www.leaksbydaylight.com Open in urlscan Pro
2606:4700:3036::ac43:ae59 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.leaksbydaylight.com/
Effective URL:
https://www.leaksbydaylight.com/
Submission: On December 01 via manual (December 1st 2021, 2:05:46 am UTC) from US — Scanned from DE

Summary HTTP 182 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 20 IPs in 3 countries across 20 domains to perform 182 HTTP transactions. The main IP is 2606:4700:3036::ac43:ae59, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.leaksbydaylight.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2021. Valid for: a year.

This is the only time www.leaksbydaylight.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 29	2606:4700:303... 2606:4700:3036::ac43:ae59	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
28	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
7	2606:4700::68... 2606:4700::6812:e134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
26	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
31	2a00:1450:400... 2a00:1450:4001:829::2001	15169 (GOOGLE) (GOOGLE)
3 7	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
4 5	2620:116:800d... 2620:116:800d:21:3175:5196:e3fd:8c1d	16509 (AMAZON-02) (AMAZON-02)
4 4	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
24	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
5	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
6 6	198.47.127.19 198.47.127.19	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4 4	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	79.137.68.187 79.137.68.187	16276 (OVH) (OVH)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
3	2600:1f14:d24... 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
1 1	3.221.239.181 3.221.239.181	14618 (AMAZON-AES) (AMAZON-AES)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
182	20

29 2606:4700:3036::ac43:ae59 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.leaksbydaylight.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:116:800d:21:3175:5196:e3fd:8c1d (United States) 4 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.215.191 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 198.47.127.19 (United States) 6 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.138 (Frankfurt am Main, Germany) 4 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 79.137.68.187 (France) 2 redirects

ASN16276 (OVH, FR)
PTR: gcm9.host.hit.gemius.pl

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c (Boardman, United States)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.221.239.181 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-221-239-181.compute-1.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	788 KB
45	doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	262 KB
29	leaksbydaylight.com 1 redirects www.leaksbydaylight.com	1 MB
10	google.com 3 redirects adservice.google.com www.google.com	2 KB
8	onesignal.com cdn.onesignal.com onesignal.com img.onesignal.com	228 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	108 KB
6	pubmatic.com 6 redirects image6.pubmatic.com	3 KB
5	openx.net rtb.openx.net	606 B
5	quantserve.com 4 redirects cms.quantserve.com	2 KB
5	googletagservices.com www.googletagservices.com	182 KB
4	rubiconproject.com 4 redirects pixel.rubiconproject.com	2 KB
4	addthis.com 4 redirects e.dlx.addthis.com	3 KB
4	googleapis.com fonts.googleapis.com ajax.googleapis.com	32 KB
3	rlcdn.com 2 redirects id.rlcdn.com	1 KB
3	innovid.com ag.innovid.com	886 B
3	google.de adservice.google.de	1 KB
2	gemius.pl 2 redirects googlecm.hit.gemius.pl	553 B
1	mookie1.com odr.mookie1.com	324 B
1	everesttech.net 1 redirects pixel.everesttech.net	378 B
1	googleadservices.com partner.googleadservices.com	642 B
182	20

	Domain	Requested by
31	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
29	www.leaksbydaylight.com	1 redirects www.leaksbydaylight.com
24	cm.g.doubleclick.net	googleads.g.doubleclick.net
23	pagead2.googlesyndication.com	www.leaksbydaylight.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
21	googleads.g.doubleclick.net	pagead2.googlesyndication.com ajax.googleapis.com googleads.g.doubleclick.net
7	www.google.com	3 redirects tpc.googlesyndication.com googleads.g.doubleclick.net
6	image6.pubmatic.com	6 redirects
5	rtb.openx.net	googleads.g.doubleclick.net
5	cms.quantserve.com	4 redirects googleads.g.doubleclick.net
5	www.googletagservices.com	googleads.g.doubleclick.net
4	fonts.gstatic.com	fonts.googleapis.com
4	pixel.rubiconproject.com	4 redirects
4	e.dlx.addthis.com	4 redirects
4	cdn.onesignal.com	www.leaksbydaylight.com cdn.onesignal.com
3	id.rlcdn.com	2 redirects googleads.g.doubleclick.net
3	ag.innovid.com	googleads.g.doubleclick.net
3	onesignal.com	cdn.onesignal.com
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.de	pagead2.googlesyndication.com
3	fonts.googleapis.com	www.leaksbydaylight.com googleads.g.doubleclick.net
2	www.gstatic.com	googleads.g.doubleclick.net
2	googlecm.hit.gemius.pl	2 redirects
1	img.onesignal.com
1	odr.mookie1.com	googleads.g.doubleclick.net
1	pixel.everesttech.net	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	ajax.googleapis.com	www.leaksbydaylight.com
182	27

This site contains links to these domains. Also see Links.

Domain
leaksbydaylight.com
twitter.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-18` - `2022-07-17`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh

This page contains 31 frames:

Primary Page: https://www.leaksbydaylight.com/
Frame ID: 82FEC3C8A7A47DB28270E0FD73DE6B9F
Requests: 59 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html
Frame ID: 57595748F7550EF9D4A23BADD805BFD7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&adk=1812271804&adf=3025194257&lmt=1638324302&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339028&bpp=4&bdt=247&idt=158&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3392548976435&frm=20&pv=2&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=199
Frame ID: B26AF86CFD3A4D7FCD77C28F2439D923
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15
Frame ID: AB8860563C709D3F600A06DC96ABAE7D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40
Frame ID: 345DA0C3106E672EE4A2B2397448A987
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44
Frame ID: F73381BD479E198AE246F3FB170FB172
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49
Frame ID: 697540E72DF1243247A0764B3A0F36DC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74
Frame ID: 2B03FEABA7AEEEB96B515689BE20252A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15
Frame ID: 127CE8D0E4C5B63AD9FFB4E8B4AF2B40
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40
Frame ID: 97F330D3C10D9F986290EA15236B4188
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44
Frame ID: 0AA236F1AFB343CEC11FC665C62B4952
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49
Frame ID: 209DD2F1AF773EC6272E1FC2E7987294
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74
Frame ID: AB0C79B37562C52F653451A1E9031846
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&adk=1812271804&adf=3025194257&lmt=1638324302&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339028&bpp=4&bdt=247&idt=158&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3392548976435&frm=20&pv=2&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=199
Frame ID: 6BFC4F4EAC293759F9EB1BCE1448434E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html
Frame ID: B012CAA9923F012886666AC0E3DF8087
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
Frame ID: 4EF086657ACCDA7D4792A02D81041711
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: D345C2633152EC16C65F3AABDF198ABA
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: BE85A82A3004AAAA090F2D30A866AB4E
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 2FB9937F8EE6F673252754A4F532DF9F
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 7BD3FFB30A0325DD589C4EFFB6FD519D
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Frame ID: D322BCDAA416C9786B5CA9438456B1AF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: E2EED418E4408972865117CFF77D4695
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C17698187E7694DAB01D4FFB401B9290
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 0598117630F14A1B1A75B94F09A77E8F
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 64CE297AAB66EDD5FE87ACF758296BDE
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5556A893711AD0E4D508FD40452BF4B4
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Frame ID: 6D3EC920C5265FD323B4C9C649F0D11E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2CCDCBBED8CD383C970D0260975C43DD
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Frame ID: 95E66DFD7CBA71A34409F3038855117E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Frame ID: 586FC3A3F527DC318E4144BEC2766F74
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Frame ID: DE65FFEFA2DE063A73447EC030AC9A57
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LeaksByDaylight - Dead by Daylight Leaks, News and More!

Page URL History Show full URLs

http://www.leaksbydaylight.com/ HTTP 301
https://www.leaksbydaylight.com/ Page URL

Page Statistics

182
Requests

84 %
HTTPS

58 %
IPv6

20
Domains

27
Subdomains

20
IPs

3
Countries

2854 kB
Transfer

6250 kB
Size

23
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://leaksbydaylight.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://leaksbydaylight.com/terms-and-conditions/
Title: Terms and Conditions

Search URL Search Domain Scan URL

URL: http://leaksbydaylight.com/cookie-policy/
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://twitter.com/leaksbydaylight

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.leaksbydaylight.com/ HTTP 301
https://www.leaksbydaylight.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 82

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKsbz2Xsrrd5oTQ8lxkWd884Iwzb6p5EiwQLD_jmngFXDdbCv0L8YI3oTUHywzzPq9R8JhF0-1sFbV8wL8PbTNaxM3LO-VNgw&google_gid=CAESEOVd4ipBBJj1YjYUOxgdj0w&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKsbz2Xsrrd5oTQ8lxkWd884Iwzb6p5EiwQLD_jmngFXDdbCv0L8YI3oTUHywzzPq9R8JhF0-1sFbV8wL8PbTNaxM3LO-VNgw&google_gid=CAESEOVd4ipBBJj1YjYUOxgdj0w&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDA3OTg0NzU5MTU2Mw%3D%3D&google_push=AYg5qPKsbz2Xsrrd5oTQ8lxkWd884Iwzb6p5EiwQLD_jmngFXDdbCv0L8YI3oTUHywzzPq9R8JhF0-1sFbV8wL8PbTNaxM3LO-VNgw

Request Chain 84

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEITqiYTm2TvzGAA_tL_vxbk&google_cver=1&google_push=AYg5qPKCE-wsgA_rDNovmGVdODFEnVe8AJNoVAYzGfYXk62qiZbEnZABJCdqy3kgAXh7pA5_pGWbisLHe9N9BnD9ZK7YHo0v6Or2zg HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEITqiYTm2TvzGAA_tL_vxbk&google_cver=1&google_push=AYg5qPKCE-wsgA_rDNovmGVdODFEnVe8AJNoVAYzGfYXk62qiZbEnZABJCdqy3kgAXh7pA5_pGWbisLHe9N9BnD9ZK7YHo0v6Or2zg&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKCE-wsgA_rDNovmGVdODFEnVe8AJNoVAYzGfYXk62qiZbEnZABJCdqy3kgAXh7pA5_pGWbisLHe9N9BnD9ZK7YHo0v6Or2zg

Request Chain 85

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHZcXoBOKa0LE05QkIxC2qI&google_cver=1&google_push=AYg5qPIVAlYD25t3szaNvmOlWU14tPY44OqSMFrc2ctw5Ubp84kSN-RJS7A1MQOBaDc3wDWbIIGBMqL7wKm9M665FXeXWkdCnZu9Ng HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGUjAtQy04SjNW&google_push=AYg5qPIVAlYD25t3szaNvmOlWU14tPY44OqSMFrc2ctw5Ubp84kSN-RJS7A1MQOBaDc3wDWbIIGBMqL7wKm9M665FXeXWkdCnZu9Ng

Request Chain 86

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1

Request Chain 87

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEHee31E53gJzgnxU9aXMaeM&google_cver=1&google_push=AYg5qPJAi3zVpYN-60bioNY2t4YFF8yRkSwZ4tbFy9dH4R8dnkoKTNZIdD-3iFUBFiWI9zqs5Gijb-B4fD1yNpayeLFYPrhUXOJTjNY HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJAi3zVpYN-60bioNY2t4YFF8yRkSwZ4tbFy9dH4R8dnkoKTNZIdD-3iFUBFiWI9zqs5Gijb-B4fD1yNpayeLFYPrhUXOJTjNY&google_hm=

Request Chain 92

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 128

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOqSnJJ442PzsT83XgIJ_kE&google_cver=1&google_push=AYg5qPJfKnofm60WHucd6J3UxyT8hVgc5PQe0JHYV6SzI5t6s2u1HIw3NhreLnmDVumWpjCVs1YUwAMbs8sQoa-YdOyScmqgnoA HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJfKnofm60WHucd6J3UxyT8hVgc5PQe0JHYV6SzI5t6s2u1HIw3NhreLnmDVumWpjCVs1YUwAMbs8sQoa-YdOyScmqgnoA&google_hm=CuGGYAbMVUFgIN8exLjU5g

Request Chain 129

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIRDS6x6ZurGZlSDLTLDjdWD-ce9XNg23J56Wh7foH1INQv51_SeQq2coR6LhKowsSH9jn1Un7TMewtxowRWmZ_GFs4OkY&google_gid=CAESELaPjK7RsG0J6B_UNhnVkF4&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIRDS6x6ZurGZlSDLTLDjdWD-ce9XNg23J56Wh7foH1INQv51_SeQq2coR6LhKowsSH9jn1Un7TMewtxowRWmZ_GFs4OkY&google_gid=CAESELaPjK7RsG0J6B_UNhnVkF4&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDAxNzE1NjI1NTAzMw%3D%3D&google_push=AYg5qPIRDS6x6ZurGZlSDLTLDjdWD-ce9XNg23J56Wh7foH1INQv51_SeQq2coR6LhKowsSH9jn1Un7TMewtxowRWmZ_GFs4OkY

Request Chain 131

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESED5YbP1TEJzmTU9lxcX3BxE&google_cver=1&google_push=AYg5qPINDGNnufOcoTdhCotJ44xDRo6JoV4Jovq6lakiIhqQrL65JFmJWpUnlIC4HY4ka6RZG2YX-UyRzqs_gf94kpW_nPng_Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPINDGNnufOcoTdhCotJ44xDRo6JoV4Jovq6lakiIhqQrL65JFmJWpUnlIC4HY4ka6RZG2YX-UyRzqs_gf94kpW_nPng_Q

Request Chain 132

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEP4Sz_sXx1I8p2y90ivJvJ8&google_cver=1&google_push=AYg5qPKEloLlukuHNmXkAhM__x2DwrWbGXKw-lVepxrSnXJ4bVwNIkNGX23cGkZPwmHZZTE8lrAfZVOTg8adYBzaScGzxBMWaQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGV1ItMVItNFBURA==&google_push=AYg5qPKEloLlukuHNmXkAhM__x2DwrWbGXKw-lVepxrSnXJ4bVwNIkNGX23cGkZPwmHZZTE8lrAfZVOTg8adYBzaScGzxBMWaQ

Request Chain 133

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU&google_cver=1&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU

Request Chain 142

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 154

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOkSfwrOqBbgBF-165Lru0U&google_cver=1&google_push=AYg5qPJHPWfdLV8Q0kYijz_YHcO9JbiQaH-7MyQhVzWFSdX-o3pyEwHTPtdPfC323rAxa6hEl13WDI3qSUZeihpMAe6EHMfuVGsI HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJHPWfdLV8Q0kYijz_YHcO9JbiQaH-7MyQhVzWFSdX-o3pyEwHTPtdPfC323rAxa6hEl13WDI3qSUZeihpMAe6EHMfuVGsI&google_hm=CuGGYAbMVUFgIN8exLjU5g

Request Chain 155

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJ7rKyjP4jHf6HU72lJ2KOXWWcctaroJMegQAPjP85gUqHqpmemSNOu_O3JQ3R5np1SpBtpQ_yHwEC5U0ZFuirDzpKg50iFxw&google_gid=CAESEJRhVhiR0JpqsC04B4szU54&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFiWWRRQUFCYk5aN1ZOaQ&google_push=AYg5qPJ7rKyjP4jHf6HU72lJ2KOXWWcctaroJMegQAPjP85gUqHqpmemSNOu_O3JQ3R5np1SpBtpQ_yHwEC5U0ZFuirDzpKg50iFxw

