 400A 1 KB
749 B 8ms
7ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 18 Oct 2021 08:58:57 GMT
expires: Tue, 19 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85502
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css
fonts.googleapis.com/ Frame 5BAF 3 KB
580 B 27ms
26ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 08:08:37 GMT
server: ESF
date: Tue, 19 Oct 2021 08:43:59 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 08:43:59 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 4F47 0
348 B 355ms
121ms Ping
image/gif 142.251.32.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kuxub1ci&c=6734441054899&slotId=3367220527449.5&qqid=CNn74MyK1vMCFQmidwodgFQA2Q&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=rda&ulv=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/2154e5c8e4a6a4bc826dabd8464a02f2.js?tag=video_mra/web_raspberry
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.32.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yyz12s07-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13173598894758287239/ Frame 4F47 87 KB
87 KB 15ms
14ms Image
image/jpeg 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13173598894758287239/downsize_200k_v1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d30a9115d45b85cdec4d761bf966cb7756b84727422b7f8d0c8dcd7af8bc8bab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 07:16:51 GMT
x-content-type-options: nosniff
age: 264428
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89530
x-xss-protection: 0
last-modified: Thu, 08 Apr 2021 15:47:58 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 16 Oct 2022 07:16:51 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4F47 0
0 55ms
55ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C7k4MToVuYdmcG4nE3gOAqYHIDYewxcRl9b3B1rANloLNhYgWEAEg49CDBmDJBqABr-jPzwHIAQmoAwHIA8sEqgTTAk_QFgtwn7fCV3CcgstKpNtNuZXUokU3CrnlLLwUVzPsbP0cKigy8a138nrOmzhkJ9j3014PkOCALi00AcAVOZZ1xj23X0g4KU-RcLFyAOCW5fikP5Fkb_tGbqe9o3zYTK5vU7fSfh0ogFhwJvwC8eirTUPWpxWf8LQpnOUs5-VcgB3F9JKKNtTR7M7P0HSFGa742easG7grRgHBoc69cQ8tH7HNG-of6WlD_FmNJ2XPWMaJ85eFH4uJHkB5g_CKDucon_ZVa_VUtXRzrwvQid5cPnOr1Njtk902jrfgLSVTWM7qcT46q1GX6bLShJBcVcWIt6GZxfpFbmZDOvjlmpNZX0-H_5nhQkHLq5PJwFPukRNHdx9UDeoRySZJSPOwcsanWK9G5rIZm2pWVYpV3sQD2FzjPrHOkgZkQChbYkKjyrtEbu7j54PyGaF3r6gEIOFxNMAEx5y22LsDkgUECAQYAZIFBAgFGASgBi6AB7mXsLACqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBBDptyPSCAcIgGEQARhfgAoByAsB2BMNiBQH0BUBmBYBgBcBshccChoIABIUcHViLTk1NTIzMTU5NTUwNjg2NzUYAA&sigh=tGRy5_IvVhM&template_id=3484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DA2D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abb3b374bb4fc2e0d611a7c417a4d1b0ae06da692b4e793e8f328869ab960aca

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DA2D 0
20 B 46ms
45ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=jca&jc=26&version=r20211013&sample=0.01

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/load_preloaded_resource_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8CDB 1 KB
749 B 6ms
6ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 18 Oct 2021 08:58:57 GMT
expires: Tue, 19 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85502
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 5BAF 2 KB
916 B 13ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 885
x-xss-protection: 0
server: cafe
etag: 638833322182864030
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:39:14 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 5BAF 18 KB
8 KB 13ms
13ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2ec3db0c3ffe01385ebd2fa36b83708e505fada5609f9859a8e04a9cbdcaefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7691
x-xss-protection: 0
server: cafe
etag: 14402072889669646931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:43:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 5BAF 3 KB
1 KB 14ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:41:10 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5BAF 123 KB
37 KB 17ms
17ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 08:43:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 5BAF 14 KB
6 KB 14ms
14ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:37:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 394
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 08:37:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5BAF 0
0 21ms
21ms Image
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRFZSFBq91y7L0DkzvhdA4XHIz2-pMZVUW4IEgpR7--7lp4VuqoWj111NSSGU8aY8m5NBlabkql9bP8ZjsvBwup1pNt3Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 94b9e9edb15b7c220f12fa63d878a5af.js Show response
www.gstatic.com/mysidia/ Frame 5BAF 27 KB
11 KB 7ms
6ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 12:52:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71519
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11213
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 03:34:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sun, 16 Jan 2022 12:52:00 GMT

GET
H3

206

videoplayback
r4---sn-4g5lzne6.gvt1.com/ Frame 4F47
Redirect Chain

https://redirector.gvt1.com/videoplayback?id=c92ab3eb1806625e&itag=18&source=web_video_ads&requiressl=yes&cmo=secure_transport=yes&ip=0.0.0.0&ipbits=0&expire=1634640239&sparams=ip,ipbits,expire,id,...
https://r4---sn-4g5lzne6.gvt1.com/videoplayback?id=c92ab3eb1806625e&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1634640239&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,m...