Request Chain 158

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEOQGn67PJeEyS5BAd76dtUU&google_cver=1&google_push=AYg5qPKGd3Kr9jwv50ofiGtyOFYEFQaAixssET9TMRjFFG3gAt8dPy-imXTa-CmstV0ayAQQLw8RCnnCpCIlv9stHZfiX5gxMCODjg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKGd3Kr9jwv50ofiGtyOFYEFQaAixssET9TMRjFFG3gAt8dPy-imXTa-CmstV0ayAQQLw8RCnnCpCIlv9stHZfiX5gxMCODjg

Request Chain 159

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1

Request Chain 162

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEI2xb9LSUI1wv-Fw0IXseOM&google_cver=1&google_push=AYg5qPJVPYLOzVXsu1LCefmeowaTullOZv3aRCllOqHnWtV9YSjPu-iOJlijAl2ecUEbLug0dRtomS3rOMQwrR9KIluYK6AEe_w HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJVPYLOzVXsu1LCefmeowaTullOZv3aRCllOqHnWtV9YSjPu-iOJlijAl2ecUEbLug0dRtomS3rOMQwrR9KIluYK6AEe_w&google_hm=CuGGYAbMVUFgIN8exLjU5g

Request Chain 163

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPKk9vmAwEO4_CWKA4dSbu09oqRBYUPEP2W6SqZrOwGKQ-TNOPPVP9hQK3gGQ_Bodcq63c2NZqT-02PkRxHu3zQ-4KnG5PY&google_gid=CAESEPY5xWvxtKHsHyUK0Zmb4Sc&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPWwm40GEgUI6AcQAEIASm9nb29nbGVfcHVzaD1BWWc1cVBLazl2bUF3RU80X0NXS0E0ZFNidTA5b3FSQllVUEVQMlc2U3Fack93R0tRLVROT1BQVlA5aFFLM2dHUV9Cb2RjcTYzYzJOWnFULTAyUGtSeEh1M3pRLTRLbkc1UFk HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTzMwa09CUHdnakIxa2JWTGhNWDVMVDR0bmpTT3lpdFlaZ1Vnc01lRmxtYw==&google_push

Request Chain 165

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEMx08NSguk8UTggtUjabYMo&google_cver=1&google_push=AYg5qPJMx9q4IDORLI4VIiQv94JqVGnYJFFLp2fQfuTjEpoJi76GRDdvzsVddPlWfWYDnBxAtd6fQG9jRaePjy5-D3l5e_Raq18 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJMx9q4IDORLI4VIiQv94JqVGnYJFFLp2fQfuTjEpoJi76GRDdvzsVddPlWfWYDnBxAtd6fQG9jRaePjy5-D3l5e_Raq18

Request Chain 166

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH_X8yUrS9SicNwutjWZxxA&google_cver=1&google_push=AYg5qPKgDUpTjocw1SCTim6u8UOGSL93lJbu91KvgpBTAmoUHpCyzCb2pfpj0KLQbpG2wUMo7QZqv3OZZECBwyyM_DKmsle2iOI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHNjktMjEtN1M5Tg==&google_push=AYg5qPKgDUpTjocw1SCTim6u8UOGSL93lJbu91KvgpBTAmoUHpCyzCb2pfpj0KLQbpG2wUMo7QZqv3OZZECBwyyM_DKmsle2iOI

Request Chain 167

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1

Request Chain 170

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 171

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGWjiPbyIBZADZPO6qVhlEM&google_cver=1&google_push=AYg5qPLtvr0AtWPaRYVWvxTGp7OfBvQB4ZZ2IkhB5_iz6OcggoBRCVS-kT7MRAymOpQA4qOqOwzsqYJbdAg9mWSDh8cezLmftW7Mbg HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLtvr0AtWPaRYVWvxTGp7OfBvQB4ZZ2IkhB5_iz6OcggoBRCVS-kT7MRAymOpQA4qOqOwzsqYJbdAg9mWSDh8cezLmftW7Mbg&google_hm=CuGGYAbMVUFgIN8exLjU5g

Request Chain 174

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIrrE8CtP71xz7q1KAU9QZA&google_cver=1&google_push=AYg5qPImaUPOunVXtteOSzRU-oj0PLZ52eRaH6dprOzlJr0N5hzHDIxheJdrOsDyTqD3W0gyHBytDfe53ZQc4TE9z2HZA4Ykqn78Gg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPImaUPOunVXtteOSzRU-oj0PLZ52eRaH6dprOzlJr0N5hzHDIxheJdrOsDyTqD3W0gyHBytDfe53ZQc4TE9z2HZA4Ykqn78Gg

Request Chain 175

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEIb00oqUe3jAzTaWu7RV07M&google_cver=1&google_push=AYg5qPLhHxga90CO2Qo2LJOKV-gYCpWVNct6G-BKh_8zJLxswgIrCgjP4TGZY--l7QoDXWt5cnrfSt2P0_3Xc1nYMgD99I3DW5Deyw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHN0EtMUwtNUpYMQ==&google_push=AYg5qPLhHxga90CO2Qo2LJOKV-gYCpWVNct6G-BKh_8zJLxswgIrCgjP4TGZY--l7QoDXWt5cnrfSt2P0_3Xc1nYMgD99I3DW5Deyw

Request Chain 176

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8&google_cver=1&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8

Request Chain 177

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEEyGPMegmsMg0D9g9v9PKq8&google_cver=1&google_push=AYg5qPL4TO81LkyD7AGZJod3kSqN3MceSfrG2TmCtl5gyFM-3ANyMwD9LRFjJaTal6sJWoOZNB3QE5XZrRzrNqAKZD5cFX-usKWp8LY HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPL4TO81LkyD7AGZJod3kSqN3MceSfrG2TmCtl5gyFM-3ANyMwD9LRFjJaTal6sJWoOZNB3QE5XZrRzrNqAKZD5cFX-usKWp8LY&google_hm=

182 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.leaksbydaylight.com/
Redirect Chain

http://www.leaksbydaylight.com/
https://www.leaksbydaylight.com/

84 KB
12 KB

91ms
53ms

Document
text/html

2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: b5aa101692924924388cbdf85855567381dfdcd504c500bdb9e353bd7c0999a3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-type: text/html; charset=UTF-8
last-modified: Wed, 01 Dec 2021 02:05:02 GMT
cache-control: max-age=3563, public
referrer-policy: no-referrer-when-downgrade
x-powered-by: W3 Total Cache/2.2.0
pragma: public
x-cacheable: YES
x-varnish: 65641293
via: 1.1 varnish (Varnish/6.0)
vary: Accept-Encoding
age: 0
x-cache: MISS
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TBrOwQHR1S1Vdn4xawhxOv57%2BCvaZLlfPGbRoPim7%2BJGjMF4g8xxn%2B8rp8MiTBP8X0QuP31GDZzgxIIavn%2F8qOvdQLM1fLkY1yBdXvwfDO%2B4nvYDRrYBYsYdIwvaYw5Ete8M%2BpWRoDdUa1gANOKss61RpJqfAA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6b68c06d1a593742-MXP
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Date: Wed, 01 Dec 2021 02:05:38 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 01 Dec 2021 03:05:38 GMT
Location: https://www.leaksbydaylight.com/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QLmtt3v1MkZbLh2yEA%2FOxGm74RkNSABVHU5dQz5yrwe5G8OFO9kmc3gGlt7dpAZ917f7Hkq8tBCVBu4Wqpw8gtWhKie8pt2n3QvPHriQ6ViZI7t49K5Ogy21k5gMnptzyNwe7NOKLlzdUEcxtNCPCzUZt0gE7A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 6b68c06caf4d6919-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 Lato-Regular.ttf
www.leaksbydaylight.com/wp-content/themes/magazina/fonts/ 117 KB
51 KB 28ms
27ms Font
font/ttf 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-content/themes/magazina/fonts/Lato-Regular.ttf
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7

Request headers

Referer: https://www.leaksbydaylight.com/
Origin: https://www.leaksbydaylight.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 1918
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06d8acb3742-MXP
x-cache: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 51329
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 13 Sep 2020 00:09:09 GMT
server: cloudflare
etag: W/"1d584-5af26ba1b3d93-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QdFuh6OGD71%2FV9hii7XFns3UWPwi7ydQrDOeXm6pBE6zGpC0FH3rVF5mzQtl1R2uWiXdN8CGKRh2Kk9e6Al2Xm%2FjSMwqJYjdZCepYCIiUmQJ8vt7JS88S3LIVCqoemPbCl1CovT1NJ0Bm7GBXwHiFPc6AA8U7A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 58952754
via: 1.1 varnish (Varnish/6.0)
cache-control: public, max-age=14400
accept-ranges: bytes
content-type: font/ttf

GET
H2 200 fa-brands-400.woff2
www.leaksbydaylight.com/wp-content/themes/magazina/font-awesome/webfonts/ 53 KB
54 KB 35ms
34ms Font
application/font-woff2 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-content/themes/magazina/font-awesome/webfonts/fa-brands-400.woff2
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 155963e3fb06f13011705c65bc52ed31f9989b87309c945948a76b35f8e7da67

Request headers

Referer: https://www.leaksbydaylight.com/
Origin: https://www.leaksbydaylight.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 24547
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06d8acd3742-MXP
x-cache: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 54470
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 13 Sep 2020 00:09:09 GMT
server: cloudflare
etag: W/"d494-5af26ba1b3d93-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ze96wLq6iSOv%2FsmE9d3rYisnZkioVg3R5AIhNXmbXGJhnWGbMH53MXtyS5F5GJOdMkA%2FhupUlUeY8lUTBT5o9URgyfyAhE3HxBnbwdTlKe7EAMqumffLAU9UUsBl21JyorwGamjDTMyfiTDLQI7XXborJ%2FBFIw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 62129095
via: 1.1 varnish (Varnish/6.0)
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: application/font-woff2

GET
H2 200 OpenSans-Regular.ttf
www.leaksbydaylight.com/wp-content/themes/magazina/fonts/ 212 KB
112 KB 34ms
34ms Font
font/ttf 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-content/themes/magazina/fonts/OpenSans-Regular.ttf
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee

Request headers

Referer: https://www.leaksbydaylight.com/
Origin: https://www.leaksbydaylight.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 1918
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06d8ace3742-MXP
x-cache: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 113998
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 13 Sep 2020 00:09:09 GMT
server: cloudflare
etag: W/"35110-5af26ba1b3d93-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3kUK%2FB3F2rDDwAPdXwyGVBB79wdix%2Bj0OXIuwUghTTu%2Foi4MkcIYeJD6PNMU1%2BRxDmM1JwACAEuq5c%2Bf8TH3VjBYBgSQ9SgeeO1gnhDvWmd0ZY3JBD%2Fy6UO3o1DGcioQCgMUWmw49qLznbgqhp42qfiFbHAfnA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 63471664
via: 1.1 varnish (Varnish/6.0)
cache-control: public, max-age=14400
accept-ranges: bytes
content-type: font/ttf

GET
H2 200 fontawesome-webfont.woff
www.leaksbydaylight.com/wp-content/plugins/ultimate-member/assets/font/ 96 KB
96 KB 35ms
34ms Font
font/x-woff 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-content/plugins/ultimate-member/assets/font/fontawesome-webfont.woff?v=4.2.0
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07

Request headers

Referer: https://www.leaksbydaylight.com/
Origin: https://www.leaksbydaylight.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1918
x-powered-by: W3 Total Cache/2.2.0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 26 Sep 2021 18:28:02 GMT
server: cloudflare
etag: W/"17ee8-5ccea240a6ae4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent,X-Forwarded-Proto,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DM1MPzvJdJ9q11Wwoprptg01v7D4Cb9pWaD38F3eTuA74yEl24TCj3icdwI5bpGN3xNAt%2Fd91udo7DHjpYQRsJE17Vq208%2B%2FJCSIWpjzE7isvdDfDwfC%2FatxH3x16oZsYd23z3qJIstHQ79kBMMwbPXNKaPE9w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/x-woff
cache-control: public, max-age=14400
cf-ray: 6b68c06d8ad03742-MXP

GET
H2 200 rocket-loader.min.js Show response
www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 19ms
19ms Script
application/javascript 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 22 Nov 2021 17:32:49 GMT
server: cloudflare
etag: W/"619bd441-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pgmlfHyrkPezJnOfNnyomhqp5QxkDijzLL%2BOudf6ZiEben8ce9mkLIls7Jk2b4GOg0lqngOONyIg7bVD%2BzIxPzLRTVVpgDEGpBv338G1AJiFQIlgJDW3%2FM83WVsyS1W1B2STvR1SCIXX6vgEzfQ9zDS2NFeGow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6b68c06d8ad13742-MXP
vary: Accept-Encoding
expires: Fri, 03 Dec 2021 02:05:38 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
917 B 46ms
16ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C500%2C700%7CLato+Slab%3A400%2C700&subset=latin%2Clatin-ext

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bc78176b4c15aa7ca9293569bc175161863bfc1f145dd5f066a978968ad34760

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 02:05:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 02:05:38 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 02:05:38 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 143 KB
51 KB 76ms
39ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6c75baf532dc2ea955da5dc642f31103d1ee99a763c021a6217a4dce6394d69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51213
x-xss-protection: 0
server: cafe
etag: 2908368871077237181
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 02:05:38 GMT

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 75ms
24ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55b4a8ebd4ce4144242d6bb9d0ebb65a01b2759e67243ed5badc3ac96c6fd396

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 456
etag: W/"2d763adca2b6a93c45e5b76bff1f8c5d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6b68c06e19135a43-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 04 Dec 2021 02:05:38 GMT

GET
H3 200 autoptimize_7373fb60d06df15494a0b8bd4ae405d9.css
www.leaksbydaylight.com/wp-content/cache/autoptimize/css/ 420 KB
74 KB 27ms
26ms Stylesheet
text/css 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-content/cache/autoptimize/css/autoptimize_7373fb60d06df15494a0b8bd4ae405d9.css
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: f2d6f8a57218c5b1a21fe3e8a7315624524f71efca6abb88da9be6c8d38b55d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dbea56987-FRA
x-cache: MISS
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 30 Nov 2021 18:55:53 GMT
server: cloudflare
etag: W/"69641-5d2061b5050b1-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YaoTU577Hp3z1DALs7V3rhdotx7%2FcdXsleqGxmLhBbVGHihbyzDzMsgihDwefpb3Sg%2FGNLZzeWZru%2B5MtR31AhXr5DG54hTB6RcFcgPwd3%2ByQlEPvLmS69pHnyJg13BKZdHJkVzWwaASyC0QIWbtC75V%2FVFO0w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61703291
cache-control: public, max-age=30672000, immutable
cf-polished: origSize=431681
content-type: text/css
cf-bgj: minify

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8d540bdbf723d49142454c58e9cfa40c4993c05b0a1cf77cbb6a6121a2ba2b6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e135b84a2331c593045726188013af7e487bc8cb383c38cfc3e27adca35381b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2735b19f236d9020b07d646f4a63c7545f1d287059d411235ff0d7f743d5ff36