1 MB
1 MB

47ms
7ms

Media
video/mp4

74.125.160.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5lzne6.gvt1.com/videoplayback?id=c92ab3eb1806625e&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1634640239&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=31CA94E59D77E7A9AFBCD051F8EB05A2A93117E5.553D0E9CF10D2DAAD2932D5A55A871287A231E2F&key=cms1&cms_redirect=yes&mh=Eb&mip=216.131.114.192&mm=28&mn=sn-4g5lzne6&ms=nvh&mt=1634632576&mv=m&mvi=4&pl=24

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.160.233 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s15-in-f9.1e100.net

Software

gvs 1.0 /

Resource Hash

f164b4777f22728b5216ffa09d58a4188b3e0ca46bf97b4c5fe4f13fbe4a1a47

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 13 Oct 2021 14:29:25 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
Content-Range: bytes 0-1155319/1155320
client-protocol: quic
cache-control: private, max-age=6900
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1155320
expires: Tue, 19 Oct 2021 08:43:59 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r4---sn-4g5lzne6.gvt1.com/videoplayback?id=c92ab3eb1806625e&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1634640239&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=31CA94E59D77E7A9AFBCD051F8EB05A2A93117E5.553D0E9CF10D2DAAD2932D5A55A871287A231E2F&key=cms1&cms_redirect=yes&mh=Eb&mip=216.131.114.192&mm=28&mn=sn-4g5lzne6&ms=nvh&mt=1634632576&mv=m&mvi=4&pl=24
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 702
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C116 1 KB
749 B 6ms
6ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 18 Oct 2021 08:58:57 GMT
expires: Tue, 19 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85502
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 38A7 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3414b62cfcae87254fb00ac1f835b1d17d19de439d4e8e1207007574f2c4ad5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 38A7 15 KB
15 KB 7ms
6ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 14:59:32 GMT
x-content-type-options: nosniff
age: 150267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 17 Oct 2022 14:59:32 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 38A7 15 KB
15 KB 7ms
7ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:31:40 GMT
x-content-type-options: nosniff
age: 490339
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 13 Oct 2022 16:31:40 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 38A7 15 KB
15 KB 7ms
7ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 54982
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 18 Oct 2022 17:27:37 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/14033136923120080826/ Frame 5BAF 10 KB
10 KB 13ms
13ms Image
image/jpeg 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14033136923120080826/downsize_200k_v1?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30463257fe1d90841fc59e37f8f3159869b5d25d783a8591995c69115582389c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 15:36:47 GMT
x-content-type-options: nosniff
age: 493632
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10543
x-xss-protection: 0
last-modified: Thu, 08 Apr 2021 15:47:57 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 13 Oct 2022 15:36:47 GMT

GET
DATA 200
OK truncated
/ Frame 5BAF 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 4F47 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 664c0ec9a605c8435e4abbcd0ab1bd986eaf937a187609db3d6ae2ec59b6979b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5BAF 0
0 52ms
52ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CmWO0ToVuYbbwGomArASIwbyQDoewxcRl9b3B1rAN8rWM8b4BEAEg49CDBmDJBqABr-jPzwHIAQmoAwHIA8sEqgTNAk_Qppc91nacbsyhZfw7QZ6qrw_uIbZSFYlBJsvkj4ZPUodN4jLp3MoGuxLlzp7ZiWiWsy-zGacQdBDbfoBxPtuqFqr-60h49_yigkT0EELxreiLaR1h8e4Do7CivtVQEBpGQrRI7iQiEGjMEq_vbMx2Z8cZcPDYtYw5fhk4LqsR8f8i9hhPIbhDl5o3q5mchXp53TDI4LWBXVgdNJI_NF9DJeChvfBxS049ApuwPXN6YwtXKPDYY8QXGoHtW_W3swX1YbAwW8PXDuDSZ17Ik7Z8AVdT7qisTNRAobBPwLuD8fYoZuAIU6Mf1_JcdOFog2TKw4ZC2ChhX8-3g9_fnJahh0rEocOiEKCEkXMFv1l95FWHgAwrxEV-lLs3_9Yjuxas39m3pKO0QMIkw-1thP5UBvEjhATxbb1JDjCNz1RKdrZA0hi_Kk4pYVq_qcAEx5y22LsDkgUECAQYAZIFBAgFGASgBi6AB7mXsLACqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBBDx2RvSCAcIgGEQARhfgAoByAsBuBOIJ9gTDYgUB9AVAZgWAYAXAbIXHAoaCAASFHB1Yi05NTUyMzE1OTU1MDY4Njc1GAA&sigh=0kA2LBsLETY&template_id=5000

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 rda_video_bg_pattern.png
googleads.g.doubleclick.net/pagead/images/ Frame 4F47 2 KB
2 KB 8ms
7ms Image
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/images/rda_video_bg_pattern.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7f42fd7e961148cbacb3643b669d55768ded74e587cd30d429a4e8112c05a5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 18 Oct 2021 11:01:12 GMT
x-content-type-options: nosniff
server: cafe
age: 78167
etag: 9923804599063086578
vary: Accept-Encoding
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2033
x-xss-protection: 0
expires: Tue, 19 Oct 2021 11:01:12 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/17130935227522362997/ Frame 4F47 2 KB
2 KB 14ms
13ms Image
image/png 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17130935227522362997/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5920c85fb035951583dd613873bb2d5686ab076a22477fb40767dc255faa56dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 23:22:05 GMT
x-content-type-options: nosniff
age: 552114
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1599
x-xss-protection: 0
last-modified: Fri, 14 May 2021 15:48:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 12 Oct 2022 23:22:05 GMT