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9604bca90e10bff23e641a5538bf2c83eed7a3ff62b951b6044f7379351ee3bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 autoptimize_15722bfd4af0c0cf2f0042926882b321.js Show response
www.leaksbydaylight.com/wp-content/cache/autoptimize/js/ 440 KB
120 KB 48ms
47ms Script
application/x-javascript 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-content/cache/autoptimize/js/autoptimize_15722bfd4af0c0cf2f0042926882b321.js
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 2dd2690baf3e0ef68505ad27bb6e22c65abeea4f07a826e743edae8829ea0493

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dceb86987-FRA
x-cache: MISS
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 30 Nov 2021 18:55:53 GMT
server: cloudflare
etag: W/"6e272-5d2061b4ff2f0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z0gmkaIvt7wlDSJD3rQzqbPJ%2BnFyVwswpVZCWqLqAtikmTJN6JTh0bIlpAqWJ%2F5BgNNED94xb%2F7TDaMdYYvodcYvyCo1F%2FVbQfWNwGQ3V4gFPx89JDcJ0Nww7eYgafKj4N7wyfexv%2BM%2FDl8dygPLGPe1%2FahhNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61703293
cache-control: public, max-age=31536000, immutable
cf-polished: origSize=451186
content-type: application/x-javascript
cf-bgj: minify

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 143 KB
51 KB 52ms
23ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2786251398835848

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a54da31e7467773a914eea11a5f58d3e021ed43c029d17e96207cf3a4919114

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.leaksbydaylight.com/
Origin: https://www.leaksbydaylight.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51172
x-xss-protection: 0
server: cafe
etag: 9778397212738017558
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 02:05:38 GMT

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 69ms
27ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55b4a8ebd4ce4144242d6bb9d0ebb65a01b2759e67243ed5badc3ac96c6fd396

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 437
etag: W/"2d763adca2b6a93c45e5b76bff1f8c5d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6b68c06e19125a43-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 04 Dec 2021 02:05:38 GMT

GET
H3 200 i18n.min.js Show response
www.leaksbydaylight.com/wp-includes/js/dist/ 10 KB
5 KB 60ms
55ms Script
application/x-javascript 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-includes/js/dist/i18n.min.js
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: dceda745a0fb58233a95eff6d10796026df6792cb960cdf675eb7b8a6750a2d2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dcec96987-FRA
x-cache: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3869
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 22 Jul 2021 14:27:28 GMT
server: cloudflare
etag: W/"268a-5c7b7162af989-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DAWTZ7%2B%2BbdTupc5Zz5uuuzfGDWgh3SfPpo3T2f18K5S2Tkd0OgMQdcS%2BE9Q40hSN7yYPu7MOGsNL%2FzhBcL6nh06YxHRTfDOhqO1DUDNUrLS0po6jRYTNN5WhyvNChW2SLugfbl35hXKffEMv19DUIC62%2F%2FvonQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 62358487
via: 1.1 varnish (Varnish/6.0)
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: application/x-javascript

GET
H3 200 hooks.min.js Show response
www.leaksbydaylight.com/wp-includes/js/dist/ 5 KB
3 KB 39ms
35ms Script
application/x-javascript 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-includes/js/dist/hooks.min.js
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 04e6fb814fccce3a0aecb83be0bc24665cf3e6a5e993f296471a63708f63e138

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dcecb6987-FRA
x-cache: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1801
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 22 Jul 2021 14:27:28 GMT
server: cloudflare
etag: W/"1540-5c7b7162ae9e9-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JkeLpcQ9s53jrKISQQaUryMiSw1r%2F8jI1Hb05soobrdkdds%2F6cCzERoB34WYgSyZh%2FMM%2FBMmBQEPQsBGXLmfWYonyI7ejk%2BZESqecI0lBd490N7IXZuXcwKxhg4%2FxUP2r79%2FVlJjsT3Q%2BRQ1kTLSt4%2Bx6sHMMg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 57970121
via: 1.1 varnish (Varnish/6.0)
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: application/x-javascript

GET
H3 200 wp-polyfill.min.js Show response
www.leaksbydaylight.com/wp-includes/js/dist/vendor/ 16 KB
7 KB 39ms
35ms Script
application/x-javascript 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-includes/js/dist/vendor/wp-polyfill.min.js
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dcecc6987-FRA
x-cache: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6042
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 22 Jul 2021 14:27:28 GMT
server: cloudflare
etag: W/"4056-5c7b7162b0d11-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BR48WnneEny71de9m4YIL6SVnAuFTAKkBj5Sw9SRXWgXxHmnESlzBk3w7CGFTdj%2FxFGLkWINQZ4FUNceUfwVGx88StpbbsrpWsv38PW%2B%2FVFErYmWLuc7rZS5fnvEezjMHVRq8cFM%2BkgCowbkKiSKVP8bmKP46A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 59050714
via: 1.1 varnish (Varnish/6.0)
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: application/x-javascript

GET
H3 200 regenerator-runtime.min.js Show response
www.leaksbydaylight.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 60ms
56ms Script
application/x-javascript 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dcece6987-FRA
x-cache: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2409
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 22 Jul 2021 14:27:28 GMT
server: cloudflare
etag: W/"1906-5c7b7162b0d11-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o0YrSPGJsx9uD2yCd0ZF3fBtEzKgvAUj0PvPqL2T2%2BOeBA%2B%2BDw9EoCtyBfBT7hojES8bgiRVCktLPnLa3CjrC0%2Bx%2FyMyh0%2BN8f%2BnXYW2cQwSNK%2BTTitvEFUVK%2FNgiL9knXydDnVGHNfND75Y5auFco75Qz1hfA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61638125
via: 1.1 varnish (Varnish/6.0)
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: application/x-javascript

GET
H3 200 lazysizes.min.js Show response
www.leaksbydaylight.com/wp-content/plugins/autoptimize/classes/external/js/ 10 KB
5 KB 60ms
56ms Script
application/x-javascript 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.leaksbydaylight.com/wp-content/plugins/autoptimize/classes/external/js/lazysizes.min.js?ao_version=2.9.3
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: c4fada4accfa24704b54248bc5ce84acac50b6a059828b7714fe3006786c80c1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25526
x-powered-by: W3 Total Cache/2.2.0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4122
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 24 Nov 2021 18:00:42 GMT
server: cloudflare
etag: "2655-5d18ca2e43e83-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: X-Forwarded-Proto,Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HgXPRURgzFs0GiNY4WbSgtRXjD8GbnOFSV6d%2Bypd5VedPOqvaUERtTCrCAw5XSGRYL9gew%2BbPtRtXziFlK%2BTFa1tKPhJQKTnlDuz32iexZmgskkMjgLGAK0lEcdBHSG9NixS5O0Nso%2FT34VyPs%2Br3PqbH1Sgog%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6b68c06dcecf6987-FRA
expires: Wed, 30 Nov 2022 19:00:12 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 143 KB
50 KB 54ms
28ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2786251398835848%27%20defer=%27defer

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90d481eecef21cebb9f0fcc30bc378bce5f81f2835b8605a4fef27e0311ac015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.leaksbydaylight.com/
Origin: https://www.leaksbydaylight.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51236
x-xss-protection: 0
server: cafe
etag: 14582820650969452504
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 02:05:38 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.4/ 82 KB
30 KB 48ms
8ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 13:12:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46369
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29725
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Nov 2022 13:12:49 GMT

GET
H3 200 dead-by-daylight-leaksbydaylight-scream-5-ghostface-saw-spiral-leatherface-behaviour-winter-halloween-kills-michael-myers-dbd-winter-event-sale-chucky-tv-series-908x460.jpeg
www.leaksbydaylight.com/lbd-images/ 72 KB
73 KB 53ms
52ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-scream-5-ghostface-saw-spiral-leatherface-behaviour-winter-halloween-kills-michael-myers-dbd-winter-event-sale-chucky-tv-series-908x460.jpeg
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: ed5ddfe8b934ade2a866b7ef1a992b0d30b84b777feae315fb0437f95c9475b9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dded16987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 73521
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 30 Nov 2021 18:46:57 GMT
server: cloudflare
etag: "11f31-5d205fb5cafbf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eS%2FP49PCjyeMt1pQmgd8IefWvCqLpNbu1L9DTcTpaqdstUJCBoS3b1nAWm2vbV8VmbUv78KanDthpB1T%2B7QtGvKGo7HG2xye4Hi%2FUyb1QC31XhZDtmqfwDkfxeAQ8oQuPthuTIICAAjku8SPMT8Qq61R4IBPzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 57970119
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-leaksbydaylight-dbd-behaviour-amazon-prime-gaming-halloween-scream-5-chucky-winter-event-jeepers-creepers-leatherface-hellraiser-nft-908x460.jpeg
www.leaksbydaylight.com/lbd-images/ 77 KB
78 KB 55ms
53ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-dbd-behaviour-amazon-prime-gaming-halloween-scream-5-chucky-winter-event-jeepers-creepers-leatherface-hellraiser-nft-908x460.jpeg
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 97f65dbb9a44c48c442f1e2787559a418e4706cb5c6cd191d2d5c9cefcd9c229

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dded36987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 78933
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 24 Nov 2021 22:25:54 GMT
server: cloudflare
etag: "13455-5d190575e6f4d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=moHfHvc5r0ZN8RGLPCWwOz44v5NoKaaZ5dbPU1txTTJSYF%2FRNPNLJrbpxoyRPQTkP%2FRodptyS68PZO2oNwCiRcU5LnwJbdBoQ%2FFfeatOFTMEF3Aq5yltyQNwaPEMXeeSIj7MQqnZIW%2BEEArGeZx6HdSRufZiKg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 60295963
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-ghostface-scream-5-dbd-behaviour-leaksbydaylight-halloween-chucky-netflix-stranger-things-netflix-resident-evil-capcom-halloween-silent-hill-sony-playstation-908x460.jpeg
www.leaksbydaylight.com/lbd-images/ 65 KB
65 KB 58ms
56ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-ghostface-scream-5-dbd-behaviour-leaksbydaylight-halloween-chucky-netflix-stranger-things-netflix-resident-evil-capcom-halloween-silent-hill-sony-playstation-908x460.jpeg
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 73def94bc81c2ce10a063cac4d719db63b63dea833d7b0ae0f2fba37ed8b5a77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dded56987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 66141
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 19 Nov 2021 14:52:31 GMT
server: cloudflare
etag: "1025d-5d1256cb8b5c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3lxxJxP9Mt9ZSYZBKgZZGSoFP7cENEKvZ9k35%2Fhiaq4jFHEbeJYhKDxuMdbQrxFbEVFbUhDzvnM%2B33eg2rsnoxeDgk%2BwX4PNQYNqxU%2BALVGTpl1tx25xVOJ8kvhsKG3uDS%2FQOybzOajs67lsgkTnnRc008lPpA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61638123
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-leaksbydaylight-nft-ghostface-scream-5-winter-event-dbd-behaviour-resident-evil-jill-valentine-leon-kennedy-chucky-saw-spiral-leatherface-pinhead-hellraiser-halloween-908x460.jpeg
www.leaksbydaylight.com/lbd-images/ 86 KB
87 KB 59ms
58ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-nft-ghostface-scream-5-winter-event-dbd-behaviour-resident-evil-jill-valentine-leon-kennedy-chucky-saw-spiral-leatherface-pinhead-hellraiser-halloween-908x460.jpeg
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 32c21e51a780e7efc510466779e8f163da04f4d1cfc4e13ce1f79bd4427b6b79

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dded66987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 88069
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 10 Nov 2021 23:38:08 GMT
server: cloudflare
etag: "15805-5d077b7ddf4d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EnBqbs9xe%2BMzyegouvIbAkuC4jZCuqKJh59FPnxls3qyYWorGd3pu0vToS%2BDqfT12r1kA4aWC3EdG1u9VxRDjp3hutz7AMRRt3BrIRGoqrv6eiXsxFZh83lpfQ50l4sqD9RAA9sibz4L8q4r%2FPP0ll%2FoXnj16Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 59050712
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-leaksbydaylight-dbd-halloween-2021-michael-myers-scream-5-ghostface-pinhead-hellraiser-chucky-behaviour-the-conjuring-chapter-23-the-nun-warren-saw-spiral-jeepers-creepers-908x460....
www.leaksbydaylight.com/lbd-images/ 84 KB
84 KB 62ms
61ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-dbd-halloween-2021-michael-myers-scream-5-ghostface-pinhead-hellraiser-chucky-behaviour-the-conjuring-chapter-23-the-nun-warren-saw-spiral-jeepers-creepers-908x460.jpeg
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 2b79cd45fdba003c6754cc201454970df0d4e6c6beb7dc0ae67f32c1e4d3fca4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25526
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06dded76987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 85562
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Nov 2021 18:20:34 GMT
server: cloudflare
etag: "14e3a-5d00eb2fe55e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DlXvrwqMfqeZ%2FqBZEPisPP4CARy61%2BKIzBhqEPr0o6NmVzB9hZ8XQCO8t1pFWhqBJuegKZX29ajCH1I3Ob2U2q4ECy51gw861x3JmZNXh9ABIsCJO6cgwR4PxzLYD3FC0DvTHx1dmG77vYMuVZGVRIPI09su5A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 43333172
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 Sfondo-Sito.jpg
www.leaksbydaylight.com/lbd-images/2021/01/ 103 KB
103 KB 13ms
13ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/2021/01/Sfondo-Sito.jpg
Requested by: Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/wp-content/cache/autoptimize/css/autoptimize_7373fb60d06df15494a0b8bd4ae405d9.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 5e686c187417b6566beef3fdabd73cf6cd27cc66e99d8cd51d9aef7c4648dec6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/wp-content/cache/autoptimize/css/autoptimize_7373fb60d06df15494a0b8bd4ae405d9.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:38 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25524
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c06e4f6e6987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 105140
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 07 Jan 2021 18:42:06 GMT
server: cloudflare
etag: "19ab4-5b853cbe2fb80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lzx%2BExDFqb%2B0ZyLhvpRWJ%2Fyk839iba3fFMs9B9ZAtPHV7jXPu2R%2FP1CLr9rdCsDWN0ZZUmcAWzFXuzlt4jVJJ6M7cjS9MaywkJT1q1le4UsuZrL8apweyRXdwon%2FQhzbpOkAq5cLARlsj63fxGS0FJtnT9pHNw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61703300
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 36ms
26ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba83c227cde7d4c34fb514ccd483305e8dfef365e6b2b70a126f2d73adaa1691

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 421
etag: W/"bac537a7eba0b66473f70a7a4bf837c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6b68c06edc816904-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 04 Dec 2021 02:05:39 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/ 270 KB
97 KB 46ms
31ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2786251398835848&plah=www.leaksbydaylight.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d573b709aa14ca7bf49c1b525bf594b26b89761e67014d87e721da328b05113

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99572
x-xss-protection: 0
server: cafe
etag: 1523783611827229646
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 02:05:39 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/ Frame 5759 11 KB
5 KB 31ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 09:43:00 GMT
expires: Tue, 14 Dec 2021 09:43:00 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 58959
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 209 B
642 B 41ms
17ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.leaksbydaylight.com&callback=_gfp_s_&client=ca-pub-2786251398835848

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2786251398835848&plah=www.leaksbydaylight.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

c469fe0f1ce35236031c0206edb53f97a257f82c6764dddd20ed58e5c6b62556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 197
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 46ms
18ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.leaksbydaylight.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 43ms
16ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.leaksbydaylight.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
39ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&tn=DIV&cls=group-loader&ign=false&pw=1600&ph=1200&x=0&y=1060.8

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&tn=DIV&cls=group-loader&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: www.leaksbydaylight.com
URL: https://www.leaksbydaylight.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B26A 181 KB
43 KB 619ms
602ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&adk=1812271804&adf=3025194257&lmt=1638324302&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339028&bpp=4&bdt=247&idt=158&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3392548976435&frm=20&pv=2&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=199

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20a432e2be37dca0082730c390f55793df25d2aa3526cfb98c5118163a4b61c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 02:05:39 GMT
server: cafe
content-length: 44382
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:39 GMT
cache-control: private

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 31ms
16ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.leaksbydaylight.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 31ms
16ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.leaksbydaylight.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET ads
googleads.g.doubleclick.net/pagead/ Frame AB88 0
0

GET ads
googleads.g.doubleclick.net/pagead/ Frame 345D 0
0

GET ads
googleads.g.doubleclick.net/pagead/ Frame F733 0
0

GET ads
googleads.g.doubleclick.net/pagead/ Frame 6975 0
0

GET ads
googleads.g.doubleclick.net/pagead/ Frame 2B03 0
0

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/ 147 KB
52 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b460d8b83e6f7ba537d2720feb7b2fc8fc18b6ec2852b0834ddcab87bfaf78a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53390
x-xss-protection: 0
server: cafe
etag: 9078786560091584727
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 02:05:39 GMT

GET
H3 200 cropped-cropped-leaksbydaylightlogo.png
www.leaksbydaylight.com/lbd-images/ 7 KB
8 KB 13ms
12ms Image
image/png 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/cropped-cropped-leaksbydaylightlogo.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 8142b2459179e71227f471b1d5a00a5638eb51c8aaf079f46f2c2faafc107fad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25524
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07588f36987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7025
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 19 Jan 2021 01:02:06 GMT
server: cloudflare
etag: "1b71-5b936632e6a2f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aMLNc16EHDnMyCt1u6WIbNbE2L47Pq%2Fnot%2Fp%2FggzO%2F8TbUv50rEfJtBYwHQ90EylXu8ywhlsP5rG0GT4goYMFg5LkcvNmABN%2FM9bPyXl936QJ2ArDRzhoUhjJMV%2FDcxQH5Q%2FmlfDz16L%2BGJacNUwW64Du4u4Nw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 59050721
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/png

GET
H3 200 dead-by-daylight-leaksbydaylight-scream-5-ghostface-saw-spiral-leatherface-behaviour-winter-halloween-kills-michael-myers-dbd-winter-event-sale-chucky-tv-series-320x500.jpeg
www.leaksbydaylight.com/lbd-images/ 27 KB
28 KB 15ms
14ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-scream-5-ghostface-saw-spiral-leatherface-behaviour-winter-halloween-kills-michael-myers-dbd-winter-event-sale-chucky-tv-series-320x500.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 8d5250c5f5cf6724a10a215296a8091d3a29f724bfe4a395ee09882288fc0f01

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25524
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07588f46987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 28003
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 30 Nov 2021 18:46:58 GMT
server: cloudflare
etag: "6d63-5d205fb756406"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xoXjwzMK7CswVb7u7gww3Mpw1E12TD%2BvG1XH7M6sJ8xL5E%2FCxCQs2Gt26EDXUFgGjtC1n%2B6NdddgG%2FQHZCZ88HpJ0urCowKP69AJefCMo2W5fw36RgtnsbnPGqE1mGABejG%2F%2BG0EneC4AvLanJL5mq4b9HYwqA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 43333177
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-leaksbydaylight-dbd-behaviour-amazon-prime-gaming-halloween-scream-5-chucky-winter-event-jeepers-creepers-leatherface-hellraiser-nft-320x500.jpeg
www.leaksbydaylight.com/lbd-images/ 30 KB
30 KB 16ms
15ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-dbd-behaviour-amazon-prime-gaming-halloween-scream-5-chucky-winter-event-jeepers-creepers-leatherface-hellraiser-nft-320x500.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 2d42a0c03f4fe9a2c65b41236010fb4be3b0c7a412f7ffa25640c3e6f3250308

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25524
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07588f56987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 30285
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 24 Nov 2021 22:25:55 GMT
server: cloudflare
etag: "764d-5d190576a8138"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gRwsk5rNwygFmZzKKazcJEHWRluJS8lxdFEgLC6Pw3M%2FHnhrRns7EHtDXiJskiuWPZQEtsjsWWA9JKI7WZtaoxSEVAi%2F7VFiyekSFRjBptqxiBZFez25kdsyijcVp0mEt6nJ3XPXG2UqtNixko5OKIXhbIoKkw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61048580
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-ghostface-scream-5-dbd-behaviour-leaksbydaylight-halloween-chucky-netflix-stranger-things-netflix-resident-evil-capcom-halloween-silent-hill-sony-playstation-320x500.jpeg
www.leaksbydaylight.com/lbd-images/ 25 KB
26 KB 13ms
12ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-ghostface-scream-5-dbd-behaviour-leaksbydaylight-halloween-chucky-netflix-stranger-things-netflix-resident-evil-capcom-halloween-silent-hill-sony-playstation-320x500.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 709eb2646045e85b4953d91eb9ae2753e9386bea945e829504a9db1f12bbba91

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25524
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07588f66987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 26097
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 19 Nov 2021 14:52:34 GMT
server: cloudflare
etag: "65f1-5d1256ce35c09"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DNowgKigAHKP4c1MG0RO8YOkygkk44BBb4UF%2B0ngrtAuQ2y%2BZZMwlnEc%2BHadPjCSp%2BpAtdED%2FWXnoR9%2BGbVHw06CjwQelAQJpXqP7CpKK4NfPKDsHGWfv3PK4kkmpFf3F0gwXOrmk%2BVbjBM679WbKSiyHaRXPg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61638130
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 Dead-by-Daylight-alien-predator-Behaviour-interactive-fortnite-prey-Disney-Scream-5-ghostface-hellraiser-Pinhead-halloween-2021-JEEPERS-CREEPERS-Reborn-marvel-320x500.jpeg
www.leaksbydaylight.com/lbd-images/ 21 KB
21 KB 17ms
16ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/Dead-by-Daylight-alien-predator-Behaviour-interactive-fortnite-prey-Disney-Scream-5-ghostface-hellraiser-Pinhead-halloween-2021-JEEPERS-CREEPERS-Reborn-marvel-320x500.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: de161d522a8c9e8414f97cf0eabe91fd7cef0edda04a1073b4548606b3e17bd9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25524
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07588f76987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21153
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 14 Nov 2021 15:02:56 GMT
server: cloudflare
etag: "52a1-5d0c0fcbca997"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O8CK6gEXDV%2FwC%2BLSBblSegFMIyt9V%2FMoZp8h60vBNAOzL5vSykK8xTvqK92zkpZDm90xY51ikl4ywnsCSqorjhPRFKuGNjYnJgLjsNW8Q2jTND9ZA3teHFWkiITpYIfXZBHU215PldzjqPytoaNBd3M9BKVzLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61277639
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 22ms
22ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba83c227cde7d4c34fb514ccd483305e8dfef365e6b2b70a126f2d73adaa1691

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 422
etag: W/"bac537a7eba0b66473f70a7a4bf837c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6b68c075ad3d6904-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 04 Dec 2021 02:05:40 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/c335de27-0526-4ec8-b1dc-5839d1a5e101/ 3 KB
2 KB 350ms
341ms Script
text/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/c335de27-0526-4ec8-b1dc-5839d1a5e101/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d27aaaf5713d4e6a8f55b9abdc1300061c06897d83f8e6a0126051dc0cc5bc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
status: 200 OK
x-envoy-upstream-service-time: 29
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 09e1d4c2-30ff-43ac-94eb-eda01567b533
x-runtime: 0.027616
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"4d27aaaf5713d4e6a8f55b9abdc13000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 6b68c075dc295a43-MXP
access-control-allow-headers: SDK-Version
expires: Wed, 01 Dec 2021 03:05:40 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 127C 87 KB
31 KB 573ms
567ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05268eb864450f188c3e1a7232680e914acae87392df03a0811e9a40f43fdfab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 31785
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 97F3 76 KB
27 KB 592ms
589ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

773aa3cda26338c8ade519d71ff737ed8de7cb6a91a0970165ad8585106efa45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 27554
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0AA2 97 KB
32 KB 482ms
477ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9764b47bf4cfd9926196b7b456ae74db8cc1af1c524e099df3dfe28a852751a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 32665
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 209D 97 KB
32 KB 631ms
626ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b412ac247f5114876ddc6778b53bdd6e72f41bdf0e59a03d6bb42e2d20a6cd40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 32772
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AB0C 97 KB
32 KB 316ms
312ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80212a42620d88102487645bfe846d41f2cede532e3eab317904104891ca3780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 32858
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6BFC 184 KB
45 KB 616ms
613ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b4508ec0a8606f1dec41e87b613eb0db23d3871617dc9537bbd21a4dc8e90b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 46495
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/ Frame B012 11 KB
5 KB 9ms
8ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 09:43:00 GMT
expires: Tue, 14 Dec 2021 09:43:00 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 58960
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 34ms
19ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211111&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a255b8afb68732995e757b44114fa5d094410d1e2f9975da39954a49af24d35c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9122
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.leaksbydaylight.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.leaksbydaylight.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/ Frame 4EF0 11 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 17:15:06 GMT
expires: Tue, 14 Dec 2021 17:15:06 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 31834
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 51ms
20ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame D345 12 KB
5 KB 37ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Wed, 01 Dec 2021 00:11:44 GMT
expires: Thu, 01 Dec 2022 00:11:44 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 6836
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame BE85 783 B
1 KB 47ms
17ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cfaa0cde0093b0ec4a6b0e211306c5c195a56ae0a2a6246d0a38b53f3e3f814a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GoFiRbmhmto+ieZIlYU0jQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 01 Dec 2021 02:05:40 GMT
date: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-GoFiRbmhmto+ieZIlYU0jQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame BE85 0
0 19ms
19ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211111&jk=48870538119826&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame D345 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 18:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 18:23:24 GMT

GET
H3 200 12207635354432864519
tpc.googlesyndication.com/daca_images/simgad/ Frame AB0C 75 KB
75 KB 8ms
8ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/12207635354432864519

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ca4bc4d8ef6522fea69046415b349a076c9829aeb7f35edc3250b1a2b00465c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 15:59:22 GMT
x-content-type-options: nosniff
age: 554778
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77204
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 10:22:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Nov 2022 15:59:22 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame AB0C 19 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 01:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 01:48:25 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame AB0C 2 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:01:58 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame AB0C 0
0 56ms
54ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Ch2vXdNimYenuCfyL7_UP_YOE0A-6zaHaZrq8_6ugD9nZHhABINzh8HtgleKQgqAHoAHmuJvJA8gBAqkC2WlGliRiYz6oAwHIA8kEqgTcAU_Q4UNEQXZKxIYCYDSpkPuoKhFEPChrThyLVU6KgzhDXyZFB3C_Ej5R_y-3NFW7UffdVz_rwlrN5VIq8YzAAsTs55LHXmAvlAuQM4eyBBbkQ3oU8TlXSMM4ywy1BWJuZZ-jlvqUj8Lz5aWoW7m9lz3sPDGvUOs7Q2YgwCjL2rd_PDRJWd7vhnLD_hS3B4bFXjbbbTvte-yFFD64L3CFl6CDHifVHf66GuBNL51ZqzIeXE6WLs1H4Cz6S0xvmvmjeDDrTBzOOONQ01Q6LhBivREVV8Xt2fGWcwpR5LLABPeyocHvA5IFBAgEGAGSBQQIBRgEoAYCgAepi-vyAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEENHzBtIICQiA4YAQEAEYX4AKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi0yNzg2MjUxMzk4ODM1ODQ4GAA&sigh=orrIX89Tmk8&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 01 Dec 2021 02:05:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame AB0C 67 B
91 B 11ms
10ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 30 Nov 2021 18:14:59 GMT
x-content-type-options: nosniff
server: cafe
age: 28241
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Wed, 01 Dec 2021 18:14:59 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AB0C 119 KB
37 KB 28ms
25ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame AB0C 15 KB
6 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:03:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:03:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame AB0C 0
0 32ms
14ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRUiNRJMMt73QcRgb3KKiaaY4lWl9x74JcQwTBtdnSqG40gLvm5_zzvJfvHt8Z5BwIUBKxIK0YC5v9y8RfYpDfZxDR1tQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame AB0C 27 KB
11 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0072f2a89bd32697c990a647ce4577265131df2f7d089ecef8eb14d50abdfb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35957
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11327
x-xss-protection: 0
server: cafe
etag: 10656063359522146397
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Dec 2021 16:06:23 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2FB9 143 B
163 B 11ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 01 Dec 2021 01:58:29 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7BD3 1 KB
749 B 8ms
7ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 05:53:44 GMT
expires: Wed, 01 Dec 2021 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72716
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame AB0C 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 838259504b70b5a23d07a6825b1b352ee5860555a0e5ff611ce9da993ed0f701

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 7BD3 35 B
463 B 38ms
9ms Image
image/gif 2620:116:800d:21:3175:5196:e3fd:8c1d
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECf1ttMFyX2GIRbvNOJrKv0&google_cver=1&google_push=AYg5qPIfHOqoJktNx75sF0GB0BNR4xi2fKrOsmBBA49JeY1vzL1aVXGDdRhJ2bUKvzTioIJbC082DlN_sOgkoXGlAKCk5f-H-vtsag

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:3175:5196:e3fd:8c1d , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7BD3
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKsbz2X...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKsbz2X...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDA3OTg0NzU5MTU2Mw%3D%3D&google_push=AYg5qPKsbz2Xsrrd5oTQ8lxkWd884Iwzb6p5EiwQLD_jmngFXDdbCv0L8YI3oTUHywzzPq...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDA3OTg0NzU5MTU2Mw%3D%3D&google_push=AYg5qPKsbz2Xsrrd5oTQ8lxkWd884Iwzb6p5EiwQLD_jmngFXDdbCv0L8YI3oTUHywzzPq9R8JhF0-1sFbV8wL8PbTNaxM3LO-VNgw

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDA3OTg0NzU5MTU2Mw%3D%3D&google_push=AYg5qPKsbz2Xsrrd5oTQ8lxkWd884Iwzb6p5EiwQLD_jmngFXDdbCv0L8YI3oTUHywzzPq9R8JhF0-1sFbV8wL8PbTNaxM3LO-VNgw
pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 01 Dec 2021 02:05:41 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 7BD3 43 B
350 B 44ms
16ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEOibwgVjJoV4rrsDmtno5hE&google_cver=1&google_push=AYg5qPKxMV9ag8JwzPZuc4djhGDMqb3G6WsW-h54cpLQ5JWHoZGGquWPH9P0F4LvrVvhu3PmY1-q5vMpu4wc2aaNelyl4V9Bdn3hUg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 6p8trn95d412b5toieccg8vsb7qgudui