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame DA2D 15 KB
15 KB 7ms
7ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 14:59:32 GMT
x-content-type-options: nosniff
age: 150267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 17 Oct 2022 14:59:32 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame DA2D 15 KB
15 KB 7ms
7ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:31:40 GMT
x-content-type-options: nosniff
age: 490339
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 13 Oct 2022 16:31:40 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame DA2D 15 KB
15 KB 8ms
7ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 54982
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 18 Oct 2022 17:27:37 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3BA7 1 KB
749 B 6ms
6ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 18 Oct 2021 08:58:57 GMT
expires: Tue, 19 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85502
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 5BAF 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4864f797891b0cb308f3497094fa679599141131e30cd7164e6861a36daecca9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 5BAF 21 KB
21 KB 9ms
8ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 08:44:05 GMT
x-content-type-options: nosniff
age: 604794
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Oct 2022 08:44:05 GMT

GET
H3 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 5BAF 21 KB
21 KB 7ms
7ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 04:08:17 GMT
x-content-type-options: nosniff
age: 16542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Oct 2022 04:08:17 GMT

GET
H3 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 4F47 21 KB
21 KB 7ms
7ms Font
font/woff2 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 08:44:05 GMT
x-content-type-options: nosniff
age: 604794
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Oct 2022 08:44:05 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 400A 35 B
464 B 27ms
9ms Image
image/gif 91.228.74.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMjrC1YMAWTh9J1P1UKcLVI&google_cver=1&google_push=AYg5qPLkBucaLSOgFNxLy8uNkT_5PJLndGqoDBy7YHW-EvKMCqYsrU-5ExOS8NVJjkC98Y9jCTj9thOUWYCqj_rwbz2EmH66PPKl

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.198 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 400A
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEJC-VFeLdedTEKtHy50Iw_4&google_cver=1&google_push=AYg5qPLXKsKs7QMxMPX1BcP00maTwh7WeJCbg0UP6g0MFfAuQnA3DYpcnIUqgtLEJlkfKfPp7tokeZCk6KhazgjV2XrnoO7RSB0K
https://rtb.openx.net/sync/dds?google_gid=CAESEJC-VFeLdedTEKtHy50Iw_4&google_cver=1&google_push=AYg5qPLXKsKs7QMxMPX1BcP00maTwh7WeJCbg0UP6g0MFfAuQnA3DYpcnIUqgtLEJlkfKfPp7tokeZCk6KhazgjV2XrnoO7RSB0K&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLXKsKs7QMxMPX1BcP00maTwh7WeJCbg0UP6g0MFfAuQnA3DYpcnIUqgtLEJlkfKfPp7tokeZCk6KhazgjV2XrnoO7RSB0K&google_hm=R80pa1fox5U39n6YBaGPlg==

170 B
188 B

26ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLXKsKs7QMxMPX1BcP00maTwh7WeJCbg0UP6g0MFfAuQnA3DYpcnIUqgtLEJlkfKfPp7tokeZCk6KhazgjV2XrnoO7RSB0K&google_hm=R80pa1fox5U39n6YBaGPlg==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLXKsKs7QMxMPX1BcP00maTwh7WeJCbg0UP6g0MFfAuQnA3DYpcnIUqgtLEJlkfKfPp7tokeZCk6KhazgjV2XrnoO7RSB0K&google_hm=R80pa1fox5U39n6YBaGPlg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: mev7locphcqckurh5eir4qjejtht23aj

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 400A
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

27ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJo7U3Kh1ZT_99CPrxKdET0HBU13__OlQGa9o4srWJz8AuQsCL1uhl8mSFplgZdoJSuYPqHuRiRv0n3vAwT4A6x9FEyeFQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJo7U3Kh1ZT_99CPrxKdET0HBU13__OlQGa9o4srWJz8AuQsCL1uhl8mSFplgZdoJSuYPqHuRiRv0n3vAwT4A6x9FEyeFQ
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 400A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEF6NF02OOSO2985vAj0MhXs&google_cver=1&google_push=AYg5qPLzaSONCWB_uqPcxxduaFYSu4ynletphWOn0V4kpLWiPR04vQ5BZPhJTvR3U4C8sZHF3EI...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxU00tVC1VWlI=&google_push=AYg5qPLzaSONCWB_uqPcxxduaFYSu4ynletphWOn0V4kpLWiPR04vQ5BZPhJTvR3U4C8sZHF3EIuWIaKTLWE2Pmrd8YRFOd27xeE

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxU00tVC1VWlI=&google_push=AYg5qPLzaSONCWB_uqPcxxduaFYSu4ynletphWOn0V4kpLWiPR04vQ5BZPhJTvR3U4C8sZHF3EIuWIaKTLWE2Pmrd8YRFOd27xeE

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxU00tVC1VWlI=&google_push=AYg5qPLzaSONCWB_uqPcxxduaFYSu4ynletphWOn0V4kpLWiPR04vQ5BZPhJTvR3U4C8sZHF3EIuWIaKTLWE2Pmrd8YRFOd27xeE
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 400A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_cver=1&google_gid=CAESEDuVAKqVXSrd49XZ1haPL8g&google_push=AYg5qPJzLHhZjzNPJwFEiLa3r2ePFPYe9B1O0...