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7BD3
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

21ms
20ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKCE-wsgA_rDNovmGVdODFEnVe8AJNoVAYzGfYXk62qiZbEnZABJCdqy3kgAXh7pA5_pGWbisLHe9N9BnD9ZK7YHo0v6Or2zg

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKCE-wsgA_rDNovmGVdODFEnVe8AJNoVAYzGfYXk62qiZbEnZABJCdqy3kgAXh7pA5_pGWbisLHe9N9BnD9ZK7YHo0v6Or2zg
date: Wed, 01 Dec 2021 02:05:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7BD3
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHZcXoBOKa0LE05QkIxC2qI&google_cver=1&google_push=AYg5qPIVAlYD25t3szaNvmOlWU14tPY44OqSMFrc2ctw5Ubp84kSN-RJS7A1MQOBaDc3wDWbIIG...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGUjAtQy04SjNW&google_push=AYg5qPIVAlYD25t3szaNvmOlWU14tPY44OqSMFrc2ctw5Ubp84kSN-RJS7A1MQOBaDc3wDWbIIGBMqL7wKm9M665FXeXWkdCnZu9Ng

170 B
188 B

33ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGUjAtQy04SjNW&google_push=AYg5qPIVAlYD25t3szaNvmOlWU14tPY44OqSMFrc2ctw5Ubp84kSN-RJS7A1MQOBaDc3wDWbIIGBMqL7wKm9M665FXeXWkdCnZu9Ng

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGUjAtQy04SjNW&google_push=AYg5qPIVAlYD25t3szaNvmOlWU14tPY44OqSMFrc2ctw5Ubp84kSN-RJS7A1MQOBaDc3wDWbIIGBMqL7wKm9M665FXeXWkdCnZu9Ng
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 7BD3
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Z...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7BD3
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEHee31E53gJzgnxU9aXMaeM&google_cver=1&google_push=AYg5qPJAi3zVpYN-60bioNY2...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJAi3zVpYN-60bioNY2t4YFF8yRkSwZ4tbFy9dH4R8dnkoKTNZIdD-3iFUBFiWI9zqs5Gijb-B4fD1yNpayeLFYPrhUXOJTjNY&google_hm=

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJAi3zVpYN-60bioNY2t4YFF8yRkSwZ4tbFy9dH4R8dnkoKTNZIdD-3iFUBFiWI9zqs5Gijb-B4fD1yNpayeLFYPrhUXOJTjNY&google_hm=

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJAi3zVpYN-60bioNY2t4YFF8yRkSwZ4tbFy9dH4R8dnkoKTNZIdD-3iFUBFiWI9zqs5Gijb-B4fD1yNpayeLFYPrhUXOJTjNY&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 30 Nov 2021 02:05:40 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 7BD3 0
223 B 43ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IFEOFGFaaz64I9pDEbjJG3Lq0SC2fN0-ahoSqeafRc3a2AiCr_Eujlxoyl9DiK4igXZoD-tQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 12207635354432864519
tpc.googlesyndication.com/daca_images/simgad/ Frame 0AA2 75 KB
75 KB 8ms
7ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/12207635354432864519

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ca4bc4d8ef6522fea69046415b349a076c9829aeb7f35edc3250b1a2b00465c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 15:59:22 GMT
x-content-type-options: nosniff
age: 554778
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77204
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 10:22:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Nov 2022 15:59:22 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 0AA2 19 KB
8 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 01:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 01:48:25 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 0AA2 2 KB
1 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:01:58 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2FB9
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

30ms
30ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0AA2 0
0 52ms
51ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CFpEddNimYfXPCfiB7_UP5ca4GLrNodpm0rfHwa8O2dkeEAEg3OHwe2CV4pCCoAegAea4m8kDyAECqQLZaUaWJGJjPqgDAcgDyQSqBOUBT9DUfmU8Nxe0CSvyl3-tJLgcnpk2huTynGlKxQMXCxCdPPydRQ7G9kZtXlRN07bGVsrg_MGUPB0M5hHWK1GLqOE0IwDxokwbPn8CymlcegbG38OneGUzlQau0oIt2VOHO_r1ln5dvTn-R0ZYFbHZf78EZktZlRquEYOPWESMuFAw9X9QOUonvRuNjhujGvki-CbIS18x0n5rQuytJ0JOwDf1jbRD6j5jdno4P7PvwW75JgDM2l0NV2mOhwqPQtC4NSnAD2x4NH5rYk1wiTwApFqL_9M0724HydS0NTu86ljPBxXtz8AEzcHV4uQDkgUECAQYAZIFBAgFGASgBgKAB6mL6_ICqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQp7AI0ggJCIDhgBAQARhfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTI3ODYyNTEzOTg4MzU4NDgYAA&sigh=hSdt_LcmNhE&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 01 Dec 2021 02:05:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame D322 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 18:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 18:23:24 GMT

GET
H3 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 0AA2 67 B
91 B 10ms
9ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 30 Nov 2021 18:14:59 GMT
x-content-type-options: nosniff
server: cafe
age: 28241
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Wed, 01 Dec 2021 18:14:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0AA2 119 KB
36 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 0AA2 15 KB
6 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:03:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:03:27 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 0AA2 27 KB
11 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0072f2a89bd32697c990a647ce4577265131df2f7d089ecef8eb14d50abdfb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35957
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11327
x-xss-protection: 0
server: cafe
etag: 10656063359522146397
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Dec 2021 16:06:23 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E2EE 143 B
163 B 9ms
8ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 01 Dec 2021 01:58:29 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C176 1 KB
749 B 7ms
7ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 05:53:44 GMT
expires: Wed, 01 Dec 2021 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72716
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211111&jk=48870538119826&bg=!OjmlOX3NAAZQLpa_UC47ACkAdvg8WkcWF5zII7Ws_0dvVHjEng0E3LazsWLp2aq7dOgxU_UkhQil8gIAAADuUgAAAChoAQeZAodYboMNMBjj6mTW1w9ypBeVXyWwa1R-hVXPFXJlm7mmPituYBij2HW99bxXEX5Ui96T5Fj1VBdkQ_yyzFRB67j8lReByG8nu379E3vjNowfVlNRPlqZMP8s_RPJ0-TiZSckYBxt-flL3u99d19WuS_a43nb2M0li5X3ckCivconIEPG8dXpJ63t7FZR7hXgo13ZSA3nOMnPh5uZGiFvtj4MYurmYXOt2krpGjfbqCe3R8_RyfKrRkWi4yNit1GV1J8GmY-6w3JrRsRc4oCLfuQrhqKcrjlLRRkPkAb-xTgCRuw-pxG-7PFtLNzY7wfmOvw9t5cz5Dx-rAcy0AnsjmXTi5hqvUVZvPTD03ZgiNmDvQjQkKigRao_JHKftiWQJWnDJ-_fASi4toehNA4T9S4PcBr3yQIUUIocYcrog7JvvLOrK-vqW8AAYlyk1ccX2DxcE6HmonVIv3g4aN16OVNygv7CrOqlZmp_z4S9eCP1amWK7eUzc0dnLPQA7tT5fQJ37WWC2_Q5u2mGKjDS4NMqPPdXNuyQt3a26tGc0L4NlHQ_HPtH_0YbGGYLWtsMXF9JDUBElgCpXLj2XIHDFHtFJkn-ZrBXHSnwDonUileXlnRWhmkOmaLDEDI_4l1_pOdR59jilBqo8EBNyxETSBjXhJ6DlG8cgTsuSo0njxmbf-jFrFv6khRdJUdZ_30tvuPDi_tf3HeT9XkovYMROgUlFTn3GmKTSmjfaCb1qP1FZZWgwNSfbiEF-oQnB2aiOfonoHn8qWHuPZLUw60R7-tz8j495AtVfzqN9R_lgM2rF234HZReMGHRYOmG9wXyTDhn7CNLzOSfT4Yu1aRQ2wUI84JkSLhsDQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 0AA2 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3d774d3d9ea205c5d9909f8bb38cfa5433a5b2b03386f784638e9f5d07207ac

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 127C 3 KB
579 B 34ms
16ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 01:45:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 02:05:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 127C 1 KB
880 B 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 01:57:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 507
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 01:57:13 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 97F3 3 KB
579 B 31ms
15ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 01:49:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 02:05:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 delayed_impression_vu_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/impression/ Frame 97F3 17 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/impression/delayed_impression_vu_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13e044ca703a01a7e376551ac09e8b5763bba33f5f2086e1449ea0db8a2fa3a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 20:40:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7382
x-xss-protection: 0
server: cafe
etag: 215217009278228325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Dec 2021 20:40:48 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 97F3 1 KB
880 B 10ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 01:57:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 507
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 01:57:13 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 97F3 19 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 01:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 01:48:25 GMT

GET
H3 200 12207635354432864519
tpc.googlesyndication.com/daca_images/simgad/ Frame 209D 75 KB
75 KB 9ms
9ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/12207635354432864519

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ca4bc4d8ef6522fea69046415b349a076c9829aeb7f35edc3250b1a2b00465c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 15:59:22 GMT
x-content-type-options: nosniff
age: 554778
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77204
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 10:22:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Nov 2022 15:59:22 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 209D 19 KB
8 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 01:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 01:48:25 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 209D 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:01:58 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 127C 19 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 01:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 01:48:25 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 127C 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:01:58 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 127C 119 KB
36 KB 25ms
22ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 127C 15 KB
6 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:03:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:03:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 127C 0
0 19ms
16ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSzaOoDPAShIg-nOy5CV4UvF36rxd0tc6HgsCgVABX8ArNTt3ei7Lrm8SDMrFeDAqTyfYJedEDTqLjL03kYTv96ECEw5A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame 127C 27 KB
12 KB 43ms
10ms Script
text/javascript 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33103
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 28 Feb 2022 16:53:57 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 97F3 2 KB
1 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:01:58 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 97F3 119 KB
36 KB 29ms
27ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 97F3 15 KB
6 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:03:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:03:27 GMT

GET
H3 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame 97F3 27 KB
11 KB 26ms
8ms Script
text/javascript 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33103
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 28 Feb 2022 16:53:57 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 209D 0
0 48ms
48ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CoXx7dNimYZeECqyV7_UPh6yDuAK6zaHaZrq8_6ugD9nZHhABINzh8HtgleKQgqAHoAHmuJvJA8gBAqkC2WlGliRiYz6oAwHIA8mEgAKqBNwBT9CVRExsh7HwM-DIfce9uw2QCHx5b0HsmZCvvcrngq_GH-bFh-TaY1ihLJ8-Xi2F3Vji93rrFGZ6Q3DDVD4P7wAGw2oe8Gi8tYfPPSPGJhSSKhBOKERQQIrZGEItsgFAAWW-Raqa_lcMOBVusIaVzTElnd_ZfCbWiepgDK62mPC6RIzLFzPJPPN5YMbAXHSzCqbHn6Zt-RzHNwj4kA9PbDztL0C_50WAbQNWJ8UK6a4Y1e8SLH81nZua9FhcF1plKA6KP32OPsWD69-ywbNgRMxRafRydgIgTOR8NcAE97Khwe8DkgUECAQYAZIFBAgFGASgBgKAB6mL6_ICqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ8OMN0ggJCIDhgBAQARhfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTI3ODYyNTEzOTg4MzU4NDgYAA&sigh=nwBFYe2S_FU&uach_m=[UACH]

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 01 Dec 2021 02:05:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 209D 67 B
91 B 8ms
7ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 30 Nov 2021 18:14:59 GMT
x-content-type-options: nosniff
server: cafe
age: 28241
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Wed, 01 Dec 2021 18:14:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 209D 119 KB
36 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 02:05:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 209D 15 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:03:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 02:03:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 209D 0
0 19ms
19ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTfWaTetWnNcNgv6Vfyem_ko7uDAnQMPG6847R-jk6LbFDhLvGbA9um5aAtg_iDQCUXT2_E3JU5eslUubjA4Jhg4lkFVg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 209D 27 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0072f2a89bd32697c990a647ce4577265131df2f7d089ecef8eb14d50abdfb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35957
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11327
x-xss-protection: 0
server: cafe
etag: 10656063359522146397
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Dec 2021 16:06:23 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C176
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOqSnJJ442PzsT83XgIJ_kE&google_cver=1&google_push=AYg5qPJfKnofm60WHucd6J3UxyT8hVgc5PQe0JHYV6SzI5t6s2u1HIw3Nh...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJfKnofm60WHucd6J3UxyT8hVgc5PQe0JHYV6SzI5t6s2u1HIw3NhreLnmDVumWpjCVs1YUwAMbs8sQoa-YdOyScmqgnoA&google_hm=CuGGYAb...

170 B
188 B

20ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJfKnofm60WHucd6J3UxyT8hVgc5PQe0JHYV6SzI5t6s2u1HIw3NhreLnmDVumWpjCVs1YUwAMbs8sQoa-YdOyScmqgnoA&google_hm=CuGGYAbMVUFgIN8exLjU5g

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJfKnofm60WHucd6J3UxyT8hVgc5PQe0JHYV6SzI5t6s2u1HIw3NhreLnmDVumWpjCVs1YUwAMbs8sQoa-YdOyScmqgnoA&google_hm=CuGGYAbMVUFgIN8exLjU5g
pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C176
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIRDS6x...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIRDS6x...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDAxNzE1NjI1NTAzMw%3D%3D&google_push=AYg5qPIRDS6x6ZurGZlSDLTLDjdWD-ce9XNg23J56Wh7foH1INQv51_SeQq2coR6LhKows...

170 B
188 B

26ms
25ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDAxNzE1NjI1NTAzMw%3D%3D&google_push=AYg5qPIRDS6x6ZurGZlSDLTLDjdWD-ce9XNg23J56Wh7foH1INQv51_SeQq2coR6LhKowsSH9jn1Un7TMewtxowRWmZ_GFs4OkY

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwMjA1NDEwMDAxNzE1NjI1NTAzMw%3D%3D&google_push=AYg5qPIRDS6x6ZurGZlSDLTLDjdWD-ce9XNg23J56Wh7foH1INQv51_SeQq2coR6LhKowsSH9jn1Un7TMewtxowRWmZ_GFs4OkY
pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 01 Dec 2021 02:05:41 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame C176 43 B
64 B 30ms
21ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFkSzepBmICrOIVKYn4FHMc&google_cver=1&google_push=AYg5qPIMYKNRa4ssAo4tlEMLEAy3JFP_pLX_krrL39gm729Xn7M3odo3qayARKYG1PyGvrimx-CkCKv6ecmTqNUe33C2-1LeKms
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:39 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 1blr8i8eb7qm4k25v8o2uamkeo3cbp4s

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C176
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPINDGNnufOcoTdhCotJ44xDRo6JoV4Jovq6lakiIhqQrL65JFmJWpUnlIC4HY4ka6RZG2YX-UyRzqs_gf94kpW_nPng_Q

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPINDGNnufOcoTdhCotJ44xDRo6JoV4Jovq6lakiIhqQrL65JFmJWpUnlIC4HY4ka6RZG2YX-UyRzqs_gf94kpW_nPng_Q
date: Wed, 01 Dec 2021 02:05:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C176
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEP4Sz_sXx1I8p2y90ivJvJ8&google_cver=1&google_push=AYg5qPKEloLlukuHNmXkAhM__x2DwrWbGXKw-lVepxrSnXJ4bVwNIkNGX23cGkZPwmHZZTE8lrA...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGV1ItMVItNFBURA==&google_push=AYg5qPKEloLlukuHNmXkAhM__x2DwrWbGXKw-lVepxrSnXJ4bVwNIkNGX23cGkZPwmHZZTE8lrAfZVOTg8adYBzaScGzxBMWaQ

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGV1ItMVItNFBURA==&google_push=AYg5qPKEloLlukuHNmXkAhM__x2DwrWbGXKw-lVepxrSnXJ4bVwNIkNGX23cGkZPwmHZZTE8lrAfZVOTg8adYBzaScGzxBMWaQ

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBGV1ItMVItNFBURA==&google_push=AYg5qPKEloLlukuHNmXkAhM__x2DwrWbGXKw-lVepxrSnXJ4bVwNIkNGX23cGkZPwmHZZTE8lrAfZVOTg8adYBzaScGzxBMWaQ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame C176
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iH...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame C176 43 B
295 B 617ms
178ms Image
image/gif 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEC1Anyj1dBs8fWu3JcJaC1w&google_cver=1&google_push=AYg5qPKEnt2xncUaGJ2-78j6OWFSzmOHaclkvkodroVZMlPywlAi5rgtCd_zRHSCyOhJBPY2M6o7c7sDryYginnqnCXiMBrS5JQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C176 0
12 B 17ms
16ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KRtw95ececNg-S1nKb9FBEv4w2qVhqs_bRKb7mYhTVesqXPa7w1N5F67yBgxE6vrekiTI7

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 127C 0
0 50ms
49ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CcwNldNimYZK3Ccmb9u8PwvaguAe3z4jtZtyLza66D5uuy4jSKhABINzh8HtgleKQgqAHoAHxp_CbKMgBCakCZ3BdLDg-sj6oAwHIA8sEqgTeAU_QstWGeo5Fq94uFzgj_-oM-uAxgygvjJjA2vL0mbuLARru2sT7lOfjzubrLq4ZHABCb9uihUWJH4ZClWamzAt6mQrKXF_yATUXoEnbA0kMBdl9yDC-Yuw_JwtfO_eR70sEQ_CBCdM4VGNrSOOeJ5SxlhH7sIfLqr7fONWsmo4TY37YSSSDuWVy2w0sOeFdhiSlCeNnc6t-4kHy0VGd34zGxbcKaGoMvaWy-d8mfPipySLZ8zeo4JQ8lRsMlZyhmMhMhDM6bKllALdFr_l-ugTkNBGT483vO9XIT5Kg88AEpc6EheUDkgUECAQYAZIFBAgFGASgBi6AB6DvtIIDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQu5wW0ggJCIDhgBAQARhfgAoByAsBuBOIJ9gTDdAVAYAXAbIXHAoaCAASFHB1Yi0yNzg2MjUxMzk4ODM1ODQ4GAA&sigh=kTYW4x1Qteo&uach_m=[UACH]&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 01 Dec 2021 02:05:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/1582029642749749123/ Frame 127C 24 KB
24 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1582029642749749123/downsize_200k_v1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a39a88721eaa00d1d84b1e7528c5ddcebf182ce68b8d25b184f3cea0226687c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 09:40:55 GMT
x-content-type-options: nosniff
age: 59085
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24640
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 15:27:00 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 30 Nov 2022 09:40:55 GMT

GET
DATA 200
OK truncated
/ Frame 127C 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0598 143 B
163 B 8ms
8ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 01 Dec 2021 01:58:29 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 64CE 1 KB
749 B 8ms
7ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 05:53:44 GMT
expires: Wed, 01 Dec 2021 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72716
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5556 1 KB
749 B 9ms
7ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 05:53:44 GMT
expires: Wed, 01 Dec 2021 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72716
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E2EE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

27ms
27ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 02:05:41 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 02:05:40 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/11923164981480175886/ Frame 97F3 14 KB
14 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11923164981480175886/downsize_200k_v1?w=600&h=314

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51705f86c256b05aa4422b86e91bb773e6903c0eea20c786108fae629544db78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 03:44:37 GMT
x-content-type-options: nosniff
age: 598863
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14212
x-xss-protection: 0
last-modified: Thu, 12 Nov 2020 16:10:01 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Nov 2022 03:44:37 GMT

GET
DATA 200
OK truncated
/ Frame 97F3 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a7a511e5ae757f6b2d2df48ef759adae30ff648f4356316dd330178617bfbe3f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame 6D3E 35 KB
13 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 18:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 18:23:24 GMT

GET
DATA 200
OK truncated
/ Frame 127C 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 35d9fbd8c71b4c95e4d9831007a9450a9561cb6fa04705abaf4558e275f0eb03

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2CCD 1 KB
749 B 7ms
7ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 05:53:44 GMT
expires: Wed, 01 Dec 2021 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72717
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 97F3 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7d5e7b8cb2282b90b34fc9d24ac988ba317c9747a1c832744d86e8da0be0f6b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 127C 21 KB
22 KB 31ms
7ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:54:46 GMT
x-content-type-options: nosniff
age: 33055
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 30 Nov 2022 16:54:46 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 127C 21 KB
21 KB 36ms
14ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 18:21:26 GMT
x-content-type-options: nosniff
age: 114255
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 29 Nov 2022 18:21:26 GMT

GET
DATA 200
OK truncated
/ Frame 209D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e672d28ad8310e422e0fee00f9190d015f65cbc68eb2e9bc785f05f11b5bcf6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 97F3 21 KB
21 KB 43ms
21ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:54:46 GMT
x-content-type-options: nosniff
age: 33055
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 30 Nov 2022 16:54:46 GMT

GET
H3 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 97F3 21 KB
21 KB 42ms
21ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 18:21:26 GMT
x-content-type-options: nosniff
age: 114255
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 29 Nov 2022 18:21:26 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 64CE
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOkSfwrOqBbgBF-165Lru0U&google_cver=1&google_push=AYg5qPJHPWfdLV8Q0kYijz_YHcO9JbiQaH-7MyQhVzWFSdX-o3pyEwHTPt...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJHPWfdLV8Q0kYijz_YHcO9JbiQaH-7MyQhVzWFSdX-o3pyEwHTPtdPfC323rAxa6hEl13WDI3qSUZeihpMAe6EHMfuVGsI&google_hm=CuGGYA...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJHPWfdLV8Q0kYijz_YHcO9JbiQaH-7MyQhVzWFSdX-o3pyEwHTPtdPfC323rAxa6hEl13WDI3qSUZeihpMAe6EHMfuVGsI&google_hm=CuGGYAbMVUFgIN8exLjU5g

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJHPWfdLV8Q0kYijz_YHcO9JbiQaH-7MyQhVzWFSdX-o3pyEwHTPtdPfC323rAxa6hEl13WDI3qSUZeihpMAe6EHMfuVGsI&google_hm=CuGGYAbMVUFgIN8exLjU5g
pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 64CE
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJ7rKyjP4jHf6HU72lJ2KOXWWcctaroJMegQAP...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFiWWRRQUFCYk5aN1ZOaQ&google_push=AYg5qPJ7rKyjP4jHf6HU72lJ2KOXWWcctaroJMegQAPjP85gUqHqpmemSNOu_O3JQ3R5np1SpBtpQ_yHwEC5U0ZFuirDzpKg50...

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFiWWRRQUFCYk5aN1ZOaQ&google_push=AYg5qPJ7rKyjP4jHf6HU72lJ2KOXWWcctaroJMegQAPjP85gUqHqpmemSNOu_O3JQ3R5np1SpBtpQ_yHwEC5U0ZFuirDzpKg50iFxw

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFiWWRRQUFCYk5aN1ZOaQ&google_push=AYg5qPJ7rKyjP4jHf6HU72lJ2KOXWWcctaroJMegQAPjP85gUqHqpmemSNOu_O3JQ3R5np1SpBtpQ_yHwEC5U0ZFuirDzpKg50iFxw
Date: Wed, 01 Dec 2021 02:05:41 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 64CE 43 B
324 B 36ms
15ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESECtbVQEmGYMNlnW63P_MsF4&google_push=AYg5qPLnrCmg3XIXi9UFyRBZdO82oKuNjCks4KEv-IkJaxBww2o_1HXj9jSSmnGX65vBR1-wIrDY_ZeFGVi1LCbirNWokGncOiNqnQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 64CE 43 B
64 B 18ms
18ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELcmNfEA_PqmFaEWcrJaTTk&google_cver=1&google_push=AYg5qPInwwf4o_QXXWerdu0LTUTrfVO7eGjb5gij1Rr3TmArofgiWbdW_JJypn1kwRkl0tNcJl5BYpV6ENun9hKAGD5D_8f3wUYeoQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 8h2670p9t3jg9nsqve6cg0jsuu66luq5

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 64CE
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

20ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKGd3Kr9jwv50ofiGtyOFYEFQaAixssET9TMRjFFG3gAt8dPy-imXTa-CmstV0ayAQQLw8RCnnCpCIlv9stHZfiX5gxMCODjg

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKGd3Kr9jwv50ofiGtyOFYEFQaAixssET9TMRjFFG3gAt8dPy-imXTa-CmstV0ayAQQLw8RCnnCpCIlv9stHZfiX5gxMCODjg
date: Wed, 01 Dec 2021 02:05:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET

pixel
cm.g.doubleclick.net/ Frame 64CE
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl6...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 64CE 43 B
295 B 291ms
179ms Image
image/gif 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEBPLLNeRLTPTTuNqIxmaHW0&google_cver=1&google_push=AYg5qPLtyevGoaEIQ2YfDpPDRtossfCBzzinajr_HiuQfR6LVG3kTtmL_jHFL0cK5g0KOgcQw4YrM5Eni0ZBgiuId15mDqBpxfBNBg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 64CE 0
12 B 15ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K2ub0M71lcwQ9lFbawkStpZajIE0VBP6tHh88M2davGn85CoMvS0gPFCKml6sVrN7U223i

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5556
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEI2xb9LSUI1wv-Fw0IXseOM&google_cver=1&google_push=AYg5qPJVPYLOzVXsu1LCefmeowaTullOZv3aRCllOqHnWtV9YSjPu-iOJl...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJVPYLOzVXsu1LCefmeowaTullOZv3aRCllOqHnWtV9YSjPu-iOJlijAl2ecUEbLug0dRtomS3rOMQwrR9KIluYK6AEe_w&google_hm=CuGGYAb...

170 B
188 B

18ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJVPYLOzVXsu1LCefmeowaTullOZv3aRCllOqHnWtV9YSjPu-iOJlijAl2ecUEbLug0dRtomS3rOMQwrR9KIluYK6AEe_w&google_hm=CuGGYAbMVUFgIN8exLjU5g

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJVPYLOzVXsu1LCefmeowaTullOZv3aRCllOqHnWtV9YSjPu-iOJlijAl2ecUEbLug0dRtomS3rOMQwrR9KIluYK6AEe_w&google_hm=CuGGYAbMVUFgIN8exLjU5g
pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5556
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPKk9vmAwEO4_CWKA4dSbu09oqRBYUPEP2W6SqZrOwGKQ-TNOPPVP9hQK3gGQ_Bodcq63c2NZqT-02PkRxHu3zQ-4KnG5PY&google_gid=CAESEPY5xWvxtKHsHyUK0Zmb4Sc&goog...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPWwm40GEgUI6AcQAEIASm9nb29nbGVfcHVzaD1BWWc1cVBLazl2bUF3RU80X0NXS0E0ZFNidTA5b3FSQllVUEVQMlc2U3Fack93R0tRLVROT1BQVlA5aFFLM2dHUV9Cb2RjcTYzYzJOWnFULTAyUGtSeE...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTzMwa09CUHdnakIxa2JWTGhNWDVMVDR0bmpTT3lpdFlaZ1Vnc01lRmxtYw==&google_push

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTzMwa09CUHdnakIxa2JWTGhNWDVMVDR0bmpTT3lpdFlaZ1Vnc01lRmxtYw==&google_push

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 01 Dec 2021 02:05:41 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTzMwa09CUHdnakIxa2JWTGhNWDVMVDR0bmpTT3lpdFlaZ1Vnc01lRmxtYw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3 200 dds
rtb.openx.net/sync/ Frame 5556 43 B
64 B 20ms
17ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEEuM0ksQPBdtjVkTBO4n110&google_cver=1&google_push=AYg5qPItFW9p6aPR8sDPZhMmpyUwdcpdTZ0kZus5CWqZegAgySGKPNOnJcQnsziCrtEUM5UwmNZDKO1uQogzPeB_mjDFhTRW-DU
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: cm7qm8usp0lgv54eeduc6pkaknlrsbof

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5556
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJMx9q4IDORLI4VIiQv94JqVGnYJFFLp2fQfuTjEpoJi76GRDdvzsVddPlWfWYDnBxAtd6fQG9jRaePjy5-D3l5e_Raq18

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJMx9q4IDORLI4VIiQv94JqVGnYJFFLp2fQfuTjEpoJi76GRDdvzsVddPlWfWYDnBxAtd6fQG9jRaePjy5-D3l5e_Raq18
date: Wed, 01 Dec 2021 02:05:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5556
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH_X8yUrS9SicNwutjWZxxA&google_cver=1&google_push=AYg5qPKgDUpTjocw1SCTim6u8UOGSL93lJbu91KvgpBTAmoUHpCyzCb2pfpj0KLQbpG2wUMo7QZ...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHNjktMjEtN1M5Tg==&google_push=AYg5qPKgDUpTjocw1SCTim6u8UOGSL93lJbu91KvgpBTAmoUHpCyzCb2pfpj0KLQbpG2wUMo7QZqv3OZZECBwyyM_DKmsle2iOI

170 B
188 B

22ms
21ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHNjktMjEtN1M5Tg==&google_push=AYg5qPKgDUpTjocw1SCTim6u8UOGSL93lJbu91KvgpBTAmoUHpCyzCb2pfpj0KLQbpG2wUMo7QZqv3OZZECBwyyM_DKmsle2iOI

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHNjktMjEtN1M5Tg==&google_push=AYg5qPKgDUpTjocw1SCTim6u8UOGSL93lJbu91KvgpBTAmoUHpCyzCb2pfpj0KLQbpG2wUMo7QZqv3OZZECBwyyM_DKmsle2iOI
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 5556
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 5556 43 B
296 B 276ms
178ms Image
image/gif 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEJGwU4smWu-Sf96yv2RDJxU&google_cver=1&google_push=AYg5qPJwEYB4BJ6ggvF_SBYYoCTRkns418NYCEVKNuznii-v6nUY1jgkqn59FBpPwKfPtYhLPVdWz45xGaSg-Cv5wIAdiNB79w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:d24:9302:e4f1:1619:40a6:2a5c Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5556 0
12 B 18ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ljdta2rnvJg7e6g_WJDnazcTXvvwMstAsyA2uV5HL3IfRLBunu4w436C3CUL5tMmLUhQUE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0598
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