0
0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 400A 0
43 B 325ms
232ms Image
text/plain 54.250.62.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEKZRhX4myhZhgtW-kbMRxEo&google_cver=1&google_push=AYg5qPKHUApVDikhsbRkaTTk298jq-CruQ162X-_w3V1acjqvL-Glz-PbZHzL3VjyrMgqNl-bmwLHxCjZOFsQT3b2C2zM_67Ejna
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.250.62.115 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-250-62-115.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: awselb/2.0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 400A
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEELSkXXEMPVEe0CfyMWz6Ho&google_cver=1&google_push=AYg5qPIJPW8qhL3_MkINwynV...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIJPW8qhL3_MkINwynVLLRD1MyXKrWMOxQ_3ZwQUHCqgPQ44FqaTu34B1ofcgk202I_8JVcFM2--sh12dweDU1FZZKhW2nQ&google_hm=

170 B
188 B

27ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIJPW8qhL3_MkINwynVLLRD1MyXKrWMOxQ_3ZwQUHCqgPQ44FqaTu34B1ofcgk202I_8JVcFM2--sh12dweDU1FZZKhW2nQ&google_hm=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIJPW8qhL3_MkINwynVLLRD1MyXKrWMOxQ_3ZwQUHCqgPQ44FqaTu34B1ofcgk202I_8JVcFM2--sh12dweDU1FZZKhW2nQ&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Mon, 18 Oct 2021 08:43:59 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 400A 0
12 B 23ms
22ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J2EKNOCYt0tKu2F0HE3S4ihGfDrKGrhRbT73W2AGSTewUNj81uZ63NDKJ3b3xtRyQtTpOm4g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8CDB
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHRY56iP5UnJ1wXuShQVu50&google_cver=1&google_push=AYg5qPIHexf-h_xbB1j-i-0yZaBs50bw-iYZMaMx0YUg3khhcGQyXOsl1C...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIHexf-h_xbB1j-i-0yZaBs50bw-iYZMaMx0YUg3khhcGQyXOsl1CaMN0VsTw-uAh3IxN-tkntWcbCCtij2idqWsjDv0UJq&google_hm=Vn9QVe...

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIHexf-h_xbB1j-i-0yZaBs50bw-iYZMaMx0YUg3khhcGQyXOsl1CaMN0VsTw-uAh3IxN-tkntWcbCCtij2idqWsjDv0UJq&google_hm=Vn9QVeftZSuqeMZRVFt5Uw

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIHexf-h_xbB1j-i-0yZaBs50bw-iYZMaMx0YUg3khhcGQyXOsl1CaMN0VsTw-uAh3IxN-tkntWcbCCtij2idqWsjDv0UJq&google_hm=Vn9QVeftZSuqeMZRVFt5Uw
pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 8CDB 42 B
317 B 16ms
14ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPIxbGYkA4lQ_Il7uCP1IT06EGUm0IBPvTfUtcixFOqYzSLMnmS0f-c9KD9ghb5j5w3wYndExe5jj3idQ1a56TVd7Jn6t53t&google_gid=CAESEDTO5K30cN9nfmAEcqm5BEw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 08:43:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8CDB
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEEyujGY4hA0c08ZVW5hdZB4&google_cver=1&google_push=AYg5qPIHm9rMSUkFXq4PNidXe8Z3Kma8PsGUPSz1-934XCHkXRq5o0erQUsdnvmkQ5v6WVrVnJjDeCuAQ11VxmBb-wWCwdHXoa4
https://rtb.openx.net/sync/dds?google_gid=CAESEEyujGY4hA0c08ZVW5hdZB4&google_cver=1&google_push=AYg5qPIHm9rMSUkFXq4PNidXe8Z3Kma8PsGUPSz1-934XCHkXRq5o0erQUsdnvmkQ5v6WVrVnJjDeCuAQ11VxmBb-wWCwdHXoa4&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIHm9rMSUkFXq4PNidXe8Z3Kma8PsGUPSz1-934XCHkXRq5o0erQUsdnvmkQ5v6WVrVnJjDeCuAQ11VxmBb-wWCwdHXoa4&google_hm=R80pa1fox5U39n6YBaGPlg==

170 B
188 B

28ms
27ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIHm9rMSUkFXq4PNidXe8Z3Kma8PsGUPSz1-934XCHkXRq5o0erQUsdnvmkQ5v6WVrVnJjDeCuAQ11VxmBb-wWCwdHXoa4&google_hm=R80pa1fox5U39n6YBaGPlg==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIHm9rMSUkFXq4PNidXe8Z3Kma8PsGUPSz1-934XCHkXRq5o0erQUsdnvmkQ5v6WVrVnJjDeCuAQ11VxmBb-wWCwdHXoa4&google_hm=R80pa1fox5U39n6YBaGPlg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 8dgtmeit708tttkj5s08cqqudqs0fooe

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8CDB
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

27ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJaKYIaTGPv353DW0FXT-BA7Gdq4Xtnef5ohGIGko-WtHKRM2U8MBpUJjpsR2v9rcD47b_Q41uLlInOBL7K7wWM-S3jc1KV

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJaKYIaTGPv353DW0FXT-BA7Gdq4Xtnef5ohGIGko-WtHKRM2U8MBpUJjpsR2v9rcD47b_Q41uLlInOBL7K7wWM-S3jc1KV
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8CDB
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKCENrPd1ycmZbd8tMoflLk&google_cver=1&google_push=AYg5qPK3ax2-fkD0EcnUdmqmzNNxkI0tfEari7RqPnggvdzgFZaYiPfqxGiu7Q_qjjnLvwshnmU...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxWDEtQy1GQ0xM&google_push=AYg5qPK3ax2-fkD0EcnUdmqmzNNxkI0tfEari7RqPnggvdzgFZaYiPfqxGiu7Q_qjjnLvwshnmU4vdZxaWJnEgB-RJxDrQduaHFj

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxWDEtQy1GQ0xM&google_push=AYg5qPK3ax2-fkD0EcnUdmqmzNNxkI0tfEari7RqPnggvdzgFZaYiPfqxGiu7Q_qjjnLvwshnmU4vdZxaWJnEgB-RJxDrQduaHFj

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:44:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxWDEtQy1GQ0xM&google_push=AYg5qPK3ax2-fkD0EcnUdmqmzNNxkI0tfEari7RqPnggvdzgFZaYiPfqxGiu7Q_qjjnLvwshnmU4vdZxaWJnEgB-RJxDrQduaHFj
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 8CDB
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIZ1SwA0JV4OeY26RdKRVT4&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEIZ1SwA0JV4OeY26RdKRVT4&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YW6FT9W14qLwzL36FNlvFAAABFUAAAAB&google_push=AYg5qPI5JIFtwCGpHyt1Hky25Jjg2MS0motgimpoXCHD_JX1jxz3OCJpQhdGMGdr6-NUUR2uIXFpDb9xxxTu04eaKl...

0
0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 8CDB 0
43 B 298ms
231ms Image
text/plain 54.250.62.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEDgZtoEJKmUZ4p7Y9m61dL8&google_cver=1&google_push=AYg5qPI6cPnF4GPSLOV-0Oo5-GkG9pSr_HpJeokRR0zkfdVHNh1R3j4FJXTyItEtsRcLOGKGgvPdaKFWeOZDwN8H_wI1UlqEtXe-
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.250.62.115 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-250-62-115.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: awselb/2.0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8CDB 0
12 B 24ms
23ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LItv7uN6EN6AovnENZmTceZzWfsAJEGwhiQvSqpfCjiI-OlYW5GY8-0bV_exoA3mtmDSao

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5598
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

99ms
99ms

Document
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: DSID=NO_DATA; IDE=AHWqTUngz1jPTV_hseBU4SLd0-W6KJyWS690bacjrm8qpF2A_6W3b_sJis9rKqcdAx4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 19 Oct 2021 08:43:59 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 19-Oct-2021 09:43:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 19 Oct 2021 08:43:59 GMT
server: safe
content-length: 257
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C116
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENzlUJhhMmJ-WnECK_KnZ3A&google_cver=1&google_push=AYg5qPKsvx2u-DAZFI9tDP3J55P0CZq34RJg6fT7qU_yScAuH9yfiralIZ...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKsvx2u-DAZFI9tDP3J55P0CZq34RJg6fT7qU_yScAuH9yfiralIZjSwZzmsX9xBUo3pkuFwUU-jJcEKB-CjiPwbpcF4G_B&google_hm=Vn9QVe...

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKsvx2u-DAZFI9tDP3J55P0CZq34RJg6fT7qU_yScAuH9yfiralIZjSwZzmsX9xBUo3pkuFwUU-jJcEKB-CjiPwbpcF4G_B&google_hm=Vn9QVeftZSuqeMZRVFt5Uw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKsvx2u-DAZFI9tDP3J55P0CZq34RJg6fT7qU_yScAuH9yfiralIZjSwZzmsX9xBUo3pkuFwUU-jJcEKB-CjiPwbpcF4G_B&google_hm=Vn9QVeftZSuqeMZRVFt5Uw
pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C116
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJ28_HnTDwxmX_-tKNQmIKY1tfEeyKei8TUpYU...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVc2RlR3QUFCV0NUS1Q5Tg&google_push=AYg5qPJ28_HnTDwxmX_-tKNQmIKY1tfEeyKei8TUpYUtRuLAUgmeWglBCOmhPsNTjLSHqhve7hi0uXXllzQJBNBYt_E8nU7pw9uB