24ms
23ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 02:05:41 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 02:05:41 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2CCD
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGWjiPbyIBZADZPO6qVhlEM&google_cver=1&google_push=AYg5qPLtvr0AtWPaRYVWvxTGp7OfBvQB4ZZ2IkhB5_iz6OcggoBRCVS-kT...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLtvr0AtWPaRYVWvxTGp7OfBvQB4ZZ2IkhB5_iz6OcggoBRCVS-kT7MRAymOpQA4qOqOwzsqYJbdAg9mWSDh8cezLmftW7Mbg&google_hm=CuGG...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLtvr0AtWPaRYVWvxTGp7OfBvQB4ZZ2IkhB5_iz6OcggoBRCVS-kT7MRAymOpQA4qOqOwzsqYJbdAg9mWSDh8cezLmftW7Mbg&google_hm=CuGGYAbMVUFgIN8exLjU5g

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLtvr0AtWPaRYVWvxTGp7OfBvQB4ZZ2IkhB5_iz6OcggoBRCVS-kT7MRAymOpQA4qOqOwzsqYJbdAg9mWSDh8cezLmftW7Mbg&google_hm=CuGGYAbMVUFgIN8exLjU5g
pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 2CCD 42 B
189 B 26ms
15ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLTjtrEDlI3eZR-0jIZA8s79NweWfo0mVZrG6Ow4dWpAJEqMWTe618CbnsDVSyqEgqKP9YO0AkmLGgUrUgOXq0b4CrZyXO8&google_gid=CAESELghEIHUDNZjvuENU1cYoBA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 02:05:41 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3 200 dds
rtb.openx.net/sync/ Frame 2CCD 43 B
64 B 18ms
17ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJvZJ_hNL5d686pSyRy44z8&google_cver=1&google_push=AYg5qPK_Ppxg_Fv2XgDP-hgPqjmHbmbIljmpJj2INdi9nU7W2J3tsmZwxvm4rqvNEx7hXODsz64O_2pDMl1VghFFOAVRpy-QaFdmtA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:40 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ej9pltggrqc2srfrceip7cjspsm2imek

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2CCD
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPImaUPOunVXtteOSzRU-oj0PLZ52eRaH6dprOzlJr0N5hzHDIxheJdrOsDyTqD3W0gyHBytDfe53ZQc4TE9z2HZA4Ykqn78Gg

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=s52sU-mOSs6DzBX7a4GbCQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPImaUPOunVXtteOSzRU-oj0PLZ52eRaH6dprOzlJr0N5hzHDIxheJdrOsDyTqD3W0gyHBytDfe53ZQc4TE9z2HZA4Ykqn78Gg
date: Wed, 01 Dec 2021 02:05:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2CCD
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEIb00oqUe3jAzTaWu7RV07M&google_cver=1&google_push=AYg5qPLhHxga90CO2Qo2LJOKV-gYCpWVNct6G-BKh_8zJLxswgIrCgjP4TGZY--l7QoDXWt5cnr...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHN0EtMUwtNUpYMQ==&google_push=AYg5qPLhHxga90CO2Qo2LJOKV-gYCpWVNct6G-BKh_8zJLxswgIrCgjP4TGZY--l7QoDXWt5cnrfSt2P0_3Xc1nYMgD99I3DW5Deyw

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHN0EtMUwtNUpYMQ==&google_push=AYg5qPLhHxga90CO2Qo2LJOKV-gYCpWVNct6G-BKh_8zJLxswgIrCgjP4TGZY--l7QoDXWt5cnrfSt2P0_3Xc1nYMgD99I3DW5Deyw

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dNVzBHN0EtMUwtNUpYMQ==&google_push=AYg5qPLhHxga90CO2Qo2LJOKV-gYCpWVNct6G-BKh_8zJLxswgIrCgjP4TGZY--l7QoDXWt5cnrfSt2P0_3Xc1nYMgD99I3DW5Deyw
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2CCD
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekUL...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2CCD
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEEyGPMegmsMg0D9g9v9PKq8&google_cver=1&google_push=AYg5qPL4TO81LkyD7AGZJod3...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPL4TO81LkyD7AGZJod3kSqN3MceSfrG2TmCtl5gyFM-3ANyMwD9LRFjJaTal6sJWoOZNB3QE5XZrRzrNqAKZD5cFX-usKWp8LY&google_hm=

170 B
188 B

21ms
21ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPL4TO81LkyD7AGZJod3kSqN3MceSfrG2TmCtl5gyFM-3ANyMwD9LRFjJaTal6sJWoOZNB3QE5XZrRzrNqAKZD5cFX-usKWp8LY&google_hm=

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPL4TO81LkyD7AGZJod3kSqN3MceSfrG2TmCtl5gyFM-3ANyMwD9LRFjJaTal6sJWoOZNB3QE5XZrRzrNqAKZD5cFX-usKWp8LY&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 30 Nov 2021 02:05:41 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2CCD 0
12 B 19ms
17ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JQ-7Cf9m_cfxQb-8NmBEYzYADB63s_Ey_EWmTzQJzSZNlTFTZm3NOsek6mk1T8i7JF3RbLCA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 97F3 0
17 B 52ms
49ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CHs0mdNimYaLICdGH7_UPjYqu8AzhmtfQZZvnm8rKDdn4oNr4IBABINzh8HtgleKQgqAHoAGv8fblAcgBCakCFEKKLBAIsz6oAwHIA8sEqgTeAU_Qwa4WNybujQVAYuvNAQJU16mAVUjGBfhfSZ6dxD7rp3JF3Ii9IrAAsejMsl7dnr96ByR4ppvx2mnQc8dPYSsAsW_UnooFMbkj70i-drBWdg1J2Y3fq1AgX_cScQGShDKHlJFtkviasm2vHLkgd5Muk4kQz9SRmtxCE-3HIlu12EtGLwQkMlN8NCiDrzaatnlS3635R_ha1QZY_YXzpVTJt2512wnXW_8z3SYZ0DUZKgvNwH7gQAFmSxQUp55YFGHqlw7SXDmajBXfz1tm9cweGDnaj2M3DaNQXdkFqsAEq97k7sEDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB-KoiZoCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQ4t4P0ggJCIDhgBAQARhfgAoByAsBuBOIJ9gTDYgUBtAVAYAXAbIXHAoaCAASFHB1Yi0yNzg2MjUxMzk4ODM1ODQ4GAA&sigh=uE_RC1IN8kw&uach_m=[UACH]&template_id=5000&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 01 Dec 2021 02:05:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame 95E6 35 KB
13 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 18:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27737
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 18:23:24 GMT

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame 586F 35 KB
13 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 18:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27737
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 18:23:24 GMT

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame DE65 35 KB
13 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 18:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27737
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 18:23:24 GMT

GET
H3 200 dead-by-daylight-leaksbydaylight-dbd-behaviour-amazon-prime-gaming-halloween-scream-5-chucky-winter-event-jeepers-creepers-leatherface-hellraiser-nft-433x228.jpeg
www.leaksbydaylight.com/lbd-images/ 26 KB
27 KB 21ms
20ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-dbd-behaviour-amazon-prime-gaming-halloween-scream-5-chucky-winter-event-jeepers-creepers-leatherface-hellraiser-nft-433x228.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: 9b3534f708364db29770ee2855314a59a5c4b3f2e2e5838186974ebad8ad6ffd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25525
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07d4b676987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 26753
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 24 Nov 2021 22:25:53 GMT
server: cloudflare
etag: "6881-5d190574ab468"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vXLAggjgB%2BIU24T22oXdjzFKWa2y2BVdmpHQQ%2BEIPkWStDYZFbv35P3cWXBHIPtfBhh%2F0Qj7iircKxbMwgKW6Rpsp9eIc%2F25Mq67zPvbiEKSEyMfpsdO1HsPNsA%2BzcMeq%2FQraIn0bJ%2BA2gHK1w6A12lSCzcY7g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 61703302
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-ghostface-scream-5-dbd-behaviour-leaksbydaylight-halloween-chucky-netflix-stranger-things-netflix-resident-evil-capcom-halloween-silent-hill-sony-playstation-433x228.jpeg
www.leaksbydaylight.com/lbd-images/ 21 KB
21 KB 19ms
18ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-ghostface-scream-5-dbd-behaviour-leaksbydaylight-halloween-chucky-netflix-stranger-things-netflix-resident-evil-capcom-halloween-silent-hill-sony-playstation-433x228.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: f059bf8e766e675911d825ea6115b13506cf2b0303d4cf52e0a8c9354b59f9a4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25522
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07d4b6a6987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21184
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 19 Nov 2021 14:52:31 GMT
server: cloudflare
etag: "52c0-5d1256cb4e91a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VhdMAsNulFoS1mGhsEmNdQtEXg0lV4j4hxg57lvknkhkYpkuEx6CQ0OubY%2FZV7zFryExw7zAw9xP0KakcbUeoXIsGey4JksDKtOXbPxHVO8ULh%2Brp71Z1KBOskUogoCqkbb9tM%2BAq8peGHZGTIQSRQkOyY%2FOCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 51517964
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-leaksbydaylight-nft-ghostface-scream-5-winter-event-dbd-behaviour-resident-evil-jill-valentine-leon-kennedy-chucky-saw-spiral-leatherface-pinhead-hellraiser-halloween-433x228.jpeg
www.leaksbydaylight.com/lbd-images/ 27 KB
28 KB 18ms
17ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-nft-ghostface-scream-5-winter-event-dbd-behaviour-resident-evil-jill-valentine-leon-kennedy-chucky-saw-spiral-leatherface-pinhead-hellraiser-halloween-433x228.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: aa03f662e95aa42c3cb70c4b5604cd7cfa5e095396bb6b62684c3c4ee3e2a773

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25523
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07d4b6b6987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 27776
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 10 Nov 2021 23:38:07 GMT
server: cloudflare
etag: "6c80-5d077b7d8d830"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=niCiU8KuE12b6kL6%2FuYW9F2ccOh3hsc%2F%2BNf1%2BugbLxkrwV9vrBvgbje52NXL5tHB7KN9pz19KR8f%2Fnoaf9QBS7%2BH%2FemxlwuWFm2QbqQNnZGoA9iyiro69ERMJ%2B7rQBGZYTx%2B%2FAMH2Gpi9oef%2B%2BATkLzSUY9Z3g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 62358506
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 dead-by-daylight-leaksbydaylight-scream-5-ghostface-saw-spiral-leatherface-behaviour-winter-halloween-kills-michael-myers-dbd-winter-event-sale-chucky-tv-series-433x228.jpeg
www.leaksbydaylight.com/lbd-images/ 24 KB
25 KB 13ms
13ms Image
image/jpeg 2606:4700:3036::ac43:ae59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.leaksbydaylight.com/lbd-images/dead-by-daylight-leaksbydaylight-scream-5-ghostface-saw-spiral-leatherface-behaviour-winter-halloween-kills-michael-myers-dbd-winter-event-sale-chucky-tv-series-433x228.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:ae59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / W3 Total Cache/2.2.0
Resource Hash: b88a661a3c7d05252c71e10d239712907913a342812c60ccb17e7130c84ca8f9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
via: 1.1 varnish (Varnish/6.0)
cf-cache-status: HIT
x-cacheable: YES
age: 25525
x-powered-by: W3 Total Cache/2.2.0
cf-ray: 6b68c07e2c476987-FRA
x-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 25057
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 30 Nov 2021 18:46:56 GMT
server: cloudflare
etag: "61e1-5d205fb56e35c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ldFKbUx6iRnxmfe1weMcDlti%2B0xWpHkiCM5P0cQBppHi%2Fmck%2BQPPcX0lVP8y5%2FR2yLeFlOQ%2FLTN%2BVgTWUZpcTR5t%2B7xLnwXRMc7VMjPzUYwbpc5lfABDPW%2FNZRCHIsaS100fii7nO4PNUUrWV%2FiKsmExY3bLBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-varnish: 56135264
cache-control: public, max-age=31536000
accept-ranges: bytes
content-type: image/jpeg

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 23ms
22ms Stylesheet
text/css 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 452
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=259200
cf-ray: 6b68c07e486e6904-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 04 Dec 2021 02:05:41 GMT

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/c335de27-0526-4ec8-b1dc-5839d1a5e101/ 192 B
618 B 340ms
317ms Fetch
application/json 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/c335de27-0526-4ec8-b1dc-5839d1a5e101/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6ce08cd9110b7a06a7a0f6ce679a2d8dd28ae90be862e8af640a2cbfb3d87fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
status: 200 OK
x-envoy-upstream-service-time: 126
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: bc532200-42f1-4217-a3db-15837b6789cf
x-runtime: 0.068092
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"f6ce08cd9110b7a06a7a0f6ce679a2d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 6b68c07ecb4b375b-MXP
access-control-allow-headers: SDK-Version

GET
H2 200 1e6cae78-e7cc-44d3-87a9-37adc4d8ce20.png
img.onesignal.com/permanent/ 74 KB
75 KB 35ms
26ms Image
image/png 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.onesignal.com/permanent/1e6cae78-e7cc-44d3-87a9-37adc4d8ce20.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec51440f714e2d33aeaf1d4317d6471d0a0e10fccedd4f3a784ef4a7bb30e259

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.leaksbydaylight.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 02:05:41 GMT
cf-cache-status: HIT
age: 1829
x-amz-meta-cache-control: public, maxage=604800
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 75940
x-amz-id-2: vkctqPm4FgQOPRMCEudMXMbyn5Mn999NFdwxANKuQKWy1nK82Vq/SgKNsPUTKD8SgVW3Crro0jI=
last-modified: Mon, 03 Aug 2020 12:04:48 GMT
server: cloudflare
etag: "8c129a6ab7c43c36bb5bbb9e92f22048"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: EQCSRNVSX43QB0H4
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 6b68c080db6b5a43-MXP
expires: Sat, 01 Jan 2022 02:05:41 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 127C 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsucc9-C08_4zcjhSrpXt2z-abnStd2005RVLEspWb_-Yi_jsjSeRuGKDrV822vVo2MCg5pOks_QIL1K8UbDX9KXmIah8VMlwzBaCllAYF91hfmeodmM_A&sai=AMfl-YQYCwU6oeNwAEXMEL2KopGpi8aOKe0Xo7lQNZmxXGH6WrwKlD4-19FgOs7A5WpHKPDpMXFs5_7pgsmyT7Oyof0qlOeEUvZiQ5Eq1KmFzYaai5OBzmK3R6biOEM&sig=Cg0ArKJSzLi4eLxhlwqQEAE&cid=CAASF-RoMOlZKewhDetfJn6QU0mV58AxxiQb&id=lidar2&mcvt=1001&p=0,0,280,1170&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=3577313618&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638324340130&rpt=1088&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 97F3 42 B
64 B 50ms
49ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsspShUikfOqhIfSECUlURIEiyOreYvYXDqwanJivY2uKYS5OFhm8RmQGV9Dt4iUy-iZiXMo4RE8AB6-Ag-golFU913P6I-zBP_IZtwRlsQ7z0yhqh209pjFTQO694rn87j7pXBDhEPWTxHo&sai=AMfl-YSFUSvR28qzkiPxIHh6rR0Er3GxgqqxBs6rNxACxXbWFLK1v3ZoEO79GaqHE--KRbBWxFO4CY675aZBTiCnhznIhdjVRi4O-e0RF22dOQeCkvj_8P9qKLdKyGQ&sig=Cg0ArKJSzBvXUXPuY-EzEAE&cid=CAASF-RoN6ku7bBtVZvip-t-0nLBV4HOe1FY&id=lidar2&mcvt=1000&p=0,0,280,1170&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1301495198&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638324340133&rpt=1107&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 02:05:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=6786654682&adk=3577313618&adf=2694351078&pi=t.ma~as.6786654682&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=3&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=vZn22hlAOf&p=https%3A//www.leaksbydaylight.com&dtd=15