170 B
188 B

35ms
35ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVc2RlR3QUFCV0NUS1Q5Tg&google_push=AYg5qPJ28_HnTDwxmX_-tKNQmIKY1tfEeyKei8TUpYUtRuLAUgmeWglBCOmhPsNTjLSHqhve7hi0uXXllzQJBNBYt_E8nU7pw9uB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:44:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVc2RlR3QUFCV0NUS1Q5Tg&google_push=AYg5qPJ28_HnTDwxmX_-tKNQmIKY1tfEeyKei8TUpYUtRuLAUgmeWglBCOmhPsNTjLSHqhve7hi0uXXllzQJBNBYt_E8nU7pw9uB
Date: Tue, 19 Oct 2021 08:43:59 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C116
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEMUTfO0Cr8AvPWCRWb4IBW8&google_cver=1&google_push=AYg5qPLaA8VxmOU5EPJWCh6tOKAWqL7vOhc2nFy6HlNDFlK9VTAZcsIZ1kErOpagiT1iNVuduY_q6elJmlSUY7_WbcbCZIO8ufic
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLaA8VxmOU5EPJWCh6tOKAWqL7vOhc2nFy6HlNDFlK9VTAZcsIZ1kErOpagiT1iNVuduY_q6elJmlSUY7_WbcbCZIO8ufic&google_hm=Q0FFU0VNVVRmTzBDcjhBd...

170 B
188 B

26ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLaA8VxmOU5EPJWCh6tOKAWqL7vOhc2nFy6HlNDFlK9VTAZcsIZ1kErOpagiT1iNVuduY_q6elJmlSUY7_WbcbCZIO8ufic&google_hm=Q0FFU0VNVVRmTzBDcjhBdlBXQ1JXYjRJQlc4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 08:43:58 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLaA8VxmOU5EPJWCh6tOKAWqL7vOhc2nFy6HlNDFlK9VTAZcsIZ1kErOpagiT1iNVuduY_q6elJmlSUY7_WbcbCZIO8ufic&google_hm=Q0FFU0VNVVRmTzBDcjhBdlBXQ1JXYjRJQlc4
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C116
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEHjzDSJrh5F7iM93SLKkla8&google_cver=1&google_push=AYg5qPKEPGJc_ezfHscEcnezQnflhJwhF08E7kH251pUEnW-3laQ3ONl9sGyUSxAX9RYTQKzm0JM1BOjSziH_ayq9gygCyOcY4td
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKEPGJc_ezfHscEcnezQnflhJwhF08E7kH251pUEnW-3laQ3ONl9sGyUSxAX9RYTQKzm0JM1BOjSziH_ayq9gygCyOcY4td&google_hm=Y25pPFPgwY02K34zEYq3MQ==

170 B
188 B

25ms
24ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKEPGJc_ezfHscEcnezQnflhJwhF08E7kH251pUEnW-3laQ3ONl9sGyUSxAX9RYTQKzm0JM1BOjSziH_ayq9gygCyOcY4td&google_hm=Y25pPFPgwY02K34zEYq3MQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKEPGJc_ezfHscEcnezQnflhJwhF08E7kH251pUEnW-3laQ3ONl9sGyUSxAX9RYTQKzm0JM1BOjSziH_ayq9gygCyOcY4td&google_hm=Y25pPFPgwY02K34zEYq3MQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: giujtd6on8vgbedoucltdf7pos43bc2b

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C116
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHH45Iq2515-kJlTWUOTRYk&google_cver=1&google_push=AYg5qPIpk56cZwyRbsXGvfUgW1Hit9sWFaY3oal4WdREeyDDUDdrhZJG474-S6Nn6T7qGWYXEgw...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxWVItMUctQlhPUw==&google_push=AYg5qPIpk56cZwyRbsXGvfUgW1Hit9sWFaY3oal4WdREeyDDUDdrhZJG474-S6Nn6T7qGWYXEgw-SVerkFMYKFd_U5hi3sWmRKlm

170 B
188 B

28ms
27ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxWVItMUctQlhPUw==&google_push=AYg5qPIpk56cZwyRbsXGvfUgW1Hit9sWFaY3oal4WdREeyDDUDdrhZJG474-S6Nn6T7qGWYXEgw-SVerkFMYKFd_U5hi3sWmRKlm

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:44:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIxWVItMUctQlhPUw==&google_push=AYg5qPIpk56cZwyRbsXGvfUgW1Hit9sWFaY3oal4WdREeyDDUDdrhZJG474-S6Nn6T7qGWYXEgw-SVerkFMYKFd_U5hi3sWmRKlm
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Expires: 0