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=1325980072&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=kiWqKuLaOw&p=https%3A//www.leaksbydaylight.com&dtd=40

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=3932384672&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=1762&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=fZWQCZlqj3&p=https%3A//www.leaksbydaylight.com&dtd=44

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=3310637626&adk=1301495198&adf=4020494109&pi=t.ma~as.3310637626&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1097&idt=0&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2072&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=2Bm8uJRbPB&p=https%3A//www.leaksbydaylight.com&dtd=49

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2786251398835848&output=html&h=280&slotname=2358672120&adk=306641003&adf=2511699804&pi=t.ma~as.2358672120&w=1170&fwrn=4&fwrnh=100&lmt=1638324302&rafmt=1&psa=0&format=1170x280&url=https%3A%2F%2Fwww.leaksbydaylight.com%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638324339878&bpp=1&bdt=1098&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D147c177d11b10cae-221dd5181ccc00c2%3AT%3D1638324339%3ART%3D1638324339%3AS%3DALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA&prev_fmts=0x0%2C1170x280%2C1170x280%2C1170x280%2C1170x280&nras=1&correlator=3392548976435&frm=20&pv=1&ga_vid=1126393279.1638324339&ga_sid=1638324339&ga_hid=2092865048&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=215&ady=2382&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063751%2C44753742%2C31062422%2C31063694%2C31063793%2C31063825%2C31063182&oid=2&pvsid=48870538119826&pem=870&tmod=1344903306&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=l8RUoDJLM3&p=https%3A//www.leaksbydaylight.com&dtd=74

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8

Verdicts & Comments Add Verdict or Comment

124 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.leaksbydaylight.com/	1970-01-20 08:27:00	Name: __gads Value: ID=147c177d11b10cae-221dd5181ccc00c2:T=1638324339:RT=1638324339:S=ALNI_MZo6K7b0_C2rUwtiJtaUkVidsNFNA
.quantserve.com/	1970-01-20 01:15:00	Name: d Value: EFEBCQHtJIEA
.quantserve.com/	1970-01-20 08:35:38	Name: mc Value: 61a6d874-a37be-a62cd-b34f9
.doubleclick.net/	1970-01-19 23:05:27	Name: DSID Value: NO_DATA
.pubmatic.com/	1970-01-19 23:06:50	Name: KTPCACOOKIE Value: YES
.casalemedia.com/	1970-01-20 07:51:00	Name: CMID Value: YabYdLOc8H4lvFEtP9.6.gAA
.casalemedia.com/	1970-01-20 01:15:00	Name: CMPS Value: 5206
.doubleclick.net/	1970-01-20 08:27:00	Name: IDE Value: AHWqTUkIQ7EpLnSCyJTKBSLkl9SKI77Vj4eMqSv9XznlpYBt4bMtm-2rimzparOxnX4
.pubmatic.com/	1970-01-20 01:15:00	Name: KADUSERCOOKIE Value: B39DAC53-E98E-4ACE-83CC-15FB6B819B09
.casalemedia.com/	1970-01-20 01:15:00	Name: CMPRO Value: 1165
.e.dlx.addthis.com/	1970-01-20 08:35:38	Name: na_tc Value: Y
.addthis.com/	1970-01-20 08:35:38	Name: na_tc Value: Y
.dlx.addthis.com/	1970-01-19 23:48:36	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-19 23:48:36	Name: na_sr Value: 20211201
.dlx.addthis.com/	1970-01-19 23:05:24	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-19 23:48:36	Name: na_sc_e Value: 0
.casalemedia.com/	1970-01-19 23:06:50	Name: CMST Value: YabYdGGm2HUA
.rlcdn.com/	1970-01-20 07:51:00	Name: rlas3 Value: DbYwJ4lGad6/xV8PGEI0gDSmkPNBSAKGblQ9VuSh1SY=
.rlcdn.com/	1970-01-20 00:31:48	Name: pxrc Value: CPWwm40GEgUI6AcQABIGCOndKhAA
.addthis.com/	1970-01-20 08:35:38	Name: na_id Value: 2021120102054100017156255033
.addthis.com/	1970-01-20 08:35:38	Name: uid Value: 61a6d875f7a7bd18
.addthis.com/	1970-01-20 08:35:38	Name: ouid Value: 61a6d875000117aa1ee2a640e5c882440da5203f58e2ded96ddf
.innovid.com/	1970-01-20 01:15:00	Name: uuid Value: 5bf5de6a-98f2-4a6f-986f-310cf41380cd-20211130 21:05:41

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPJRxUiYDUUNNjm-lOwuwm3A4jXwL9x0fJtaps7SqqDSPyM4XH0Cx88kmopJCeP_XUb_ioznJrptkI016Smu9Zu44sEdWRs_bA&google_gid=CAESEGmOC59DKv80WS1rJFweOfg&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPI1zd6GYtseTrTgcGnxu3NHrtQj0cjW00cIhv-JjRSLTPlw4PjTddVOCLq6NTs-BUzJnGcFpJ51iUp-oiw9iHykaUo_BVs&google_cver=1&google_gid=CAESELY_VIA_VbdQijFYoBmMAvU Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKBn6ok1h8mvsw1Vt0anAg265PTKOVSHO82Lg_kTGwKmncIGTYXHMhQdZ-ef5EgJO6J-AgrlZSIfNmKQyvgl69KC4gtoarZvQ&google_gid=CAESEAREBRq4RsKwmAPOxtHB2Ys&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPKMItBljFjUtMmfAaE-a5dGgkyCfHjOdRzCLpZVw6OjgzWt8nLDShtT_bJEP4LmvMfu0yEyxw1oidDRymekULkwg41WgkGTPQ&google_cver=1&google_gid=CAESEBRTrLjo3-zSPSX6tz_UWZ8 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YabYdLOc8H4lvFEtP9-6-gAABI0AAAIB&google_push=AYg5qPIqCDC_HlFEWnXUzK8xrOuGPeuxOd4ZbLt1ge4uzhs3ilo49f7c4vcz4j-qYK8dMo9RpwwlnlAg_tLn9X8uzH0gwLz0BKY&google_gid=CAESEMUJho2nTpmMesU8hymknIM&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
ajax.googleapis.com
cdn.onesignal.com
cm.g.doubleclick.net
cms.quantserve.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
id.rlcdn.com
image6.pubmatic.com
img.onesignal.com
odr.mookie1.com
onesignal.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
rtb.openx.net
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.leaksbydaylight.com
cm.g.doubleclick.net
googleads.g.doubleclick.net
104.111.215.191
142.250.184.226
142.250.186.66
198.47.127.19
2600:1f14:d24:9302:e4f1:1619:40a6:2a5c
2606:4700:3036::ac43:ae59
2606:4700::6812:e134
2606:4700::6812:e234
2620:116:800d:21:3175:5196:e3fd:8c1d
2a00:1450:4001:808::2003
2a00:1450:4001:810::2002
2a00:1450:4001:810::200a
2a00:1450:4001:811::2002
2a00:1450:4001:812::2004
2a00:1450:4001:827::2002
2a00:1450:4001:829::2001
2a00:1450:4001:82b::2003
2a00:1450:4001:831::200a
3.221.239.181
34.98.67.61
35.227.252.103
35.244.174.68
69.173.144.138
79.137.68.187
0072f2a89bd32697c990a647ce4577265131df2f7d089ecef8eb14d50abdfb36
04e6fb814fccce3a0aecb83be0bc24665cf3e6a5e993f296471a63708f63e138
05268eb864450f188c3e1a7232680e914acae87392df03a0811e9a40f43fdfab
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
13e044ca703a01a7e376551ac09e8b5763bba33f5f2086e1449ea0db8a2fa3a6
155963e3fb06f13011705c65bc52ed31f9989b87309c945948a76b35f8e7da67
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
20a432e2be37dca0082730c390f55793df25d2aa3526cfb98c5118163a4b61c2
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
2735b19f236d9020b07d646f4a63c7545f1d287059d411235ff0d7f743d5ff36
293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b
2a54da31e7467773a914eea11a5f58d3e021ed43c029d17e96207cf3a4919114
2b79cd45fdba003c6754cc201454970df0d4e6c6beb7dc0ae67f32c1e4d3fca4
2d42a0c03f4fe9a2c65b41236010fb4be3b0c7a412f7ffa25640c3e6f3250308
2d573b709aa14ca7bf49c1b525bf594b26b89761e67014d87e721da328b05113
2dd2690baf3e0ef68505ad27bb6e22c65abeea4f07a826e743edae8829ea0493
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
32c21e51a780e7efc510466779e8f163da04f4d1cfc4e13ce1f79bd4427b6b79
35d9fbd8c71b4c95e4d9831007a9450a9561cb6fa04705abaf4558e275f0eb03
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
3e672d28ad8310e422e0fee00f9190d015f65cbc68eb2e9bc785f05f11b5bcf6
4d27aaaf5713d4e6a8f55b9abdc1300061c06897d83f8e6a0126051dc0cc5bc0
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
51705f86c256b05aa4422b86e91bb773e6903c0eea20c786108fae629544db78
55b4a8ebd4ce4144242d6bb9d0ebb65a01b2759e67243ed5badc3ac96c6fd396
5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274
5e686c187417b6566beef3fdabd73cf6cd27cc66e99d8cd51d9aef7c4648dec6
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
6ca4bc4d8ef6522fea69046415b349a076c9829aeb7f35edc3250b1a2b00465c
709eb2646045e85b4953d91eb9ae2753e9386bea945e829504a9db1f12bbba91
73def94bc81c2ce10a063cac4d719db63b63dea833d7b0ae0f2fba37ed8b5a77
773aa3cda26338c8ade519d71ff737ed8de7cb6a91a0970165ad8585106efa45
7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7
80212a42620d88102487645bfe846d41f2cede532e3eab317904104891ca3780
8142b2459179e71227f471b1d5a00a5638eb51c8aaf079f46f2c2faafc107fad
838259504b70b5a23d07a6825b1b352ee5860555a0e5ff611ce9da993ed0f701
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8d5250c5f5cf6724a10a215296a8091d3a29f724bfe4a395ee09882288fc0f01
8e135b84a2331c593045726188013af7e487bc8cb383c38cfc3e27adca35381b
90d481eecef21cebb9f0fcc30bc378bce5f81f2835b8605a4fef27e0311ac015
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
9604bca90e10bff23e641a5538bf2c83eed7a3ff62b951b6044f7379351ee3bf
9764b47bf4cfd9926196b7b456ae74db8cc1af1c524e099df3dfe28a852751a7
97f65dbb9a44c48c442f1e2787559a418e4706cb5c6cd191d2d5c9cefcd9c229
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b3534f708364db29770ee2855314a59a5c4b3f2e2e5838186974ebad8ad6ffd
9b4508ec0a8606f1dec41e87b613eb0db23d3871617dc9537bbd21a4dc8e90b2
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a255b8afb68732995e757b44114fa5d094410d1e2f9975da39954a49af24d35c
a39a88721eaa00d1d84b1e7528c5ddcebf182ce68b8d25b184f3cea0226687c3
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a7a511e5ae757f6b2d2df48ef759adae30ff648f4356316dd330178617bfbe3f
aa03f662e95aa42c3cb70c4b5604cd7cfa5e095396bb6b62684c3c4ee3e2a773
b3d774d3d9ea205c5d9909f8bb38cfa5433a5b2b03386f784638e9f5d07207ac
b412ac247f5114876ddc6778b53bdd6e72f41bdf0e59a03d6bb42e2d20a6cd40
b460d8b83e6f7ba537d2720feb7b2fc8fc18b6ec2852b0834ddcab87bfaf78a4
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b5aa101692924924388cbdf85855567381dfdcd504c500bdb9e353bd7c0999a3
b88a661a3c7d05252c71e10d239712907913a342812c60ccb17e7130c84ca8f9
ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07
ba83c227cde7d4c34fb514ccd483305e8dfef365e6b2b70a126f2d73adaa1691
bc78176b4c15aa7ca9293569bc175161863bfc1f145dd5f066a978968ad34760
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
c469fe0f1ce35236031c0206edb53f97a257f82c6764dddd20ed58e5c6b62556
c4fada4accfa24704b54248bc5ce84acac50b6a059828b7714fe3006786c80c1
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
c8d540bdbf723d49142454c58e9cfa40c4993c05b0a1cf77cbb6a6121a2ba2b6
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cfaa0cde0093b0ec4a6b0e211306c5c195a56ae0a2a6246d0a38b53f3e3f814a
d6c75baf532dc2ea955da5dc642f31103d1ee99a763c021a6217a4dce6394d69
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dceda745a0fb58233a95eff6d10796026df6792cb960cdf675eb7b8a6750a2d2
de161d522a8c9e8414f97cf0eabe91fd7cef0edda04a1073b4548606b3e17bd9
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7
ec51440f714e2d33aeaf1d4317d6471d0a0e10fccedd4f3a784ef4a7bb30e259
ed5ddfe8b934ade2a866b7ef1a992b0d30b84b777feae315fb0437f95c9475b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f059bf8e766e675911d825ea6115b13506cf2b0303d4cf52e0a8c9354b59f9a4
f2d6f8a57218c5b1a21fe3e8a7315624524f71efca6abb88da9be6c8d38b55d9
f6ce08cd9110b7a06a7a0f6ce679a2d8dd28ae90be862e8af640a2cbfb3d87fb
f7d5e7b8cb2282b90b34fc9d24ac988ba317c9747a1c832744d86e8da0be0f6b

www.leaksbydaylight.com Open in urlscan Pro 2606:4700:3036::ac43:ae59 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

182 Requests

84 %HTTPS

58 %IPv6

20 Domains

27 Subdomains

20 IPs

3 Countries

2854 kBTransfer

6250 kBSize

23 Cookies

4 Outgoing links

Page URL History

Redirected requests

182 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.leaksbydaylight.com Open in urlscan Pro
2606:4700:3036::ac43:ae59 Public Scan

Screenshot
Live screenshot

Full Image

182
Requests

84 %
HTTPS

58 %
IPv6

20
Domains

27
Subdomains

20
IPs

3
Countries

2854 kB
Transfer

6250 kB
Size

23
Cookies

182 HTTP transactions
11 data transactions