GET
H2 200 trk
ag.innovid.com/ Frame C116 43 B
297 B 117ms
21ms Image
image/gif 18.168.50.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESENfPzJjjl66XaVjE0BGuqaA&google_cver=1&google_push=AYg5qPKp3XTFhvK4VOb0K9Kco6yllikGBuR2kQCFn4ivS3Jb4auXZmu3xltRFhpyvtqG7eonHrAd5zm14EYVFlRoEqrSkU45r6Y
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.50.255 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-50-255.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame C116 0
43 B 283ms
232ms Image
text/plain 54.250.62.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEGpRoh6Jn1aNi_1xeK2_wtY&google_cver=1&google_push=AYg5qPLIQlGHoEwcIl6lQYslCNFxOT3ABj8QPwy3QSgVV6tUdQbxso5cX6ybKfHOQTkQsLdIYCGrYr20WC7gRNvVG8dgiwLD_ZAi
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=240&adk=1173128844&adf=1243682051&pi=t.aa~a.4280498718~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1616194329&rafmt=1&to=qs&pwprc=5610257074&psa=0&format=300x240&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=0&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280%2C909x280&nras=6&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1130&ady=1823&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=tFJxIepjeF&p=https%3A//www.thespoof.com&dtd=30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.250.62.115 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-250-62-115.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: awselb/2.0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C116 0
12 B 27ms
23ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JBr5TdlzhTOdGP4PtNWXVSBXBeO45YmIYU2ffJIyEGDO03lc5Y7Aqq1fb1HpPHgeXvKTDA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 9A2D 35 KB
13 KB 7ms
6ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=3175172783&pi=t.aa~a.1708805249~i.9~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=908&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=2&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0&nras=2&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=vARJXKsjZw&p=https%3A//www.thespoof.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1983
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 08:10:56 GMT

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 13E3 35 KB
13 KB 7ms
7ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=323648396&pi=t.aa~a.1708805249~i.20~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=873&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280&nras=4&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2450&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=wKlLoZoumM&p=https%3A//www.thespoof.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1983
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 08:10:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BA7
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAnvWMEZ0LAt5Pv2vND1sUk&google_cver=1&google_push=AYg5qPKkFFp7pMZzO2Y-0twHJTXmuDo5TSugliopIwV8pT6fdqD4m0NUjo...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkFFp7pMZzO2Y-0twHJTXmuDo5TSugliopIwV8pT6fdqD4m0NUjout1H85dxz1B7JbLZpUEa4fcsSpBPKl8SUEfs-aojqX&google_hm=Vn9QVe...

170 B
188 B

26ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkFFp7pMZzO2Y-0twHJTXmuDo5TSugliopIwV8pT6fdqD4m0NUjout1H85dxz1B7JbLZpUEa4fcsSpBPKl8SUEfs-aojqX&google_hm=Vn9QVeftZSuqeMZRVFt5Uw

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkFFp7pMZzO2Y-0twHJTXmuDo5TSugliopIwV8pT6fdqD4m0NUjout1H85dxz1B7JbLZpUEa4fcsSpBPKl8SUEfs-aojqX&google_hm=Vn9QVeftZSuqeMZRVFt5Uw
pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BA7
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEHPaXzg8sp1N0DRjiUnYCfg&google_cver=1&google_push=AYg5qPJ5hc9naGjZe1AaN6CTRnWssw9EI298ZjVMEOYBc4o3-NEjXWaMrvfHpCCGPMh8TwxDCMedinNoffrGa3TTXG-BG_K6QGWt
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJ5hc9naGjZe1AaN6CTRnWssw9EI298ZjVMEOYBc4o3-NEjXWaMrvfHpCCGPMh8TwxDCMedinNoffrGa3TTXG-BG_K6QGWt&google_hm=Q0FFU0VIUGFYemc4c3AxT...

170 B
188 B

26ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJ5hc9naGjZe1AaN6CTRnWssw9EI298ZjVMEOYBc4o3-NEjXWaMrvfHpCCGPMh8TwxDCMedinNoffrGa3TTXG-BG_K6QGWt&google_hm=Q0FFU0VIUGFYemc4c3AxTjBEUmppVW5ZQ2Zn

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 08:43:59 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJ5hc9naGjZe1AaN6CTRnWssw9EI298ZjVMEOYBc4o3-NEjXWaMrvfHpCCGPMh8TwxDCMedinNoffrGa3TTXG-BG_K6QGWt&google_hm=Q0FFU0VIUGFYemc4c3AxTjBEUmppVW5ZQ2Zn
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 3BA7 42 B
306 B 16ms
14ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPIX5-jzXwOkaGHkHyUlHzOiup0sUbgcoqCR2B4dpX_I5E75ZqVuXytZ_1hHWIAZeNGOP8Q6HAwnHyOmI8mjYmVQbZuwFSvq&google_gid=CAESEDdjzMIIQfef-mYJIah3vsE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 08:43:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 3BA7 43 B
611 B 34ms
15ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEGILXOUqP2lEOs2AYgP-k-Y&google_cver=1&google_push=AYg5qPLvreVEq82LJYXCyqxavLMRPlj2d3_FWGIWzxZnuyC5BDHY8XMYGvXCvZi4o8d_9NqYprdEYtAlDTZSzlyvOfFssadOAfk
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BA7
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFecnky02tEvAKhSYQLgB6Q&google_cver=1&google_push=AYg5qPLdxt478E7G6BHhMHceqc5Sz9sYuW6TtISpwcbwR5pdco_Vz62FGTW9wIQRmmy2GWzdomwcJP4zi9gEu6pJMw-rD-CXOiE
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLdxt478E7G6BHhMHceqc5Sz9sYuW6TtISpwcbwR5pdco_Vz62FGTW9wIQRmmy2GWzdomwcJP4zi9gEu6pJMw-rD-CXOiE&google_hm=R80pa1fox5U39n6YBaGPlg==

170 B
188 B

27ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLdxt478E7G6BHhMHceqc5Sz9sYuW6TtISpwcbwR5pdco_Vz62FGTW9wIQRmmy2GWzdomwcJP4zi9gEu6pJMw-rD-CXOiE&google_hm=R80pa1fox5U39n6YBaGPlg==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLdxt478E7G6BHhMHceqc5Sz9sYuW6TtISpwcbwR5pdco_Vz62FGTW9wIQRmmy2GWzdomwcJP4zi9gEu6pJMw-rD-CXOiE&google_hm=R80pa1fox5U39n6YBaGPlg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: hqok2sbi7v77sgulledfdgq7uj0qki99

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BA7
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLZSm3LfPZxa0eMN0EKq6jpdZtjHHxju-C7v2k9EgbGY2_Wv-nXbWzDeXPCXfUtayCfgr1vCDZMMa0JBocwCq1SdbAuVIaH

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=As2neM_DTnSXKXVOgmWUjQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLZSm3LfPZxa0eMN0EKq6jpdZtjHHxju-C7v2k9EgbGY2_Wv-nXbWzDeXPCXfUtayCfgr1vCDZMMa0JBocwCq1SdbAuVIaH
date: Tue, 19 Oct 2021 08:43:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BA7
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK9Mj5NnQejCUzkJWMybtlU&google_cver=1&google_push=AYg5qPJsn8wH0NdV_guktPxBhr8XlYnAnpE-HPX_y64YW-fZZXSrKip0G4-L4dHpdKTMELEPe2S...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIyMDctTi1BUFZC&google_push=AYg5qPJsn8wH0NdV_guktPxBhr8XlYnAnpE-HPX_y64YW-fZZXSrKip0G4-L4dHpdKTMELEPe2S65TO2SyzcI_NcTHW6QZ-4RUqV

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIyMDctTi1BUFZC&google_push=AYg5qPJsn8wH0NdV_guktPxBhr8XlYnAnpE-HPX_y64YW-fZZXSrKip0G4-L4dHpdKTMELEPe2S65TO2SyzcI_NcTHW6QZ-4RUqV

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 08:44:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VYVUIyMDctTi1BUFZC&google_push=AYg5qPJsn8wH0NdV_guktPxBhr8XlYnAnpE-HPX_y64YW-fZZXSrKip0G4-L4dHpdKTMELEPe2S65TO2SyzcI_NcTHW6QZ-4RUqV
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3BA7 0
12 B 30ms
29ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IasS1xu0NGStMceKvFddno60eTRjydfnss4Y3UWEJE1obWJPjqM5GP0xzMuLdnNHcOr3Lw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:43:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame AA8B 35 KB
13 KB 7ms
6ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9552315955068675&output=html&h=280&adk=1844542946&adf=2938316776&pi=t.aa~a.1708805249~i.21~rp.4&w=909&fwrn=4&fwrnh=100&lmt=1616194329&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=5610257074&psa=0&ad_type=text_image&format=909x280&url=https%3A%2F%2Fwww.thespoof.com%2Fspoof-news%2Fus%2F152694%2Ffauci-to-hit-the-road-with-song-and-dance-routine-to-promote-jabs&flash=0&fwr=0&pra=3&rh=200&rw=909&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634633038396&bpp=1&bdt=872&idt=-M&shv=r20211013&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7f47986854a5ed23-22a1d2faf8ca003f%3AT%3D1634633037%3ART%3D1634633037%3AS%3DALNI_MbjWgoYdEKSb7s4fKZ9bBHTC_4wTA&prev_fmts=0x0%2C909x280%2C909x280%2C909x280&nras=5&correlator=528618447351&frm=20&pv=1&ga_vid=1511157247.1634633038&ga_sid=1634633038&ga_hid=1119162920&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=170&ady=2786&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=1199803616806719&pem=273&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=OJwZ1DiEGW&p=https%3A//www.thespoof.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1983
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 08:10:56 GMT

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame B145 35 KB
13 KB 7ms
6ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 08:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1983
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 08:10:56 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8F90 42 B
64 B 29ms
28ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstwmE466OhZb4RBOkpyqmhhp0JTxNdmwqORyPgDR_vos6akrY0Qe54DoCaCuILriTn0gEkBUgqAVwKn5rLJTVaEti6f99qQ6yEMQTqurIxBh_jjZpo&sai=AMfl-YQHQgpl54QL23k5a1uq2edD7EwpWVTwYM2cd0Gyh9G96iNPHLuAkd0eKlD_zqGy_KXND1ra1T-WNB-6&sig=Cg0ArKJSzNaUkHXXuRfJEAE&id=lidar2&mcvt=1001&p=0,1,125,1006&mtos=0,751,1001,1135,1275&tos=0,751,250,134,140&v=20211013&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634633038446&rpt=130&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS